Leaseweb vs Unomed Cloud PACS

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

No public independent security audit report located on unomed.ch.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

No ISO 27001 certificate or registry entry found on the official site.

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

No SOC 2/3 report referenced on public pages reviewed.

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

Swiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

Swiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

GTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

PACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Default OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional.

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

Privacy policy says processors can be requested at any time but does not name hosting vendors on the page. Blockers for security questionnaires until the annex is shared.

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.

Even with Swiss HQ and claimed Swiss image hosting, AWS and Firebase endpoints appear in public privacy/CSP materials. Procurement should obtain the named subprocessor annex and assess CLOUD Act residual risk.

If radiologists must report from the included viewer, Unomed alone is the wrong shortlist item unless a certified diagnostic viewer is contracted.

Assurance currently rests on vendor policies, Swiss entity status and contractual ABV rather than published certificates.