Sovereignty · Updated 10 November 2026 · 9 min read

Where to host health data in Europe in 2026

HDS in France, C5 in Germany and Article 9 of the GDPR: which European clouds hold the certificates, what each one asks of you, and where an app host fits.

View as Markdown

For health data in Europe, start from the certificate your market asks for. If you serve French patients, pick a host with HDS certification: Clever Cloud and Scalingo are platforms where you push code, and OVHcloud sells HDS infrastructure you run yourself. If German care providers or health insurers are your buyers, they need a cloud with a current BSI C5 attestation, and Exoscale lists both C5 and HDS. Eurobase fits the parts of your product that never touch health data, such as the marketing site or a frontend that calls a certified backend.

Health data hosts at a glance

Platform	Company based in	What you run	Health certificates stated	ISO 27001
Clever Cloud	France	Apps and managed databases from Git	HDS, all six activities	Yes
Scalingo	Strasbourg, France	Apps and managed databases from Git	HDS 2.0, all six activities	Yes
OVHcloud	France	Private cloud, Public Cloud, bare metal	HDS since 2019	Yes
Exoscale	Lausanne, Switzerland	Instances, Kubernetes, managed PostgreSQL and MySQL	HDS and BSI C5	Yes, 2022 version
Eurobase	Warsaw, Poland	Web apps, Functions, storage and logs	None	In progress

Certificate details are from each provider's own page, checked on 10 November 2026.

What the law asks for

The GDPR, everywhere in the EU. Article 9 lists data concerning health among the special categories whose processing is prohibited unless one of its exceptions applies, such as explicit consent or medical care by a professional bound by secrecy. Everything in our GDPR hosting checklist still holds on top of that.
HDS in France. Article L.1111-8 of the French Public Health Code requires anyone who hosts personal health data on behalf of a third party to be certified. The certificate comes from an accredited body, lasts three years with a yearly surveillance audit, and the framework requires the data to stay in the European Economic Area. Our HDS guide goes through the French rules in more depth.
C5 for German healthcare. Section 393 of the German Social Code, Book V, lets care providers, health and care insurance funds and their processors use cloud services for health data only in Germany, the EU or an adequate country, and only with a current C5 attestation for the cloud systems used, or a certificate under a standard of equal or higher security. Since 1 July 2025, a current attestation means Type 2. A system first put on the market after 30 June 2025 may rely on Type 1 for its first 18 months. The BSI C5 page covers the two types.

Beyond France, OVHcloud's healthcare page cites health hosting laws in the UK, Italy, Poland and Germany too, so ask a lawyer in each country you serve before you sign.

What to check before you pick a host

Scope of the certificate. HDS covers six activities, from the physical sites to outsourced backups. A host certified for only some of them leaves the rest to you or another provider.
Which regions are covered. A certificate can apply to some zones and not others. Put your app, database and backups in a zone the certificate names.
Extra contract steps. Some hosts require a health addendum, a higher support plan or a named health contact before you store any data.
Proof on paper. Get the certificate or attestation itself, check who issued it and when it expires, and file it with your own compliance records.

1. Clever Cloud

Clever Cloud deploys apps from Git and runs managed PostgreSQL, MySQL, Redis and other databases beside them. Its HDS certificate, issued by Bureau Veritas Certification on 20 December 2024 under the v2 framework, covers all six activities and is valid until 19 December 2027. It names three certified regions in France: Paris, and HDS zones in Gravelines and Roubaix in OVH datacenters. It says no personal health data leaves the EEA.

Best for: French e-health products that want code, database and backups under one HDS certificate, deployed with a Git push.
Price: Not stated on its HDS page.

2. Scalingo

Scalingo, from Strasbourg, is a Git-push platform with managed PostgreSQL, MySQL, MongoDB, OpenSearch and caching, and its home page lists HDS as an option. It first got HDS certification in September 2022 and renewed it in September 2025 under HDS 2.0. The certificate, no. 38436 from BYCYB, runs until 11 September 2028 and covers all six activities. The certification also obliges Scalingo to keep a health professional point of contact for each customer, so expect to name one.

Best for: teams that want HDS now and may need Scalingo's SecNumCloud region on Outscale later.
Price: a 256 MB container starts at €7.20 a month excl. VAT.
What it lacks: a published price for HDS apps and databases.

3. OVHcloud

OVHcloud is a French provider that first received HDS certification in 2019. You turn on the HDS option in the control panel for Hosted Private Cloud and Public Cloud projects, or ask sales for bare metal. Before storing health data you need a Business or Enterprise support plan and must accept the OVHcloud Healthcare Addendum.

Best for: an ops team that wants certified HDS hardware and cloud under the servers, Kubernetes clusters or databases it manages itself.
Price: Not stated on its HDS page, and a Business or Enterprise support plan is required.
What it lacks: a done-for-you app platform in this offer: you patch and back up whatever you install.

4. Exoscale

Exoscale is a cloud based in Lausanne, Switzerland, and a registered trademark of Akenes SA. Its zones are in Austria, Bulgaria, Croatia, Germany, Spain and Switzerland. The compliance page lists ISO/IEC 27001:2022, ISO/IEC 27017 and 27018, BSI C5, SOC 2 and HDS. It sells instances, managed Kubernetes and managed PostgreSQL and MySQL, among other services.

Best for: health products sold to German care providers or insurers that want C5 and HDS from one provider.
Price: each product has its own rate, charged per second of use.
What it lacks: none of the products on its pricing page builds and runs your app from Git. Check which zones each certificate covers before you choose one.

5. Eurobase, for the parts without health data

Eurobase deploys code pushed to GitHub, GitLab, Codeberg, Forgejo or Gitea, and your app lives on European infrastructure run by Scaleway, a French provider. The business is registered in Warsaw, Poland. It holds neither an HDS certificate nor a C5 attestation, and its ISO 27001 and SOC 2 audits are unfinished, so patient data stays off it wherever a certificate is required.

A public website, documentation, a booking page that hands off to a certified system, or a frontend whose API runs at an HDS host can all live on Eurobase.

Best for: marketing sites, docs and frontends that don't store or process health data.
Price: nothing on the Free plan; Starter costs €10 and Pro €20 a month + VAT, covering the whole workspace. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
What it lacks: any health certificate, managed Postgres, MySQL or Redis, and builds from a Dockerfile.

How to choose

List every place health data appears: database, files, logs, error reports, emails and backups. Each needs the same care as the main database.
Find out which countries your patients and buyers are in, and which certificate each one expects.
Pick a host whose certificate covers those activities and regions. For France, compare Clever Cloud and Scalingo for apps, OVHcloud for infrastructure. For German healthcare, ask for a current C5 Type 2 attestation.
Keep anything that holds no health data wherever it runs best, and make sure nothing leaks into it through logs or analytics.
Read every tool's processing agreement and subprocessor list, and check who owns each provider with EU region vs EU company.

Frequently asked questions

Do I need HDS certification to store health data?

Your hosting provider does, when it hosts French personal health data on your behalf. According to Scalingo's compliance page, a health establishment that manages its own information system is exempt, unless it does so as part of a hospital group.

Is HDS valid outside France?

HDS is a French requirement, so it proves compliance with French law. It doesn't replace C5 for German healthcare buyers or the rules of other countries.

Can I host health data on AWS, Azure or Google Cloud in Europe?

The GDPR doesn't forbid US-owned providers, but you still need a legal basis under Article 9 and the national certificates your buyers ask for. Our data residency vs data sovereignty guide explains why an EU region isn't the same as an EU company.

What is the European Health Data Space?

An EU regulation that entered into force on 26 March 2025. It sets rules for patients' access to and exchange of electronic health records, and for reusing health data in research. Its main parts apply from March 2029, with medical images, lab results and discharge reports following by March 2031.

Can a health app run on Eurobase?

The parts that never hold patient data can, such as the website, docs or a frontend that talks to a certified backend. Patient records belong at a host with the certificate your market asks for.