The verdict in three sentences
As soon as a SaaS stores personal health data on behalf of a practitioner or patient in France, hosting with an HDS-certified provider is mandatory, and it is the reference standard for selling health software across Europe from a French base. The budget stays reasonable for a vendor: EUR 300 to 2,000 per month of infrastructure and EUR 5,000 to 20,000 to migrate from a non-certified cloud. The real cost lies elsewhere: without HDS, you lose hospital tenders and risk a CNIL fine of up to 4% of worldwide turnover.
What HDS certification requires in 2026
The HDS framework in force since 2024 (version 2) builds on ISO 27001 and adds health-specific requirements, including data location within the European Economic Area and transparency about access from third countries. The SaaS vendor does not necessarily need its own certification if it only runs the application on HDS infrastructure, but it must contractually frame every link in the chain.
| Obligation | What it means in practice | Main owner |
|---|---|---|
| HDS-certified host | Contract with a host certified for the relevant activities (1 to 6) | Vendor |
| EEA location | Data and backups stored in the EEA | Host |
| Encryption at rest | Encrypted volumes and databases, keys managed and logged | Vendor and host |
| Encryption in transit | TLS 1.2 minimum, ideally 1.3 | Vendor |
| Logging | Traceability of data access, kept 6 to 12 months | Vendor |
| HDS contract | Mandatory clauses: reversibility, subcontractors, incidents | Vendor and host |
| GDPR DPIA | Impact assessment required for large-scale health data | Vendor |
A common misunderstanding: hosting « in France » is not enough. The provider must be certified for the activities you actually use, for example activity 5 (system administration and operation) if you outsource managed services.
2026 costs at the main HDS hosts
The prices below are 2026 orders of magnitude for an SME-sized health SaaS (a few hundred to a few thousand practitioners). They include the HDS premium over a standard offer, usually 15 to 40%.
| Hosting profile | Typical setup | Monthly cost excl. VAT (2026 order of magnitude) |
|---|---|---|
| Early-stage SaaS | 2 VMs, managed database, backups, about 500 users | EUR 300 to 600 |
| Growing SaaS | 3-node Kubernetes cluster, HA database, 2,000 to 5,000 users | EUR 800 to 1,400 |
| Established SaaS | Multi-zone, HA database, WAF, shared SOC | EUR 1,500 to 2,000 and up |
| HDS managed services (activity 5) | 24/7 operation by a certified provider | +EUR 800 to 2,500 |
| Medical imaging storage | Encrypted object storage, 10 TB | EUR 150 to 400 |
| Offsite HDS backup | Copy on a second certified site | EUR 80 to 300 |
OVHcloud, Scaleway and Outscale all offer HDS-certified services, with different service levels and support. The French regions of some US clouds are also certified, but exposure to extraterritorial law often comes up in public tenders, where a SecNumCloud-qualified offer can become a criterion.
Migrating to HDS hosting: budget and timeline
Migration is most of the one-off effort. It covers auditing the current setup, rebuilding the infrastructure, switching the data over and updating compliance documentation.
| Item | Estimated cost excl. VAT | Timeline |
|---|---|---|
| Initial compliance audit | EUR 2,000 to 5,000 | 1 to 2 weeks |
| Infrastructure as code and rebuild | EUR 3,000 to 9,000 | 2 to 4 weeks |
| Encryption and key management | EUR 1,000 to 3,000 | 1 week |
| Logging and alerting | EUR 1,500 to 4,000 | 1 to 2 weeks |
| Data cutover and testing | EUR 1,000 to 3,000 | 1 week |
| Total migration | EUR 5,000 to 20,000 | 6 to 10 weeks |
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Thomas, CTO of a telehealth software vendor in Bordeaux, hosts 1,200 practitioners on a general-purpose cloud at EUR 650 per month. A hospital group asks for HDS evidence before signing a EUR 85,000 per year contract.
He moves to a certified offer: EUR 14,000 of migration and EUR 1,050 per month of hosting, a EUR 400 monthly premium or EUR 4,800 a year. First-year cost: EUR 18,800. The hospital contract alone covers that investment in under 3 months of billing, not counting the two other tenders that required the same certification.
FAQ
Does a medical appointment booking SaaS need HDS hosting?
Yes, as soon as it stores consultation reasons or any information revealing a health condition. A bare calendar without reasons is debated, but 9 vendors out of 10 choose HDS to protect their sales.
Does the vendor itself need HDS certification?
Not necessarily if it relies on a host certified for all relevant activities. If it administers the servers holding the data itself, it may need activity 5 certification, which costs EUR 20,000 to 50,000 and takes 6 to 12 months.
What is the penalty for non-compliant hosting?
The CNIL can impose a fine of up to EUR 20 million or 4% of worldwide turnover. The French Public Health Code also provides criminal penalties, and customers can terminate for breach.
How long does moving to HDS take?
Plan 6 to 10 weeks for a migration to an already certified host. Add 2 weeks if a DPIA must be written.
Does HDS cover all GDPR compliance?
No, it covers hosting. You remain responsible for the record of processing, the DPIA, patient information and access rights, about EUR 3,000 to 8,000 of legal support on average.
Let's scope your project. We audit your health SaaS and price the HDS migration and compliance work, usually EUR 5,000 to 20,000 over 6 to 10 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
