Health Data Hosting for a Web App in Berlin

The verdict in three sentences

A German digital health startup processing patient data must run it on a cloud provider holding a BSI C5 attestation, as required since July 2025 by section 393 SGB V, for a budget of EUR 300 to 1,500 per month in 2026 depending on volume. The startup does not need its own C5 attestation if it builds on an attested provider and does not operate the underlying infrastructure itself. It remains responsible for GDPR, encryption at rest, 1 year of access logging and a EUR 4,000 to 8,000 audit before its first hospital or DiGA-related contracts.

Compliant hosting options in 2026

The CTO of a startup signing with university hospitals or health insurers quickly receives a security questionnaire of 80 to 150 questions. The first line concerns the hosting provider. Several options cover most needs.

For an MVP with 2 environments (staging and production), a managed PostgreSQL database, encrypted object storage and backups, count EUR 400 to 700 per month with IONOS, STACKIT or OVHcloud.

What C5 does not cover

C5 attests the provider's own controls. Everything happening inside your application remains your responsibility, including the complementary customer controls listed in the provider's report.

If your team operates bare-metal servers and their operating systems itself, you may effectively become a cloud operator in the eyes of buyers and face C5 or ISO 27001 projects of EUR 30,000 to 80,000 and 6 to 12 months. Managed services on an attested provider avoid that trap.

Timeline before the first hospital contract

Allow 8 to 12 weeks: 2 weeks to choose the provider and sign the data processing agreement, 3 to 4 weeks of migration and hardening, 2 weeks of DPIA and documentation, then 2 to 4 weeks of penetration testing and fixes. Hospital IT departments also ask for the Article 28 GDPR contract and the list of sub-processors. DiGA applicants additionally face BfArM data protection and security certification requirements.

Mini case study

Lukas, CTO of a Berlin startup offering remote monitoring for chronic patients, is preparing a contract with 3 hospitals covering 4,000 patients. He chooses a managed C5 offer at EUR 650 per month, or EUR 7,800 per year. He adds a GDPR and DPIA audit at EUR 6,000, a penetration test at EUR 8,000 and EUR 5,000 of development for field encryption and logging. First-year budget: EUR 26,800. The first hospital contract is worth EUR 90,000 per year. Compliance therefore represents 30 % of first-year revenue and about 12 % in following years.

FAQ

Does a digital health startup need its own C5 attestation?

Not if it builds on an attested cloud provider and does not operate the infrastructure itself. It must, however, document how it implements the complementary customer controls, which covers most procurement questionnaires.

How much does compliant hosting cost for an MVP?

Between EUR 300 and 700 per month for 2 environments, a managed database and backups. Beyond 50,000 active patients, plan EUR 1,000 to 1,500 per month.

Can we use AWS or Azure?

Yes, their Frankfurt regions hold C5 attestations. Some hospitals and insurers still prefer providers subject only to EU law, especially after the Schrems II debates.

How long should access logs be kept?

Buyers typically expect at least 1 year of access traces for health data. Storing those logs usually costs EUR 50 to 200 per month.

Do we need a data protection officer?

Yes, large-scale processing of health data requires a DPO under GDPR and the German BDSG. An external DPO costs EUR 500 to 1,500 per month.

Let's scope your project. We prepare your compliant hosting migration and application security before your hospital contracts: scope, first-year budget of EUR 15,000 to 35,000, timeline of 8 to 12 weeks. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.