The verdict in three sentences
For a business app, sovereign or certified hosting costs EUR 400 to 2,500 per month, against EUR 150 to 900 on a standard cloud, a factor of 2 to 3. In Germany, BSI C5 attested or sovereign offers (STACKIT, IONOS, T-Systems Sovereign Cloud, Delos for the public sector) add +30 to +80% over an equivalent hyperscaler setup, plus EUR 5,000 to 20,000 of adaptation work. Before paying, check whether the requirement is legal (health data, critical infrastructure under KRITIS and NIS2, public sector) or merely contractual, because the answer moves your three-year budget by tens of thousands of euros.
C5, sovereign cloud, standard cloud: what you pay
In Germany, the BSI C5 catalogue is the reference for cloud security, and C5 attestation is required for statutory health insurance data processing under the SGB V rules since 2024. France has its equivalents: HDS certification for health data and ANSSI's SecNumCloud qualification, offered by OVHcloud, Outscale, Cloud Temple and S3NS. Both markets show similar price gaps.
| Hosting type | Indicative monthly cost (mid-size business app) | Typical commitment | For whom |
|---|---|---|---|
| Standard cloud (AWS, Azure, Hetzner) | EUR 150 - 900 | None | Non-sensitive data |
| Standard cloud, Frankfurt region + encryption | EUR 250 - 1,200 | None | Regular GDPR personal data |
| C5 attested health hosting (or French HDS) | EUR 400 - 2,500 | 12 months common | Health data |
| Sovereign cloud (STACKIT, IONOS, SecNumCloud) | +30 to +80% vs standard | 12 to 36 months | Public sector, KRITIS, sensitive data |
| Sovereign + health certification | EUR 800 - 4,500 | 12 to 36 months | Hospitals, public health |
| Managed operations (24/7 monitoring) | +EUR 300 to 1,500 | 12 months | Teams without DevOps |
The gap is not just machine prices. Sovereign catalogues are narrower: fewer managed services, sometimes no managed database of the type you use, AI services rarely available. Your team often has to replace a managed service with a self-hosted component, which drives adaptation costs.
Adaptation costs and timelines
Migrating an existing app to a certified environment is both a technical and a documentation project.
| Adaptation item | 2026 range (EUR, excl. VAT) | Timeline |
|---|---|---|
| Architecture review and provider selection | 1,500 - 4,000 | 1-2 weeks |
| Replacing non-qualified managed services | 2,000 - 8,000 | 2-4 weeks |
| Encryption, key management, logging | 1,000 - 4,000 | 1-2 weeks |
| Data migration and testing | 1,000 - 3,000 | 1 week |
| Security policy, BCP/DRP, data processing agreement | 1,000 - 3,000 | 1-2 weeks |
| Typical total | 5,000 - 20,000 | 6-10 weeks |
Opening an account with an already attested provider takes days. Getting your own organisation certified (French HDS as a managed service provider, or an ISO 27001 scope on BSI IT-Grundschutz) takes 6 to 12 months and EUR 20,000 to 60,000 in audit and consulting. Pick a provider whose attestation is current and check the scope covers the services you actually use.
Legal or contractual requirement
This is the question that saves the most money. Certified hosting is legal when you process health data for statutory insurers in Germany or host identifiable health data for a third party in France. Sovereign offers are expected for sensitive public-sector data and for many KRITIS and NIS2 entities. In many other cases, the request is a contractual requirement from a large customer, and it is negotiable: an encrypted Frankfurt-region setup with customer-managed keys may suffice, at 40 to 60% less.
Mini case study
Sophie is CIO of a remote patient monitoring company. Her app runs on a standard cloud for EUR 700 per month. A new hospital customer requires certified health hosting on a sovereign stack. Selected quote: EUR 1,900 per month, plus EUR 12,000 of adaptation.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Three-year premium: (1,900 - 700) x 36 + 12,000 = EUR 55,200. The hospital contract brings EUR 180,000 per year. The premium is therefore about 10% of the contract's gross margin over the period, and the certification opens two more public tenders. Without that contract, simple health-certified hosting at EUR 1,100 per month would have been enough, for EUR 28,800 of premium over three years instead of EUR 55,200. The Berlin equivalent on STACKIT with C5 lands in the same range.
FAQ
Is C5 mandatory for every health app in Germany?
It is required for cloud processing of statutory health insurance data and is becoming the market standard for hospitals. Expect EUR 400 to 2,500 per month for a mid-size business app.
What is the price gap between sovereign and standard cloud?
Plan for +30 to +80% on infrastructure, plus EUR 5,000 to 20,000 of adaptation depending on how many managed services you must replace.
How long does the migration take?
Between 6 and 10 weeks for a standard business app with an already attested provider. Your own certification takes 6 to 12 months.
Can part of the app stay on a standard cloud?
Yes, a hybrid architecture works: the public front end and non-sensitive data stay on a standard cloud, health data on certified hosting. It often cuts the bill by 25 to 40%.
What about US-owned clouds?
They can obtain C5 attestation or French HDS certification, but they do not qualify for SecNumCloud unless operated by a European entity such as S3NS. For sensitive public data, a sovereign offer is usually required.
Let's scope your project. We scope your business app hosting: real requirement level, certified or sovereign option, an adaptation budget of EUR 5,000 to 20,000 and the migration timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
