The verdict in three sentences
If your SaaS stores patient health data on behalf of practices, certified health data hosting is mandatory in France (HDS) and expected by German buyers (BSI C5 attestation), it is not a sales option. The real premium sits between 30 and 80% over standard cloud, or 300 to 1,500 EUR per month for a mid-sized vendor. Sovereign cloud tiers (SecNumCloud in France, comparable sovereign offers in Germany) add protection from extraterritorial laws, useful for public hospitals, but often double the bill.
Certified, sovereign, standard cloud: what you actually pay
The CTO of a software vendor for physiotherapists, speech therapists or home nurses must decide fast: clients ask for the certificate in their tenders. The figures below come from the French HDS market and are a sound order of magnitude for Berlin. Comparison base: 6 virtual machines, 2 TB of storage, encrypted backups, about 4,000 client practices.
| Criterion (2026 order of magnitude) | Standard cloud | Certified health host | Certified + sovereign |
|---|---|---|---|
| Monthly infrastructure cost | 230 to 850 EUR | 300 to 1,500 EUR | 600 to 2,800 EUR |
| Premium over standard | baseline | +30 to +80% | +100 to +230% |
| Managed services on certified layers | not required | included or 200 to 800 EUR per month | usually included |
| Protection from the US Cloud Act | no | depends on the host | yes, required by the framework |
| Managed services catalogue | very broad | medium | narrow |
| Minimum commitment | none | 12 to 36 months common | 24 to 36 months common |
| Required by | no health client | any client storing patient data | hospitals, public health tenders |
The premium stays moderate because certification sits with the host. Your job is to choose the right scope (infrastructure only or full managed service) and document your own controls.
The compliance budget beyond hosting
| Item | Cost (excl. VAT) | Duration |
|---|---|---|
| Initial compliance audit (GDPR, health hosting, security gaps) | about 8,000 EUR | 3 to 4 weeks |
| Data protection impact assessment and records | 3,000 to 6,000 EUR | 2 to 3 weeks |
| Infrastructure and data migration | 10,000 to 30,000 EUR | 2 to 4 months |
| Encryption, logging, access management | 5,000 to 15,000 EUR | 4 to 8 weeks |
| Penetration test before go-live | 6,000 to 12,000 EUR | 2 weeks |
| Exit plan and processor contracts | 2,000 to 4,000 EUR | 2 weeks |
For a vendor starting from standard cloud, the full first-year budget is therefore 40,000 to 90,000 EUR, hosting included.
How to limit the premium without taking risks
Three practices make the difference. Separate health data from everything else: your marketing site, billing tool and analytics can stay on standard cloud. Right-size before signing a 36 month commitment, because certified hosts charge heavily for unused reserved resources. Finally, negotiate reversibility in the contract, with a documented export format.
Mini case study
Thomas, CTO of a software vendor serving 4,000 allied health practices, pays 620 EUR per month on standard cloud. The certified hosting quote with managed services reaches 1,050 EUR, a 69% premium and 5,160 EUR more per year. Add 8,000 EUR of audit, 18,000 EUR of migration and 9,000 EUR for penetration testing and encryption: 35,000 EUR in year one. On the other side, two tenders from practice networks, worth 600 subscriptions at 45 EUR per month or 324,000 EUR of annual revenue, required the certificate. Compliance pays back in under 2 months of those new contracts.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is certified hosting mandatory for a SaaS serving health practices?
In France, yes: article L.1111-8 of the Public Health Code requires HDS as soon as you host personal health data for professionals. In Germany, buyers and insurers increasingly require a BSI C5 attestation, so the 30 to 80% premium is unavoidable in principle.
Do I need a sovereign cloud tier?
Not for most vendors. It becomes relevant for public hospitals or tenders requiring immunity from extraterritorial laws, with a bill that often doubles.
How long does a migration to a certified host take?
Allow 2 to 4 months: 1 month of audit and design, 1 to 2 months of migration and testing, 2 weeks of cutover with parallel running.
Does my company itself need certification?
If you hand all infrastructure and managed services to a certified host, not necessarily. If you administer the servers yourself, certifying your operations may be required, at 20,000 to 50,000 EUR.
Where should backups be hosted?
Also with a certified host, in a second site at least a few dozen kilometres away. Budget 10 to 20% of the main hosting cost.
Let's scope your project. Describe your current architecture and target clients: we will propose a certified hosting scope, an indicative budget in line with our price grid and a zero-downtime migration plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
