Amazon Web Services (AWS), Hetzner, IONOS, Telekom Cloud, and others—(aspiring) DiGA providers have a wide range of options when it comes to choosing a hosting service provider. This leaves them facing a difficult decision: Which server provider is the right one?
To provide an overview, QuickBird Medical identified the server providers for the current DiGA in the BfArM directory and listed them in a summary.
What stands out: Many of the listed DiGA have switched server providers. The reason?
One might think it’s due to the C5 certificate requirement. Starting in July 2025, DiGA backends will be required to provide proof of a Type 2 C5 certificate. But that doesn’t seem to be the only reason.
According to QuickBird Medical, the following observations can be made regarding the changes between 2023 and 2025:
- A total of 7 DiGA have completed the transition from the Open Telekom Cloud (OTC) to Amazon Web Services (AWS). However, both providers hold Type 2 C5 certification. The motivation for the switch may therefore be due more to technical advantages or server costs.
- Hetzner (which is currently not C5-certified at all) lost two contracts to IONOS, which, in turn, is currently only C5 Type 1-certified.
- Interestingly, it appears that no DiGA provider has switched to the Open Telekom Cloud, even though it holds the C5 certificate and, unlike AWS, is based in Germany.
- Overall, almost no manufacturer has switched server providers yet, even though the legal deadline for C5 certification is approaching. More than 60% of manufacturers are still using server providers that do not have a C5 Type 2 certificate. Are manufacturers aware that, in the worst-case scenario, this could lead to their exclusion from the DiGA directory? The certificate is also required as part of the BSI certification process under BSI TR-03161.
Although it is currently conceivable that there will be a transitional regulation or equivalence regulation with ISO 27001, this is not certain.
All information on server providers can be found in the continuously updated DiGA directory for manufacturers provided by QuickBird Medical.
Note: The entire analysis was conducted using publicly available data.