C5-attested European cloud providers
Last updated: 22 August 2026
Since 1 July 2025, § 393 SGB V generally requires a BSI C5 Type 2 attestation for processing health and social data in the cloud. There is no central official register of attested providers. This overview lists European cloud infrastructure providers holding a C5 attestation, with country, ownership, and a public source.
| Provider | Country | Ownership | GPU | LLM API | C5 attestation | Source |
|---|---|---|---|---|---|---|
| CloudFerro | PL | founders and Innova Capital | yes | Sherlock | Type 2 | Evidence |
| Exoscale | CH | A1 Group (Telekom Austria) | yes | Managed Inference | Type 2 | Evidence |
| Hetzner | DE | owner-managed | dedicated servers | Type 2 | Evidence | |
| Open Telekom Cloud | DE | Deutsche Telekom | yes | AI Foundation Services (T-Systems) | Type 2 | Evidence |
| OVHcloud | FR | publicly listed | yes | AI Endpoints | Type 2 | Evidence |
| plusserver | DE | BC Partners (private equity) | yes | Type 2 | Evidence | |
| STACKIT | DE | Schwarz Group | yes | AI Model Serving | Type 2 | Evidence |
| gridscale | DE | subsidiary of OVHcloud (FR) | bare metal | Type 1 | Evidence | |
| IONOS | DE | United Internet | yes | AI Model Hub | Type 1 | Evidence |
A curated selection, not a complete register. A broad, continuously updated list across all industries is maintained by the private registry c5-attestations.com. Attestations apply per service and audit period, request the current attestation from the provider before deciding.
For background, read The cloud in healthcare, reconsidered.
Is a provider missing or an entry outdated? Write to us at hello@thalamiq.io.