There is no universal winner, and the available evidence does not support naming one. For a healthtech service the deciding factors are usually not resize speed. They are where derived images live, who can fetch them, and how fast you can make a cached copy disappear. Sharp gives you a processing library that runs inside an environment you control, so you also own storage, delivery and caching. A hosted service such as Cloudinary or Imgix bundles transformation, CDN delivery and managed caching, but adds a third party to the data path and puts deletion behavior partly outside your control.
This is an engineering and procurement framing, not legal advice. Whether a given arrangement is acceptable for images containing electronic protected health information (ePHI) depends on the exact data, vendor product, contract and configuration.
What you are actually comparing
The two options are not the same kind of thing, so a feature-for-feature contest is misleading.
Sharp: a library you deploy
Sharp is a Node-API module powered by libvips. It handles format conversion and resizing, plus operations such as rotation, extraction, compositing and gamma correction. Its documentation specifies Node-API v9 runtimes, including Node.js 20.9.0 or later, Deno and Bun. It does not deliver images. Object storage, a CDN, cache keys, TTLs and invalidation are all decisions your team makes and operates, along with scaling and library updates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
Cloudinary and Imgix: services that render and deliver
Cloudinary’s URL-based transformations produce derived files that are cached on its CDN. Imgix describes fetching an image from a connected origin, transforming it and serving it through its CDN. Your application integrates URLs and service controls instead of running the rendering code.
How caching differs in practice
| Question | Sharp in your stack | Hosted transformation service |
|---|---|---|
| Who renders derivatives? | Your runtime, on your compute | The vendor, on request via a transformation URL |
| Where do derivatives get cached? | Wherever you decide: object storage, your CDN, application cache | The vendor’s CDN (Cloudinary documents CDN caching of derived files; Imgix documents CDN delivery and cache behavior) |
| Who sets cache keys and TTLs? | You | Largely the vendor’s model, with documented controls such as Cloudinary’s versioned URLs |
| Who handles purge? | You, across every layer you added | The vendor for its network; you for browsers, proxies and anything downstream |
| Added parties in the data path | None by default, though any CDN you add is one | The vendor, plus its CDN infrastructure |
The practical consequence: with Sharp you must build the caching layer, but you can design it around your own deletion and access rules. With a hosted service you get caching immediately, but you work within the vendor’s cache lifecycle.
Deleting a patient image: where caching gets risky
For most media sites a stale cached image is a nuisance. For a clinical or patient-facing product it can be an incident, so check what “delete” really does in each layer.
What Cloudinary documents
Cloudinary states that delivered versions may remain on CDN servers for up to 30 days after deletion, rename or overwrite. An invalidation request can remove cached copies, but it takes time, and browser, proxy or search engine caches outside Cloudinary’s network may still hold the asset. The 30-day figure is Cloudinary’s own statement about its CDN, and it describes one cache layer only.
What Imgix documents
Imgix’s terms of service describe caching that can persist beyond the stated cache period. Read that clause alongside the product documentation before you assume a purge is instantaneous.
What this means for a Sharp-based design
Self-hosting does not remove the problem. If you put Sharp output behind your own CDN, the same layers exist: CDN edge, browser, intermediate proxies. The difference is that you choose the TTLs and can decide not to cache sensitive derivatives at shared layers at all. When any vendor makes a statement about cache duration or purging, work out which layer it describes, because none of them cover every copy a client may hold.
A defensible design principle, offered as engineering judgment rather than a sourced rule: for images that may contain ePHI, favor short-lived, access-checked delivery over long-lived public cache entries, and treat any cached copy outside your control as something you cannot retract.
Access control: public by default is the thing to check
Cloudinary’s access control documentation says its default upload delivery type is accessible through its public CDN, and it documents access-protection features for restricting that. That does not mean every deployment is exposed. It does mean private delivery has to be configured deliberately and verified, not assumed.
Recommended Free Tools
The same question applies to a self-built pipeline. If your Sharp-generated derivatives land in a bucket fronted by a CDN, confirm that unauthenticated requests fail, that URLs are not guessable or enumerable, and that signed or authenticated delivery is enforced where needed.
Compliance: neither option is compliant by default
Two mistakes are common, and the evidence supports neither.
- “Hosted means covered.” A BAA covers named products. Google Cloud’s documentation states: “The Cloud Healthcare API is a covered service under the Google Cloud HIPAA BAA, which means that customers can use it with electronic protected health information (ePHI), with appropriate configuration.” (Overview of the Cloud Healthcare API). That is a statement about one named Google service. It does not extend to image transformation vendors, and the sources reviewed here do not establish BAA coverage for Cloudinary or Imgix for this use.
- “Self-hosted means compliant.” Running Sharp in your own environment may reduce the number of third-party processing paths, but it does not establish compliance. Storage, logs, backups, networking, staff access and downstream delivery all still need review.
Sharp is a library, so the question “is Sharp HIPAA compliant?” does not have a meaningful yes or no answer. What matters is the environment around it.
Map the data path before choosing
For any image that could contain patient information, trace each stage and note who can read it and how long it persists:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Upload and origin storage: where the original lands, and who has access.
- Transformation request: what the request URL or API call exposes, including filenames or identifiers that could themselves be sensitive.
- Generated derivative: where it is stored and for how long.
- CDN and browser cache: which layers hold copies and who controls their expiry.
- Logs and observability: whether request URLs, headers or payload metadata are logged.
- Backups: whether originals and derivatives are retained in snapshots.
- Deletion: what runs when a record is removed and which layers it reaches.
- Support access: who at the vendor or in your own team can view assets.
For a hosted vendor, ask about the exact product and configuration, whether a BAA is available and what it covers, the covered entity and business associate relationship, regions and data location, retention and purge behavior, signed or authenticated delivery, and incident handling. A general claim that a vendor is secure or has healthcare customers is not a substitute. Do not send real patient data until those answers are in writing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Cost and performance: what is and is not known
Cost
Cloudinary’s billing documentation describes metering across transformations, storage and bandwidth. Imgix’s terms describe charging based on rendering and bandwidth. Plan terms change, so calculate from current pricing using your real transformation count and traffic. No sourced cost model exists for running Sharp in a service like yours. Include compute, storage, delivery, redundancy and the engineering time needed to maintain the pipeline.
Speed
Sharp’s own page says resizing is typically 4x–5x faster than the quickest ImageMagick and GraphicsMagick settings. That is a project claim about other libraries. It is not a comparison with Cloudinary or Imgix and not a measurement on healthtech images. No independent head-to-head result between hosted transformation and Sharp was found, so do not use that figure to justify either choice.
What to benchmark yourself
- For Sharp: representative input sizes and formats, transformation chains, concurrency, memory use, cold starts and output quality on your intended runtime.
- For a hosted service: origin fetch time, cold versus warm cache latency, regional latency, CDN hit rate, transformation latency and output quality in the regions you serve.
Choosing between them
Sharp is the stronger fit when
- You need direct control over where processing happens and who can touch the data.
- Your team can run a compatible Node-API runtime and operate storage, a CDN and cache invalidation as part of the service.
- You want deletion and access rules to apply uniformly across a pipeline you designed.
A hosted service is the stronger fit when
- Managed transformations and global delivery are worth an additional processor, a vendor integration and usage-based billing.
- The vendor can document, for your exact product and configuration, the contractual and technical controls you need.
- The images in question are not ePHI, or you have confirmed coverage and configured private delivery.
Both lists are architectural inferences from documented capabilities, not findings from a comparative study. A split design is also possible: use a hosted service for non-sensitive assets such as marketing imagery, and keep patient-related images in a pipeline you control. Whether that suits you depends on how cleanly you can separate the two classes of image.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
