French Sovereign Cloud has become an important consideration for French businesses, public institutions and European organisations managing sensitive information. Choosing a cloud service now involves more than comparing storage costs, computing performance and uptime. Organisations must also understand where their data is processed, who controls the infrastructure, which laws may apply and how easily they can move their workloads elsewhere.
A French sovereign cloud is a cloud service designed to give organisations meaningful control over their data, infrastructure, operations and legal exposure under French or European jurisdiction. However, the term does not automatically establish a particular level of security or guarantee that a service has received official certification.
France has developed a specific framework for evaluating trusted cloud services: SecNumCloud, a qualification issued by the French National Cybersecurity Agency, ANSSI. Several providers also offer French or European cloud infrastructure and application platforms with different approaches to sovereignty.
This guide compares seven relevant providers, explains the difference between sovereign cloud and conventional hosting, and outlines the questions businesses should ask before choosing a service.
What Is a French Sovereign Cloud?
A French sovereign cloud is a cloud environment intended to preserve control over data, technology and operations within a defined legal and organisational framework.
Unlike ordinary hosting, where the primary focus may be performance, availability and price, sovereignty also considers who operates the service, who can access its systems, which jurisdictions can impose legal obligations and whether the customer can change providers without losing control of critical workloads.
Four factors are particularly important.
Data sovereignty: The organisation understands where information is stored, processed, replicated and backed up, and which legal requirements govern it.
Legal sovereignty: The cloud operator’s corporate structure and applicable laws are assessed to understand potential exposure to foreign legal demands.
Operational sovereignty: Administrative access, technical support, maintenance and incident response are controlled through documented policies and appropriate personnel.
Technological sovereignty: The organisation understands its dependence on proprietary platforms, software, hardware, identity services and other technology suppliers.
These factors are related but not interchangeable. A French company may rely on foreign-owned software, while a European cloud provider may use infrastructure located in several countries. Neither circumstance alone determines the full sovereignty of a service.
The most useful approach is to evaluate the complete cloud offering rather than rely on the provider’s marketing label.
Why Does Cloud Sovereignty Matter in France?
Cloud sovereignty matters because organisations increasingly depend on cloud services to operate applications, manage customer information, analyse business data and support critical infrastructure.
For a company operating in France, the decision may involve several considerations.
Regulatory obligations
Public bodies and certain regulated organisations may face specific requirements for hosting sensitive information. France’s Cloud au centre policy and related trusted-cloud requirements make the choice of cloud service particularly important for certain government workloads.
Other organisations must assess their own obligations under applicable data protection, cybersecurity and sector-specific rules. A sovereign cloud is not automatically compulsory for every French business.
Confidentiality and legal exposure
A company may store intellectual property, financial records, health information or confidential customer data in the cloud. It needs to understand who can access that information and whether the provider could be subject to legal demands from another jurisdiction.
The location of a data centre is only one part of this assessment.
Business continuity
Dependence on a single cloud provider can create operational risks if prices rise, services change or access becomes unavailable. Sovereignty therefore overlaps with resilience, portability and the ability to maintain essential operations during disruption.
Strategic technology independence
Some organisations want to reduce dependence on a small number of global technology companies. French and European providers can offer alternatives, although customers should still examine the underlying technologies and subcontractors used by each service.
French Sovereign Cloud vs European Cloud vs Traditional Cloud
The following comparison illustrates typical differences. These are general categories, not guarantees about every provider.
| Criterion | Traditional cloud | European cloud | French sovereign cloud |
|---|---|---|---|
| Provider ownership | May be international | Often European, but varies | French or otherwise demonstrably controlled under the required framework |
| Data location | Depends on service and configuration | European regions may be available | Defined locations appropriate to the workload |
| Legal jurisdiction | Depends on provider and circumstances | European law may apply alongside other laws | Legal control and foreign-law exposure are specifically assessed |
| Operational access | Depends on provider policies | Depends on service arrangements | Access and operational control should be clearly documented |
| Technology dependencies | May include global proprietary platforms | May include non-European technology | Dependencies should be assessed and controlled according to requirements |
| Security evidence | Varies by service | Varies by service | May include SecNumCloud qualification where applicable |
A cloud hosted in France is not necessarily sovereign. A French-owned company is not necessarily independent of foreign technology, either.
Equally, a European cloud does not automatically offer the same legal, operational and technical assurances as a SecNumCloud-qualified service.
The right choice depends on the organisation’s risk assessment and the specific guarantees available for its chosen service.
Key French Sovereign Cloud Providers
The following providers are relevant to organisations evaluating French cloud infrastructure and managed platforms. They are not ranked because they operate at different layers of the cloud market.
1. OUTSCALE
OUTSCALE, a Dassault Systèmes company, provides cloud infrastructure and related services for organisations with demanding security and sovereignty requirements.
Its offering includes infrastructure services and capabilities aimed at public-sector organisations, critical operators and businesses managing sensitive workloads. OUTSCALE publicly identifies its IaaS offering as SecNumCloud 3.2-qualified and describes additional security and compliance credentials.
Its positioning makes it worth evaluating for organisations seeking controlled infrastructure for enterprise applications, sensitive workloads and sovereign AI projects.
Best suited to: Public-sector workloads, regulated organisations, enterprise infrastructure and projects requiring strong sovereignty assurances.
What to verify: The exact service covered by the current ANSSI qualification, the relevant region, service dependencies and whether the selected configuration meets the organisation’s requirements.
Source: OUTSCALE sovereign cloud.
2. OVHcloud
OVHcloud is a French cloud provider offering public cloud, dedicated servers, hosted private cloud and other infrastructure services.
Its portfolio includes specific SecNumCloud-qualified environments. In September 2026, the company announced that its SNC Cloud Platform had obtained SecNumCloud qualification, expanding its options for customers seeking public-cloud-style services under a trusted framework.
This is an important distinction: the qualification applies to the relevant offering, not automatically to every product sold by OVHcloud.
OVHcloud may be suitable for businesses that want to combine cloud infrastructure, dedicated resources and managed enterprise environments.
Best suited to: Enterprise IT, dedicated infrastructure, private cloud and selected sensitive workloads.
What to verify: The precise qualified product, region, service conditions and whether the intended workload can run entirely within the required qualified environment.
Sources: OVHcloud SecNumCloud solutions and September 2026 qualification announcement.
3. Clever Cloud
Clever Cloud is a French cloud platform provider focused on simplifying application deployment and management.
Its platform-oriented approach can be attractive to development teams that want to deploy applications without managing every layer of the underlying infrastructure. The company describes its services as French-designed and European-governed and publishes information about its ISO 27001 and HDS certifications.
An important qualification is that Clever Cloud states that its own infrastructure is undergoing SecNumCloud qualification. It also offers access to services hosted on a partner’s SecNumCloud-qualified infrastructure. These arrangements should not be treated as equivalent without checking the actual deployment and service scope.
Best suited to: SaaS companies, developers, web applications and businesses looking for managed application hosting.
What to verify: Whether the selected service runs on the provider’s own infrastructure or a qualified partner environment, and which security assurances apply to the complete application stack.
Source: Clever Cloud sovereign cloud.
4. Scalingo
Scalingo is a French platform-as-a-service provider designed to simplify application deployment, scaling and operations.
Rather than requiring customers to manage virtual machines and infrastructure components directly, a PaaS handles much of the application hosting environment. This can reduce operational workload for software teams.
Scalingo describes its cloud regions as being located in France and built on OUTSCALE infrastructure. Its documentation identifies a region using SecNumCloud-qualified infrastructure, but that should not be interpreted as proof that every Scalingo service or deployment is itself SecNumCloud-qualified.
Best suited to: SaaS businesses, development teams and organisations that prioritise application deployment simplicity.
What to verify: The infrastructure region, the precise boundary of any qualification, the managed services involved and whether the application can be migrated to another platform if necessary.
Source: Scalingo’s sovereign cloud guide.
5. Scaleway
Scaleway is a European cloud provider with French roots and a broad range of infrastructure and developer services.
Its services are relevant to businesses comparing compute, storage, networking and cloud-native development environments. As with other providers, the existence of French operations does not establish that every product meets a specific sovereignty requirement.
For organisations that do not require the strictest trusted-cloud framework, Scaleway may be worth including in a broader technical and commercial assessment.
Best suited to: Developers, startups, digital businesses and teams seeking European cloud infrastructure.
What to verify: Current certification status for the exact product, data locations, operational access arrangements, subcontractors and applicable legal jurisdiction.
6. Cloud Temple
Cloud Temple specialises in enterprise cloud transformation, managed infrastructure and services for organisations with demanding security and compliance needs.
Its Secure Temple infrastructure and OpenShift PaaS have appeared in ANSSI’s SecNumCloud qualification materials. The provider also publishes information about its trusted-cloud services and managed environments.
This makes Cloud Temple relevant to organisations that need more than basic hosting, particularly where migration, infrastructure management and operational support are important.
Best suited to: Large enterprises, public-sector organisations, hybrid-cloud projects and sensitive business applications.
What to verify: The current qualification validity dates, exact service scope, availability architecture, support model and any third-party technology dependencies.
Sources: Cloud Temple and ANSSI’s cloud service qualification information.
7. Bleu
Bleu is a French trusted-cloud initiative associated with Orange and Capgemini, designed to offer cloud services based on Microsoft technologies to French organisations with demanding sovereignty requirements.
The model illustrates an important point: organisations may want the functionality of established international software platforms while requiring stronger French operational and legal controls.
However, the status of each offering matters. Bleu announced that its cloud services entered the SecNumCloud 3.2 qualification process in 2025. That announcement alone did not establish that every service had completed qualification.
On 15 October 2026, Snowflake announced its intent to partner with Bleu to bring its AI Data Cloud to France’s regulated markets. This is evidence of an announced intention, not proof that a fully operational, SecNumCloud-qualified Snowflake service is already available through the partnership.
Best suited to: Public-sector organisations and regulated businesses that need selected Microsoft-based or other enterprise software capabilities in a trusted-cloud environment.
What to verify: Current ANSSI qualification status, which services are actually available, the operational responsibilities of each party and whether the exact software stack meets the required sovereignty level.
Sources: Bleu’s qualification-process announcement and Snowflake’s announcement dated 15 October 2026.
Comparison Table: French Sovereign Cloud Providers
This table is a starting point for vendor selection, not a universal ranking. Qualification status and product availability should be checked again before procurement.
| Provider | Main service model | Potential use cases | Sovereignty evidence and caveats |
|---|---|---|---|
| OUTSCALE | IaaS and related cloud services | Critical workloads, enterprise infrastructure | Publicly identifies a SecNumCloud 3.2-qualified IaaS offering; verify exact scope and validity |
| OVHcloud | Public cloud, private cloud and dedicated infrastructure | Enterprise IT and infrastructure hosting | Specific offerings are qualified; not every OVHcloud product is covered |
| Clever Cloud | PaaS and managed application services | SaaS and web applications | ISO 27001 and HDS claims; own infrastructure qualification is in progress, with partner-hosted qualified options |
| Scalingo | PaaS | Application deployment and management | French platform using OUTSCALE infrastructure; verify which service and infrastructure qualification applies |
| Scaleway | IaaS and developer cloud services | Startups, developers and digital products | Evaluate individual products and their documented assurance scope |
| Cloud Temple | Managed cloud, IaaS and PaaS | Enterprise, hybrid cloud and sensitive applications | Specific services appear in ANSSI qualification materials; check current status |
| Bleu | Trusted-cloud initiative and enterprise software ecosystem | Public sector and regulated enterprise applications | Qualification and partner-service status must be confirmed for the specific offering |
The key purchasing question is not simply which provider calls itself sovereign. It is which provider can demonstrate the required guarantees for the exact service, configuration and workload.
What Is SecNumCloud?
SecNumCloud is a cloud security qualification framework developed by ANSSI, France’s national cybersecurity agency.
It establishes demanding requirements for cloud service providers, covering technical safeguards and aspects of operational and legal control. The framework is particularly relevant when organisations need demonstrable assurances beyond ordinary data-centre security or a general information-security certification.
SecNumCloud is not a synonym for sovereign cloud.
A provider can offer a service that it describes as sovereign without holding this qualification. Conversely, a provider’s qualification for one cloud environment does not automatically extend to all its products.
When checking a claim, look for four details:
- The qualified service: Is it IaaS, PaaS, a managed platform or another defined service?
- The status: Is the service qualified, undergoing assessment or merely planned for qualification?
- The validity: Is the qualification currently valid, and are there conditions or limitations?
- The scope: Does the qualification cover the region, infrastructure and service components your organisation will actually use?
Start with ANSSI’s official SecNumCloud information and request supporting documentation from the provider.
What Does “Cloud de Confiance” Mean?
Cloud de confiance, commonly translated as “trusted cloud”, is associated with France’s approach to trusted commercial cloud services.
In this context, the distinction is important because the French state links trusted-cloud requirements to SecNumCloud qualification and protection against certain extraterritorial legal risks.
A general marketing statement about trust or sovereignty should therefore not be treated as equivalent to evidence that a service meets the applicable trusted-cloud requirements.
The correct assessment depends on the workload, the relevant government or sector rules and the service’s current status.
French Sovereign Cloud, GDPR and the US CLOUD Act
Legal sovereignty is one of the most misunderstood parts of cloud selection.
GDPR compliance is not the same as sovereignty
The General Data Protection Regulation (GDPR) governs the processing of personal data and sets requirements for matters including security, accountability and international data transfers.
A provider’s GDPR compliance is important, but it does not automatically establish that the service is sovereign under French trusted-cloud criteria.
The GDPR permits certain transfers of personal data outside the European Economic Area when the applicable legal requirements and safeguards are met. Organisations must assess their specific processing arrangements rather than assume that all overseas processing is prohibited.
See the official GDPR text on EUR-Lex.
Understanding the US CLOUD Act
The US CLOUD Act concerns lawful access to certain electronic data held by service providers subject to US jurisdiction.
The US Department of Justice explains that covered providers may be required to disclose responsive data within their possession or control, regardless of where that data is stored, when the relevant legal requirements are met.
This does not mean that every US-linked cloud service routinely exposes customer information or that all foreign-owned services carry identical risks. Jurisdiction, corporate structure, legal process, operational control and the service contract all matter.
Nevertheless, a business with strict sovereignty requirements should investigate whether a provider or its parent company may be subject to foreign legal demands and how the provider would respond.
Source: US Department of Justice explanation of the CLOUD Act.
What should businesses do?
Before choosing a cloud provider, ask for:
- A clear explanation of the legal entities operating the service.
- A list of relevant data locations and subprocessors.
- Details of administrative access and remote support.
- Contractual commitments concerning legal requests and customer notification, where permitted.
- Information about encryption, key custody and access logging.
- Evidence of the relevant qualification or certification.
These checks help organisations assess risk without assuming that nationality or hosting location alone determines the answer.
How to Choose the Right French Sovereign Cloud
The best cloud service depends on the sensitivity of your data, your technical architecture, your legal obligations and your available budget French Sovereign Cloud.
Use the following checklist during vendor evaluation.
1. Classify your data
Identify which workloads contain personal information, confidential business records, intellectual property or information subject to sector-specific requirements. Define the controls each category needs.
2. Confirm every relevant data location
Ask where production data, backups, logs, disaster-recovery copies and support records are stored and processed. Check whether locations can change and how those changes are communicated.
3. Examine ownership and jurisdiction
Understand the provider’s corporate structure, controlling entities and applicable laws. Ask whether critical subcontractors introduce additional legal or operational dependencies.
4. Review administrative access
Determine who can access production systems, who provides technical support and whether privileged operations are logged, restricted and audited.
5. Verify certification scope
Request the relevant qualification certificate or official listing. Match the documented scope to the exact product, region and configuration under consideration.
6. Assess encryption and key management
Check encryption in transit and at rest, access controls for keys, separation of duties and the extent to which the customer can retain control over sensitive encryption keys.
Encryption is valuable, but it does not remove every sovereignty concern, particularly where a service provider must process unencrypted data to deliver its service.
7. Test disaster recovery
Ask about backup isolation, recovery objectives, availability zones and incident-response responsibilities. Ensure recovery arrangements do not introduce unacceptable dependencies on another jurisdiction or unqualified service.
8. Map technology dependencies
Review identity providers, monitoring tools, operating systems, databases, APIs, hardware and managed services. A sovereign infrastructure layer does not automatically make every dependent application sovereign.
9. Plan for portability and exit
Understand how to export data, migrate applications, retrieve backups and transition to another provider. Confirm the associated costs, formats, contractual timelines and support arrangements.
10. Compare total cost and support
Evaluate the full cost of compute, storage, data transfer, licensing, security controls, migration and managed services. Compare service-level agreements, support availability and incident escalation rather than relying on headline prices.
A structured assessment makes it easier to distinguish a genuinely suitable service from an offering that merely uses sovereignty-related language.
Which Organisations Should Consider a French Sovereign Cloud?
Public-sector organisations
Government bodies may need specific trusted-cloud arrangements for sensitive workloads. Procurement teams should begin with the applicable government policy and the classification of the information involved.
Healthcare organisations
Healthcare providers and their technology partners should assess the applicable health-data hosting requirements, including HDS where relevant. HDS certification and SecNumCloud qualification address different assurance needs and should not be treated as interchangeable.
Financial services and regulated industries
Banks, insurers and other regulated businesses should consider data protection, resilience, outsourcing oversight and sector-specific obligations. The appropriate cloud model depends on the service and the information being processed.
SaaS and software companies
Software businesses may value a French cloud for customer assurance, contractual requirements and greater control over application hosting. PaaS providers can reduce infrastructure-management work, while IaaS gives technical teams more direct control.
SMEs and startups
Smaller businesses may not need the strictest qualification for every workload. A sensible approach is to identify critical data and applications first, then select the appropriate level of sovereignty without paying for controls that do not address a real requirement.
Frequently Asked Questions
What is a French sovereign cloud?
A French sovereign cloud is a cloud service designed to preserve control over data, legal exposure, infrastructure and operations within a defined French or European framework. The precise assurances depend on the provider and service.
Which are the main sovereign cloud providers in France?
Relevant options include OUTSCALE, OVHcloud, Clever Cloud, Scalingo, Scaleway, Cloud Temple and Bleu. They offer different services, and their sovereignty and qualification status must be checked individually.
Is a cloud hosted in France automatically sovereign?
No. French hosting establishes a location, not the full legal, operational and technological arrangements. Ownership, remote access, subcontractors and applicable law must also be considered.
What is the difference between SecNumCloud and a sovereign cloud?
Sovereign cloud is a broad concept describing control over cloud data and operations. SecNumCloud is a specific qualification assessed by ANSSI against defined requirements. A provider’s general sovereignty claim does not prove that its service is qualified.
Is a French cloud more secure than a traditional cloud?
Not automatically. Security depends on architecture, configuration, access management, monitoring, operational practices and the evidence available for the particular service. Sovereignty addresses additional questions about control and jurisdiction.
Can a US-owned cloud provider offer sovereign services?
A provider with foreign ownership may design services with stronger local controls, but the customer must assess the applicable legal framework, operational independence, technology dependencies and relevant qualifications. Marketing terminology alone is not sufficient evidence.
How can a business verify a cloud provider’s sovereignty claims?
Check the provider’s corporate structure, data-location documentation, administrative access arrangements, subcontractors, contractual safeguards and official certification records. For SecNumCloud claims, verify the exact service and current status through ANSSI.
Conclusion
Choosing a French sovereign cloud is ultimately a question of matching the right level of control to your organisation’s data, risks and legal obligations.
OUTSCALE, OVHcloud and Cloud Temple are relevant options for infrastructure and sensitive enterprise workloads. Clever Cloud and Scalingo may appeal to software teams looking for managed application platforms, while Scaleway offers a broader European cloud environment. Bleu is relevant to organisations evaluating trusted-cloud options built around enterprise software ecosystems.
These providers should not be treated as interchangeable. Their products, dependencies and qualification status differ.
Before committing to a service, define your sovereignty requirements, verify the exact offering against authoritative evidence, review contractual access and exit arrangements, and test whether the complete technology stack meets your needs.
