Skip to content
ENFRDescribe your project

Sovereign cloud and SecNumCloud: what they change for your data

Being hosted in Europe is not enough to protect your data from foreign laws. What a sovereign cloud is, what SecNumCloud guarantees, who is qualified, who has to be, and how to migrate without rewriting everything.

By Published on 3 October 2026

A sovereign cloud is a cloud whose data falls under European law alone: neither the provider nor its shareholders can be compelled by an authority outside the Union to hand over your data. In France, the benchmark is SecNumCloud, the qualification the French cybersecurity agency (ANSSI) grants to cloud offers that meet its security requirements, including its requirements for protection against non-European laws.

The nuance matters: a data centre located in Europe is not enough. What decides is who controls the provider and which law it answers to.

Sovereign cloud: what are we talking about?

The US CLOUD Act, passed in March 2018, lets US authorities require a US provider to hand over the data it controls, wherever that data is stored. A company whose data is hosted in Europe by a provider subject to that law therefore remains exposed to a foreign request.

The topic matters all the more because the market is concentrated: according to Synergy Research Group (July 2025), European providers hold about 15% of the European cloud market, against 70% for Amazon, Microsoft and Google combined.

SecNumCloud, the ANSSI qualification

SecNumCloud qualifies a specific offer of a provider, for a limited period, not the whole company. Its current requirements, version 3.2 of 8 March 2022, add protection against non-European laws to the security requirements:

  • the provider’s registered office, central administration and main establishment are in the European Union;
  • shareholders outside the Union hold no more than 24% of the capital and voting rights each, nor more than 39% together, and have neither a veto nor a majority on the management bodies;
  • data is stored and processed in the Union, and the service is administered from the Union.

Who is qualified today?

The ANSSI catalogue dated 15 September 2026 lists, among others, for infrastructure and platforms: OVHcloud (three offers), Outscale, Cloud Temple, NumSpot and S3NS, whose PREMI3NS offer has been qualified since 17 December 2025. Several online software publishers are listed too. Bleu and Scaleway are going through qualification at that date.

The list changes: before choosing, check the official catalogue, and the qualification of the exact offer you plan to use.

Does your organisation need it?

For the French State, it is an obligation. The “cloud au centre” doctrine (circular of 31 May 2023) requires SecNumCloud, or a European qualification at least equivalent, for the sensitive data of administrations. The SREN law of 21 May 2024 (article 31) extended this requirement to State operators and to some public bodies that process data of particular sensitivity, and its implementing decree of 14 April 2026 has applied since 17 April 2026.

For a private company, it is a choice, guided by the sensitivity of the data, the requirements of your own customers and those of your sector. Not all your data needs the same level: classify first, choose next.

At European level, the cloud certification scheme (EUCS) has still not been adopted, and its March 2024 draft had dropped the sovereignty requirement. SecNumCloud therefore remains the benchmark in France.

What it changes: available services, costs, reversibility

  • Services: a qualified offer has a narrower catalogue than a large public cloud; check that the building blocks you need (databases, containers, storage) are there.
  • Costs: they are compared offer by offer, on your real usage, rather than on list prices.
  • Reversibility: an architecture built on containers, infrastructure described as code and open formats lets you change provider if your situation changes.

Sovereign AI: your agents and models in Europe

The same questions arise for AI: where the models run, where the data the agents consult goes, where their logs are kept. An agent platform can be hosted on a European or qualified cloud, with models chosen accordingly, without depending on one provider. Our page Agentic platform details this approach, and our article on agentic AI explains what an agent is.

Migrating without rewriting everything

  • Classify your data and applications by sensitivity.
  • Choose a target per class: a qualified cloud for what requires it, a European or public cloud for the rest.
  • Set up a landing zone on the target: accounts, identities, connectivity and security rules, described as code.
  • Migrate in waves, with a way back at every switchover.

Our offers Sovereign hosting and A move to the cloud follow these steps, and the page Cloud foundation presents our work on the topic.

Frequently asked questions

What is SecNumCloud?

A qualification granted by ANSSI to a specific cloud offer that meets a set of requirements for security and for protection against non-European laws.

Is a European cloud necessarily sovereign?

No. You need to look at who controls the provider, where the service is administered from and which law it answers to. A European provider owned or run from abroad can remain exposed to non-European laws.

Are “trusted cloud” and SecNumCloud the same thing?

Almost. France’s national cloud strategy of May 2021 introduced the notion of a trusted cloud based on SecNumCloud, and ANSSI now presents SecNumCloud as the way to recognise trusted offers. The term also appears in the trade names of some offers.

Are Bleu and S3NS SecNumCloud-qualified?

As of 15 September 2026, S3NS’s PREMI3NS offer is qualified, since 17 December 2025; Bleu is going through qualification. Check the ANSSI catalogue when you make your choice.

Sources

Facts and figures checked on 3 October 2026.