NewTop highlight! Read about our VivaTech 2026 takeaways

SecNumCloud qualification: A natural next step in our Trusted Cloud journey

Build
Manon Quaghebeur
4 min read

This article is the third in our series on the SecNumCloud framework, its strategic implications, and Scaleway’s journey towards obtaining this demanding qualification.
In the previous articles, we explored how SecNumCloud is redefining the criteria for trust in the cloud, as well as the structural choices it requires cloud providers to make regarding architecture, operations, and technological sovereignty.
In this third and final article, we present our strategy and concrete roadmap for obtaining and implementing the qualification.

For Scaleway, embarking on the French Cybersecurity Agency - ANSSI’s SecNumCloud (SNC) qualification process is a natural next step. With an ecosystem built natively on open-source technologies, digital sovereignty was already one of our core commitments.

Recognized as the most demanding standard in France, SecNumCloud qualification attests to the highest level of security and to our ability to provide highly resilient services. To turn these commitments into reality, we decided to set Scaleway on the path to qualification in 2025.

Our strategy rests on two fundamental pillars:

  • Open source: The guarantee of complete transparency and reversibility, without technological lock-in.
  • Sovereignty: Legal and technical protection against extraterritorial laws, providing a trusted sanctuary for your sensitive data.

Choosing a unified infrastructure

Today, the cloud market is often divided between “standard” offerings that are agile but subject to limited regulation, and SecNumCloud environments perceived as isolated, siloed, and complex.

At Scaleway, we are taking a different approach by refusing to confine security to a separate enclave. Our ambition is to bring our entire standard infrastructure natively in line with ANSSI’s strictest requirements. This transformation is based on an “SNC by design” approach applied across all our Availability Zones, ensuring a controlled increase in security throughout our European infrastructure.

By placing our customers’ interests at the heart of this strategy, we are aiming for “zero migration”: by qualifying our existing infrastructure, we will enable users to benefit from the highest level of trust without service disruption or additional technical complexity.

Open source as an accelerator of trust

Scaleway’s native use of open-source technologies is a major strategic advantage in our pursuit of SecNumCloud qualification. This approach provides complete control over and transparency into the source code, eliminating the blind spots inherent in proprietary solutions.

By moving away from software black boxes, Scaleway strengthens its digital sovereignty and security guarantees. This technological independence drastically reduces reliance on third parties and protects users against vendor lock-in and sudden policy reversals by service providers in an increasingly tense geopolitical environment.

Scaleway has established itself as a major player in digital sovereignty, supported by its European foundations and the strength of iliad Group. This French and European identity ensures that our infrastructure and governance remain strictly under European jurisdiction, providing a robust alternative to providers subject to foreign legislation.

This sovereign foundation offers effective protection against the risks associated with extraterritorial laws. Our customers’ sensitive data therefore benefits from a technical and legal sanctuary that fully complies with the security and confidentiality requirements of ANSSI’s SecNumCloud framework. This sovereignty is also underpinned by the transparency and technological independence provided by our open-source solutions.

The roadmap: from a Single-AZ IaaS offering to a Multi-AZ PaaS offering

The initial qualification scope: a comprehensive production-ready catalog

We have defined a robust initial scope designed to address the real expectations and needs of sponsors—the official term used by ANSSI for customers of a qualified offering. This will not be a superficial qualification intended merely to display ANSSI’s seal of approval, but a concrete and practical offering.
Our initial SecNumCloud catalog will therefore cover the core cloud requirements:

Because security begins at the server level, our qualified services will be hosted in datacenters located in France—more specifically, in the Paris region and within iliad Group. However, this initial offering is only the beginning. Scaleway ultimately intends to extend its qualification to Multi-AZ environments across the European Union.

From IaaS to PaaS

Beyond the initial foundation provided by our IaaS offering—Infrastructure as a Service, which supplies the fundamental compute, storage, and networking resources—our roadmap includes a strategic expansion towards our PaaS services.
Unlike IaaS, PaaS provides a ready-to-use development and deployment environment, allowing teams to focus exclusively on code and business functionality rather than maintaining the underlying infrastructure. This transition is intended to reduce operational complexity for our customers.
Solutions such as Kapsule, which provides managed Kubernetes, perfectly illustrate our ambition to offer more abstracted, agile, and readily deployable services within our secure ecosystem.

High availability: our path towards Multi-AZ

Our first objective is to establish a fully qualified region in France. The next step will be to extend the qualification to all Scaleway Availability Zones. While the initial scope is therefore based on a Single-AZ configuration, our roadmap is clear: the transition to Multi-AZ.

Scaleway’s ambition extends beyond France.

Ultimately, our objective is to make all our services available and SecNumCloud-qualified across every Scaleway Availability Zone in the European Union. This deployment is based on a robust industrialization strategy: our new AZs are designed to be “SNC-ready by design,” while our existing infrastructure is being upgraded to standardize a unified Multi-AZ model.
This approach will enable us to provide native regional resilience and maximum service continuity throughout Europe, offering every customer the same demanding standards of security, availability, and sovereignty for their critical infrastructure.

Democratizing the trusted cloud

By industrializing the “SNC by design” model, Scaleway is bringing together sovereign, high-security infrastructure and the agility of the public cloud. Unlike SecNumCloud environments that are often perceived as isolated or complex, we refuse to confine security to a separate enclave. By qualifying our existing infrastructure, we are aiming for “zero migration” and will provide the highest level of trust without service disruption or additional technical complexity.

This same level of rigor will also shape our customer relationships. The qualification will transform the provider-customer relationship into a genuine partnership, formalized through a dedicated service agreement detailing the division of responsibilities and ensuring complete transparency in incident management.

For Scaleway, SecNumCloud is not the finish line. It is the regulatory foundation of the European hyperscaler we are building. By progressively extending the qualification across all our Availability Zones in Europe, we will make high security and sovereignty the norm rather than the exception.

Recommended articles