Understanding the trusted cloud standard
Find out why this framework has become the highest standard in European cloud security. This article breaks down the label's core criteria and the role they play in protecting your sensitive environments.
SecNumCloud by Scaleway
We're building a trusted cloud infrastructure, designed to protect your most sensitive data and safeguard your strategic autonomy. Already HDS and ISO 27001 certified, Scaleway is currently undergoing the SecNumCloud qualification process run by ANSSI, France's national cybersecurity agency, the most demanding cloud security framework in Europe. The qualification has not been granted to date. Start planning your future sovereign deployments now, with our experts.
A sovereign cloud aligned with SecNumCloud requirements
Performance and innovation, without trade-offs
Our ambition: to bring together the requirements of SecNumCloud and the flexibility of the modern cloud. Scaleway builds the strictest regulatory requirements into a high-performance, fully automated ecosystem.
Full control over our value chain
Sovereignty demands independence. From our physical infrastructure to our software stack, we control every technical link. This vertical integration, operated in France by our own teams, removes any risk of interference or foreign technological dependency.
A transparent shared responsibility model
Trust demands clarity. Scaleway handles the physical, logical and regulatory security of the qualified infrastructure. On your end, you keep full control over your applications, configurations, and access.
SecNumCloud: which use cases, which sectors?
Host your critical services on an infrastructure natively aligned with France's "Cloud au centre" policy. Our environments allow public administrations to move away from non-European solutions and deploy highly available, interoperable applications that meet the State's requirements.
As cyber risk keeps rising, our sovereign infrastructure offers a resilient technical haven. Immune to foreign extraterritorial laws, it gives Operators of Vital Importance and Operators of Essential Services total control over their critical activities.
Protect your most valuable strategic assets: health data, industrial secrets, R&D, and financial data. By combining ANSSI's security requirements with the robustness of Scaleway's infrastructure, we enable regulated organizations and technology companies to host and process their critical data within a sovereign, high-performance environment.
Ready for the trusted cloud?
Our experts will help you plan your sensitive architectures on our upcoming qualified zone.
Understanding SecNumCloud: our resources
The strategic stakes of qualification
Explore the economic and geopolitical forces driving organizations toward technological autonomy. Essential reading to guide the infrastructure decisions of executives and CIOs.
An end-to-end commitment to your compliance
The upcoming SecNumCloud qualification will complete our infrastructure certification ecosystem, designed to meet the regulatory requirements of every sector.
HDS certification
Scaleway ensures rigorous protection of health data through its HDS certification. Our sovereign infrastructure meets the legal requirements of healthcare and HealthTech players, guaranteeing the confidentiality and resilience of your most critical applications.
ISO/IEC 27001:2022 certification
The foundation of our governance, ISO 27001 certification attests to the robustness of our Information Security Management System (ISMS). It guarantees end-to-end risk management and continuous improvement across all our operational processes.
Why choose Scaleway for your sovereign cloud?
Sovereignty as the standard
Unlike providers subject to foreign extraterritorial laws, Scaleway guarantees that your data and your workloads remain under 100% European jurisdiction. This strict legal separation protects your strategic assets from any interference, ensuring maximum, lasting confidentiality for your critical environments.
Agility through open standards
Built on leading open-source technologies such as Kubernetes, our platform guarantees full reversibility and no vendor lock-in. You keep complete control over your architecture, which allows you to run multi-cloud strategies or migrate your workloads without friction or hidden costs.
Continuity across your cloud environments
Leaving hyperscalers subject to the CLOUD Act shouldn't mean a technical step backward. Our solutions are designed to interoperate seamlessly with your current tools and existing architectures. You move your sensitive workloads at your own pace, with no operational disruption, maintaining the agility you've built on public cloud.
Contact us
Frequently asked questions
What is ANSSI's SecNumCloud framework?
The SecNumCloud framework (version 3.2) is the strictest security standard set by ANSSI to assess a cloud offering. More than a certification, this demanding qualification acts as a "security visa". It relies on an independent audit verifying close to 300 requirements and 1,000 precise control points, built around three main pillars:
Technical security & resilience: strict physical and logical isolation of environments, advanced encryption and maximum protection against cyberattacks.
Organizational excellence: full control over access, complete traceability of administration actions and rigorous incident management.
Legal compliance & sovereignty: protection against foreign extraterritorial laws (CLOUD Act, FISA). Data is stored and processed exclusively within the European Union.
Why do we talk about SecNumCloud qualification rather than certification?
ANSSI issues a SecNumCloud qualification, not a certification. The distinction matters: whereas a certification attests to compliance at a given point in time, qualification involves an initial, in-depth review of the provider's architecture, operational processes and legal immunity by independent accredited bodies, followed by continuous monitoring under the agency's direct control and final approval. Scaleway is engaged in this demanding process.
How will I be able to order a SecNumCloud service and sign the corresponding contract?
To use our SecNumCloud-qualified services once they become available, you will need to sign a dedicated contract specifically covering the legal and technical requirements of this high-trust zone. This contract cannot be signed directly from the Scaleway Console: it will require personalized, direct support from our sales team.
Will there be a price premium for the SecNumCloud offering?
No. Access to the qualified infrastructure will not carry any price premium on resources. The only requirement to benefit from the level of support and security these critical environments call for will be a Business or Enterprise support plan. We will also charge no migration fees to help you move to our trusted zone.
SecNumCloud and sovereign cloud: what's the difference, and what protection against extraterritorial laws?
Sovereign cloud refers to the broader concept of digital independence, while SecNumCloud is its strictest technical and regulatory expression, validated by ANSSI. This qualification imposes a watertight legal and operational framework that neutralizes the risk tied to foreign extraterritorial laws (such as the CLOUD Act or FISA) by placing your data exclusively under European law. Beyond this regulatory compliance, Scaleway reinforces that protection with a software stack it controls end to end, free from non-European technological dependencies.
Software sovereignty: how does Scaleway control its technological dependencies?
Sovereignty isn't limited to where data resides: it also means controlling the software chain. Scaleway pays close attention to the geopolitical dependencies that certain components can introduce, including open-source ones, depending on how they are governed. That's why the core building blocks of our platform, such as our Object Storage, are developed in-house and exposed through open standards that ensure full reversibility.
How does the shared responsibility model work?
Under SecNumCloud, security is a shared responsibility:
- Scaleway: guarantees the physical, logical and operational security of the infrastructure and services.
- The customer: remains responsible for the configuration, access management and encryption of the data they deploy.
Are the technical support teams handling my SecNumCloud scope based in Europe?
Yes. In line with ANSSI's requirements, all operational and support teams authorized to work on the SecNumCloud scope are based within the European Union and subject to strict security controls.