# HDS certification for health data hosting in France in 2026

Last updated: 2026-11-10

HDS, short for Hébergeur de Données de Santé, is the French certification that any company must hold before it hosts personal health data on someone else's behalf. It comes from article L.1111-8 of the French Public Health Code, is issued after an audit by an accredited certification body, and requires the data to stay inside the European Economic Area. If you build health software for French patients, the practical choice is a platform that already holds the certificate: **Clever Cloud** and **Scalingo** cover the full stack as a PaaS, and **OVHcloud** fits teams that want to run their own servers.

This guide isn't legal advice. Confirm with your data protection officer or lawyer whether your processing falls under HDS.

## HDS-certified platforms at a glance

| Platform | Certificate | Activities covered | Valid until | Where health data sits |
|---|---|---|---|---|
| Clever Cloud | FR094504, issued by Bureau Veritas Certification | All six | 19 December 2027 | Paris, Gravelines and Roubaix |
| Scalingo | 38436, issued by BYCYB, formerly LNE | All six | 11 September 2028 | Outscale infrastructure, no access from outside the EEA |
| OVHcloud | Held since 2019 | Not stated | Not stated | Not stated |
| Eurobase | None | None | Not applicable | Not available for health data |

Certificate details are from each provider's own page, checked on 10 November 2026.

## What the certification actually requires

The rule targets hosting, not care. In France, health data collected for prevention, diagnosis, care, or social and medico-social follow-up must be hosted by a certified host when a third party hosts it. A few points decide whether and how it applies to you:

- **Who must be certified.** Public or private organisations that host health data, run the health information system, or back it up on behalf of a health establishment or another party. Scalingo's documentation says archiving services are outside the obligation, and that a health establishment running its own information system doesn't need the certificate.
- **The six activities.** The framework splits hosting into the physical sites, the hardware infrastructure, the virtual infrastructure, the application hosting platform, administration and operation of the system holding the data, and outsourced backups. A certificate can cover some or all of them, so match its scope to what you buy.
- **The audit.** Clever Cloud's page explains that a body accredited by COFRAC, or by the national accreditation body of another EU member state, issues the certificate after an audit. It's valid for three years, with a surveillance audit every year.
- **Location.** Health data has to be stored within the European Economic Area. Your provider can still be in another EU country, as long as it holds the certificate.
- **The framework version.** Version 2 of the requirements has been in force since 16 May 2024. Clever Cloud says version 2.1 is due to be published in October 2026 and to take effect in December 2026, so no host can hold it yet.
- **The official register.** France's Digital Health Agency, the ANS, publishes the list of certified hosts, so you can check a provider's claim against it.

## What to check before you sign

- **The certificate itself.** Ask for the number, issuing body, expiry date and the activities listed. Clever Cloud and Scalingo both publish theirs.
- **Every company in the chain.** A PaaS usually sits on someone else's datacentre. Scalingo's HDS appendix names Outscale, a Dassault Systèmes subsidiary, as the subcontractor for the physical and hardware layers, and states whether each party can reach health data from outside the EEA.
- **Which services are inside the scope.** A certified provider rarely certifies everything it sells. Scalingo excludes some database engines, and OVHcloud restricts the option to certain products.
- **The contract.** Certified hosting comes with a specific health data contract or addendum, on top of the usual GDPR processing agreement. The base processing agreement is walked through in the [GDPR hosting checklist](/i/gdpr-hosting-checklist).
- **A health professional contact.** Scalingo's documentation says the framework obliges it to keep a named point of contact per customer, who can designate a health professional when health data must be accessed or an incident handled.

## 1. Clever Cloud

Clever Cloud, a French company, runs apps you push from Git alongside managed databases. Its HDS certificate, issued on 20 December 2024 by Bureau Veritas Certification, covers all six activities. Health data stays in three French regions: Paris, in the TH2 and nLighten facilities, and the OVH HDS zones in Gravelines and Roubaix. Its managed PostgreSQL, MySQL, MongoDB, Redis and Elasticsearch are inside that scope.

- **Best for:** health software vendors who want app servers and several database engines from one certified provider.
- **Price:** a fixed €200 a month subscription, plus a 1.4 multiplier on the standard rate for the CPU, memory, storage and databases you use. Its sales team prepares the exact quote.
- **What it lacks:** deployments on your own hardware or in an isolated environment fall outside its certified scope today, its FAQ says.

## 2. Scalingo

Scalingo is a Heroku-style platform in Strasbourg. It first certified under version 1.1 in September 2022 and renewed for three years under version 2.0 on 12 September 2025, covering all six activities. HDS isn't a setting you switch on later: you pick it when you create the app or database, and an existing resource can't be converted.

- **Best for:** teams that already know the Heroku workflow and want a clear, published price for an HDS stack.
- **Price:** Scalingo says HDS coverage carries no direct surcharge, but it requires high availability. Web processes run on at least two containers, so two 256 MB containers come to €14.40 a month excl. VAT. HDS databases must use the Business or Enterprise classes; the smallest Business PostgreSQL with 512 MB and 10 GB is €20 a month excl. VAT, or €24 in its SecNumCloud region.
- **What it lacks:** Elasticsearch, MongoDB and InfluxDB aren't eligible for HDS workloads.

## 3. OVHcloud

OVHcloud is a French infrastructure provider. Its compliance page says it first gained approval in 2016 and HDS certification in 2019, and that it also follows health data hosting rules in Germany, Italy, Poland and the UK. You enable the HDS option from the Control Panel on Hosted Private Cloud and Public Cloud projects, and through sales for Bare Metal servers.

- **Best for:** teams that run their own servers or private cloud and need certified infrastructure underneath.
- **Price:** Not stated on its HDS page. You need a Business or Enterprise support level and must accept the OVHcloud Healthcare Addendum, and sales handles the request.

## 4. Eurobase

Eurobase is a Warsaw-registered business that deploys web apps, Functions and containers on European infrastructure run by Scaleway, a French provider. It does **not** hold HDS certification, so it isn't a fit for any part of your system that stores or processes personal health data under French rules. It doesn't hold ISO 27001 or SOC 2 either; both audits are in progress.

- **Best for:** the parts of a health product that never touch patient data, such as your marketing site, documentation or a public status page.
- **What it lacks:** HDS certification, managed Postgres, MySQL or Redis, and a health data contract.

To see which company handles each piece of a Eurobase project, read the [EU hosting guide](/docs/guides/host-in-the-eu) and the [subprocessor list](/legal/subprocessors).

## How to choose

1. **Map the data first.** List which services store, process or back up health data. Only those need a certified host; the rest of your stack can live elsewhere.
2. **Pick the layer you want to operate.** If you'd rather not patch servers, choose a certified PaaS such as Clever Cloud or Scalingo. If you need full control of the operating system, start from OVHcloud's certified infrastructure. For German and other European health rules, see [where to host health data in Europe](/i/health-data-hosting-europe).
3. **Check the database engine.** Make sure the engine you rely on sits inside the certified scope before you migrate.
4. **Budget for high availability.** Price the redundant processes and database tiers HDS asks for, not a single container.
5. **Read the sovereignty side too.** HDS sets location and audit rules; questions about foreign law are covered in [data residency vs data sovereignty](/i/data-residency-vs-data-sovereignty) and [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act).

## Frequently asked questions

### Does HDS apply to me if I'm not a French company?

It applies to hosting health data covered by French law, whatever country your company is in. The certificate can be issued by a body accredited in another EU member state, and the data must stay inside the European Economic Area, so a provider elsewhere in the EU can qualify if it holds the certificate.

### Does using an HDS-certified host make my company certified?

No. Clever Cloud states that running on its platform doesn't pass the certificate to you; you stay the data controller, under a specific HDS contract. If your own team carries out one of the six activities, such as administering the system that holds the data, that part stays your responsibility, and the contract sets out the split.

### Is GDPR compliance enough for health data in France?

No. Under the GDPR, health data is a special category with stricter rules across the EEA. France adds the HDS requirement on top whenever a third party hosts that data.

### Does HDS require data to stay in France?

The framework requires storage within the European Economic Area, not specifically France. Clever Cloud keeps HDS workloads in its French regions, and Scalingo's appendix states there's no access to health data from outside the EEA.

## Sources

- [Clever Cloud: health data hosting](https://www.clever.cloud/health-data-hosting/) and [Clever Cloud for health software vendors](https://www.clever.cloud/health-hds/)
- [Scalingo: HDS certification](https://scalingo.com/hds-certification), [Scalingo HDS documentation](https://doc.scalingo.com/compliance/hds) and [HDS impact on managed services](https://doc.scalingo.com/platform/hds)
- [Scalingo: health data hosting appendix to its terms](https://scalingo.com/gtc-appendix-health-data-hosting) and [Scalingo pricing](https://scalingo.com/pricing)
- [OVHcloud: healthcare data hosting compliance](https://www.ovhcloud.com/en/compliance/hds/)
- [Eurobase: host a web app in the EU](/docs/guides/host-in-the-eu) and [Eurobase subprocessors](/legal/subprocessors)