# What is SecNumCloud? Rules and qualified providers in 2026

Last updated: 2026-11-10

SecNumCloud is a security qualification for cloud services issued by ANSSI, the French national cybersecurity agency. Since version 3.2, it also requires the provider to be European-owned and run from Europe, which keeps US hyperscalers out unless their technology is run by a European-controlled company, as with S3NS. Services that state the qualification on their own pages include OVHcloud, Outscale, S3NS, Cloud Temple and Numspot. Scalingo and Clever Cloud offer app platforms on top of qualified infrastructure.

The qualification is granted to a specific service, not to a company. A provider can hold it for one product and not for the rest of its catalogue, so the useful question is never "is this company qualified?" but "is the exact service I'll buy qualified?".

## SecNumCloud in short

| Point | What it means |
|---|---|
| Issued by | ANSSI, the French national cybersecurity agency |
| Current version | 3.2, released in March 2022 |
| Scope | One named cloud service at a time: IaaS, CaaS, PaaS or SaaS |
| Ownership rule | Headquartered in Europe; no single non-EU owner above 24%, all non-EU owners together at most 39% |
| Operations rule | Primary administration and maintenance carried out in Europe |
| Size of the framework | More than 700 requirements, according to Cloud Temple |
| Typical buyers | Public bodies, health, finance and insurance, and operators of vital or essential services, the sectors Numspot aims its qualified offer at |

## What version 3.2 changed

Earlier versions were mostly about technical and operational security. Version 3.2 added rules on who owns and controls the provider, aimed at protection from non-European laws. Scalingo's summary of the framework names FISA, the US surveillance law, as one of the laws in view, and Cloud Temple describes the same article as protection against the US CLOUD Act. If you want the background on that law, read [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act).

Three other changes matter if you build software rather than buy infrastructure:

- **PaaS and CaaS are in scope.** Container and platform services can be qualified, not only virtual machines.
- **Composition.** A software vendor can build on infrastructure that's already qualified and concentrate its own audit on the application layer, as Cloud Temple explains it.
- **The trusted cloud label.** Scalingo explains that the French "Cloud de Confiance" label goes to services with a SecNumCloud qualification that aren't subject to non-European law.

SecNumCloud is French. EUCS, the European scheme meant to cover similar ground, is still listed by ENISA as a draft, so nobody holds it yet. [Data residency vs data sovereignty](/i/data-residency-vs-data-sovereignty) covers where EUCS stands.

## Before you rely on a SecNumCloud claim

- **Name the service.** "SecNumCloud cloud" on a homepage tells you little. Find the product the qualification covers and match it to what you'll actually deploy.
- **Check the version.** A 3.2 qualification includes the ownership and European-operations rules. Ask which version applies.
- **Separate the platform from the infrastructure.** A qualified region covers the servers and network underneath. Ask whether the platform service you deploy to is qualified too.
- **Look at the extras.** Ask whether backups, logs, support access and monitoring fall inside the qualified scope, and where each of them runs.
- **Confirm with ANSSI.** The agency publishes its catalogue of qualified products and services on [cyber.gouv.fr](https://cyber.gouv.fr/). Treat it as the reference over any marketing page, including this one.

## Providers that state a SecNumCloud qualification

Each line below comes from the provider's own site, checked on 10 November 2026.

| Provider | Qualified offer, as the provider names it | Type | Note |
|---|---|---|---|
| OVHcloud | SNC Cloud Platform, Managed VMware vSphere, SAP HANA on Private Cloud, Bare Metal Pod | IaaS and managed services | SNC Cloud Platform qualified in September 2026, VMware in December 2020; Roubaix, Gravelines and Strasbourg |
| Outscale | Its SecNumCloud 3.2 public cloud region | IaaS, Kubernetes, hosted AI models | Managed Kubernetes and Mistral AI models run in that region |
| S3NS | PREMI3NS | Public cloud on Google Cloud technology | Thales and Google Cloud alliance; French-law company with three datacenters in France |
| Cloud Temple | OpenSource IaaS and services built on its qualified infrastructure | IaaS, managed databases | Says each product is qualified or eligible for qualification |
| Numspot | Its IaaS | IaaS | Also HDS-certified for health data |

### OVHcloud

OVHcloud lists four SecNumCloud offers. The newest, SNC Cloud Platform, brings public-cloud-style managed services under the qualification and was qualified in September 2026. Its Managed VMware vSphere service has held it since December 2020. The services sit in datacentres in Roubaix, Gravelines and Strasbourg, and OVHcloud says only staff based in Europe operate, maintain and monitor them.

### Outscale

Outscale describes its public cloud as SecNumCloud 3.2 qualified, and runs a managed Kubernetes service and Mistral AI language models in that region. It's also the base Scalingo uses for its own SecNumCloud region.

### S3NS

S3NS is a French-law company formed by Thales and Google Cloud. Its PREMI3NS offer is a public cloud based on Google Cloud technology and is SecNumCloud 3.2 qualified, according to S3NS. It's the route for teams who want Google Cloud services inside the French framework.

### Cloud Temple

Cloud Temple runs an open-source IaaS in its SecNumCloud-qualified environment and offers managed PostgreSQL, MariaDB and a file system on the same infrastructure. Its compliance page says each product is either qualified or eligible for qualification, and eligible means not yet qualified, so ask which side of that line the service you want is on.

### Numspot

Numspot states that ANSSI qualified its IaaS offer for SecNumCloud and that it also holds HDS certification. Its offer targets the public sector, health, financial services and insurance, and operators of vital or essential services.

## App platforms on qualified infrastructure

If you want to push code instead of running servers, two French platforms put their PaaS on top of a qualified provider:

- **Scalingo** runs a SecNumCloud region that its pricing page says is based on Outscale's SecNumCloud IaaS. A 256 MB container costs €7.20 a month excl. VAT in its standard region and €8.64 in the SecNumCloud region. Its smallest Postgres, 512 MB with 10 GB, follows the same €7.20 and €8.64 split. There's a 30-day free trial.
- **Clever Cloud** offers a SecNumCloud zone on request through its partner Cloud Temple. Its standard platform runs in its own French datacenters.

In both cases the infrastructure underneath is qualified. Whether the platform layer is qualified in its own right isn't stated on those pages, so ask before you put it in a tender response.

## Where Eurobase stands

Eurobase doesn't hold a SecNumCloud qualification and doesn't sell a qualified region. If a contract or tender names SecNumCloud, choose one of the services above. Eurobase is a business registered in Warsaw, Poland, and hosts your apps on European infrastructure run by Scaleway, a French provider. It's working towards ISO 27001 and SOC 2, and holds neither today. GitHub and GitLab Inc. are US subprocessors when you connect them, and you can [deploy from Codeberg](/docs/guides/deploy-from-codeberg), a non-profit Git host based in Germany, instead. It fits teams that want a European provider for web apps without a formal qualification requirement. The [host in the EU guide](/docs/guides/host-in-the-eu) and the [subprocessor list](/legal/subprocessors) show what runs where.

## Frequently asked questions

### Is SecNumCloud mandatory?

It's mandatory when your contract, tender or sector rules name it. Qualified providers aim these offers at French public bodies, health, finance and operators of vital or essential services. If you sell to none of them, read your customer's requirements before you pay for a qualified service.

### Can AWS, Azure or Google Cloud be SecNumCloud qualified?

Not on their own under version 3.2, because of the European headquarters rule and the ownership caps. The route in use is a separate French-law company, as with S3NS, the Thales and Google Cloud alliance whose PREMI3NS offer runs on Google Cloud technology.

### Is SecNumCloud the same as EUCS?

No. SecNumCloud is a French qualification issued by ANSSI. EUCS is a proposed European certification scheme that hasn't been adopted, and Scalingo expects it could eventually replace SecNumCloud.

### Does a SecNumCloud region make my app qualified?

No. The region qualifies the infrastructure underneath. Your app, and any platform layer between the two, needs its own assessment if your buyer asks for a qualified service end to end.

### Where is the official list of qualified providers?

ANSSI keeps it in its catalogue of qualified products and services on cyber.gouv.fr. Look up the exact service name and its qualification date there before you sign.

## Sources

- [ANSSI, cyber.gouv.fr](https://cyber.gouv.fr/)
- [ENISA: draft candidate schemes](https://certification.enisa.europa.eu/certification-library/draft-candidate-schemes-technical-documents_en)
- [Scalingo: Inside SecNumCloud 3.2](https://scalingo.com/blog/referentiel-secnumcloud-3-2-evolutions-futur)
- [Cloud Temple: SecNumCloud 3.2](https://www.cloud-temple.com/en/secnumcloud/) and [Cloud Temple: our SecNumCloud approach](https://www.cloud-temple.com/en/our-secnumcloud-approach/)
- [OVHcloud: ANSSI SecNumCloud](https://www.ovhcloud.com/en/compliance/secnumcloud/)
- [Outscale](https://en.outscale.com/)
- [S3NS](https://www.s3ns.io/en)
- [Numspot](https://numspot.com/)
- [Scalingo pricing](https://scalingo.com/pricing)
- [Clever Cloud](https://www.clever.cloud/)
- [Eurobase: host a web app in the EU](/docs/guides/host-in-the-eu), [deploy from Codeberg](/docs/guides/deploy-from-codeberg) and [Eurobase subprocessors](/legal/subprocessors)