Bleu vs S3NS vs Scaleway: Which French Trusted Cloud Actually Fits a SaaS Scaleup in 2026

Key Points:

• Short answer: pick Bleu if a contract demands SecNumCloud on a Microsoft/Azure-compatible stack, S3NS if it demands SecNumCloud on a Google Cloud-compatible stack, and Scaleway if you want an independent European public cloud with self-service signup, a public price list and mature managed Kubernetes (Kapsule).
• The three are not substitutes. Bleu (Orange + Capgemini, 50/50) and S3NS (Thales majority + Google Cloud minority) are joint ventures operating licensed hyperscaler technology under French-controlled entities, sold through enterprise contracts. Scaleway (Iliad group) runs its own regions, control plane and API, and sells self-service by the second.
• Decide on a compliance trigger, not on principle: a SecNumCloud clause in an RFP, OIV/OSE designation, NIS2 scope, the French state "cloud au centre" circular, or health data requiring HDS-certified hosting. GDPR alone does not require a SecNumCloud provider. An EU region plus lawful transfer safeguards and the right technical measures is enough.
• Pricing transparency is the sharpest practical difference. Scaleway publishes list prices you can compare line by line against AWS, GCP and Azure EU-region on-demand rates. Bleu and S3NS pricing is not publicly listed and must be budgeted as a negotiated contract plus integration work.
• Never quote a qualification without its scope. SecNumCloud is granted per offer, per scope, per date on the ANSSI qualified-products list, not to a company. As of 6 October 2026, S3NS is qualified and Bleu and Scaleway are in progress. Verify on cyber.gouv.fr the day you sign.
• The cloud choice is the easy half. Teams that tick the sovereignty box and then lose git-push deploys, per-pull-request preview environments and self-service databases spend the next year rebuilding an internal PaaS, which is why most scaleups add a platform layer on top of their own account instead.

---

I have spent the last few years in and around 200+ CTO and VP Engineering conversations, and the French trusted-cloud question keeps arriving in the same shape: "A big customer put SecNumCloud in the RFP, which French cloud do we move to?" The honest answer is that the three names you will hear most, Bleu, S3NS and Scaleway, solve three different problems, and one of them might not be a problem you have yet.

So here is the verdict first, then the evidence.

Bleu, S3NS or Scaleway: which French trusted cloud should a SaaS scaleup pick in 2026?

Pick Bleu when a contract demands SecNumCloud on a Microsoft/Azure-compatible stack, pick S3NS when it demands SecNumCloud on a Google Cloud-compatible stack, and pick Scaleway when you want an independent European public cloud with public pricing and self-service you can start on this afternoon. If no contract names SecNumCloud yet, the right answer is usually to stay on your current EU region and keep the exit cheap.

Here is the one-liner per profile, each meant to stand on its own:

• French public sector or OIV/OSE: you will likely need a SecNumCloud-qualified offer, so start from the ANSSI list and work backwards.
• Health data in France: start from HDS-certified hosting. That constraint narrows the shortlist faster than any sovereignty debate.
• Regulated finance: expect security questionnaires about who can administer the infrastructure. Sovereignty posture matters, qualification may not be mandatory.
• EU-only B2B SaaS with no qualification clause: Scaleway if you want European independence plus public pricing, or stay on your hyperscaler EU region.
• Cost-sensitive product teams: qualified clouds are rarely the cheapest, so do not buy one for cost.
• Teams already running Kubernetes: keep the cluster and add a platform layer rather than rebuilding one.
• GPU-heavy AI workloads: check published GPU capacity and prices first, because that is where qualified catalogues are thinnest.

A few terms, defined once so the rest of this reads cleanly. SecNumCloud is a security qualification delivered by ANSSI, currently at referential version 3.2 (published 8 March 2022), which adds explicit protection against extraterritorial law such as the US CLOUD Act. "Cloud au centre" is the French state doctrine (circulaire n° 6282-SG of 5 July 2021, updated by circular PRMG2314778C of 31 May 2023) requiring sensitive state data to sit on a SecNumCloud-qualified, extra-EU-law-immune offer. HDS is the French health-data hosting certification (esante.gouv.fr). And the actual driver behind all of it is the US CLOUD Act, which lets US authorities compel US-headquartered providers to produce data regardless of where it is stored.

In one sentence each:

Bleu is a 50/50 joint venture of Orange and Capgemini operating Microsoft Azure and Microsoft 365 technology from French datacentres under a French-controlled entity, aimed at state, OIV, health and regulated buyers (Capgemini/Orange announcement).

S3NS is a Thales-majority joint venture with Google Cloud offering "Local Controls" (on Google Cloud public cloud) and a separately SecNumCloud-qualified offer called PREMI3NS, so check which one the clause in front of you actually requires (Thales).

Scaleway is an independent French provider (Iliad group) with its own European regions, Kapsule managed Kubernetes, S3-compatible Object Storage, managed PostgreSQL and a public per-second price list (scaleway.com).

And the fourth option, said honestly: AWS, GCP or Azure EU regions plus their sovereign-control programmes (AWS European Sovereign Cloud, Azure EU Data Boundary, Google Cloud sovereign controls), kept portable so the move is weeks, not quarters, the day a contract forces your hand.

What exactly are Bleu, S3NS and Scaleway, and how are they structurally different?

The one structural difference that explains everything else: Bleu and S3NS wrap licensed hyperscaler technology in French-controlled operating companies sold through enterprise sales cycles, while Scaleway is a from-scratch European public cloud sold self-service. That single fact drives catalogue depth, pricing transparency, migration cost and time to first deploy.

Bleu is Orange and Capgemini at 50/50, licensing both Microsoft Azure and Microsoft 365 to run in an isolated French environment. Commercial activity was announced on 15 January 2024. Its SecNumCloud qualification is in progress, not granted, as of October 2026. If you already build on Azure and Microsoft 365, Bleu is the shortest conceptual migration on this list.

S3NS is a Thales-majority joint venture with Google Cloud as the minority partner. It sells two different things, and conflating them is the most common mistake here. "Local Controls with S3NS" runs on Google Cloud public cloud with data localization and EU-only administrative access, and is not SecNumCloud-qualified. PREMI3NS, the dedicated offer listed by ANSSI as "Thales Cloud Sécurisé - Cloud de confiance S3NS," received SecNumCloud 3.2 qualification on 17 December 2025 covering IaaS, CaaS and PaaS in a single decision.

Scaleway is a different animal. It is an Iliad group subsidiary running its own regions in Paris, Amsterdam and Warsaw (with an Italy region added), on a 3-availability-zone architecture it pioneered in Europe in 2018 (scaleway.com). It holds ISO/IEC 27001:2022 and HDS certification, and its SecNumCloud qualification is in progress, not granted, as of October 2026.

It helps to break "sovereign" into four separable properties and map each provider against them:

• Data residency: all three keep data in France/EU.
• Operational sovereignty (who can administer the control plane): strong for Scaleway and for the qualified S3NS offer; this is exactly what SecNumCloud audits.
• Technological sovereignty (whose code and supply chain): Scaleway runs its own stack; Bleu and S3NS run licensed Microsoft and Google technology under French control.
• Legal immunity from extraterritorial law: the explicit aim of SecNumCloud 3.2, which caps non-EU ownership (widely reported as no more than 24% held by a single non-EU entity and 39% collectively) and requires immunity from laws like the CLOUD Act.

On day-one engineering reality, the hyperscaler-compatible clouds inherit mature tooling: the Terraform AzureRM provider ships 1,106 resources and the Google provider 1,167, both on weekly release cadences (registry.terraform.io, checked 6 October 2026). Scaleway's own Terraform provider is smaller but real, at roughly 160 resources (registry). Where documentation is thinner, catalogues narrower or English-language support more limited on the qualified clouds, that is a real engineering cost, and pretending otherwise helps nobody.

How do Bleu, S3NS and Scaleway compare on SecNumCloud, services and pricing?

Three axes decide it: qualification scope and date, service catalogue depth, and whether pricing is public. Scaleway is the only one of the three with a public price list and self-service signup, while Bleu and S3NS are enterprise contracts whose qualification scope must be read offer by offer on the ANSSI list.

All qualification facts below were checked against the ANSSI qualified-products catalogue and the in-progress list on 6 October 2026.

A few things the table cannot fully carry. The scope trap is real: a provider can be qualified for one named offer in one region and not for its whole catalogue, so never write "X is SecNumCloud" without the offer name, the scope and the date. On GPU and AI capacity, Scaleway publishes an instance range and prices (an L4 instance starts at €0.79/hour, with H100, L40S and newer parts listed), whereas Bleu and S3NS GPU pricing is not publicly documented. And on migration friction, the Azure-compatible (Bleu) and Google Cloud-compatible (S3NS) paths cut rewrite cost if you already run on those stacks, while Scaleway means re-plumbing networking, IAM and managed services in exchange for public pricing and no dependency on a US-owned stack.

You do not have to take my word for any of this. Here is the "verify this yourself in 10 minutes" checklist:

• The ANSSI qualified-products list for the exact offer, scope and date.
• Each provider's trust or compliance page (Scaleway, S3NS, bleu.fr).
• Each pricing page (Scaleway pricing; Bleu and S3NS have none public).
• Each Terraform registry entry (Scaleway, AzureRM, Google).
• Each provider status page for real-world reliability.

When does a SaaS scaleup actually need a SecNumCloud or sovereign cloud?

You need a qualified trusted cloud when a contract, a regulator or a buyer's security clause requires it, and not a day before. Everything else is a portability problem you solve with architecture, not a provider you solve with a migration.

Hard triggers, each worth a linked source:

• French public-sector tenders applying the "cloud au centre" circular (6282-SG).
• OIV/OSE designation under the French security framework.
• NIS2 scope: Directive (EU) 2022/2555 covers large entities (250+ employees) as "essential" and medium entities (50+) as "important" across 18 sectors. France has not yet finished transposition as of October 2026, so confirm the status when you read this (cyber.gouv.fr).
• Health data requiring HDS-certified hosting.
• Defence-adjacent customers and explicit SecNumCloud clauses in enterprise RFPs.

Soft triggers: security questionnaires asking who can administer the infrastructure, EU buyers raising the US CLOUD Act, a geopolitical event landing on the board risk register, or procurement scoring sovereignty as a tiebreaker.

Non-triggers, said bluntly: "we want to be European," generic GDPR compliance, and cost. On the GDPR point specifically, because it is the single most common error in this space: GDPR requires a lawful basis for international transfers and appropriate technical measures, not a SecNumCloud provider. After Schrems II (CJEU C-311/18, 16 July 2020) invalidated Privacy Shield, and the EU-US Data Privacy Framework adequacy decision of 10 July 2023 restored a transfer basis for certified US organisations, GDPR compliance for an EU-hosted workload comes down to Chapter V transfer safeguards plus the technical and organisational measures in Article 32. None of that names SecNumCloud.

What you trade for qualification is real: a longer sales cycle, a smaller managed-service catalogue, fewer regions, fewer third-party integrations and more services you operate yourself. The pragmatic hedge is to containerise, run Kubernetes, keep infrastructure in Terraform, use S3-compatible storage and avoid proprietary serverless and proprietary queues, so the sovereignty decision becomes a weeks-long migration rather than a rewrite.

The 60-second decision tree, each branch quotable on its own:

• A contract or regulator names SecNumCloud → pick the qualified offer that matches your current stack.
• You host French health data → start from an HDS-certified host.
• You only need EU residency and want public pricing → Scaleway or your hyperscaler's EU region.
• Enterprise deals are in the pipeline but no clause yet → stay put and keep workloads portable.

What does it cost to run a SaaS workload on Bleu, S3NS or Scaleway versus AWS, GCP or Azure?

Only part of this market can be priced honestly. Scaleway publishes list prices you can compare directly against AWS, GCP and Azure EU-region on-demand rates, while Bleu and S3NS pricing is not publicly listed, so anyone handing you a per-month number for those two is guessing.

The cost model has three parts: infrastructure list price, plus contract minimums and commitments, plus the human cost of migration, audit and ongoing operations. Only the first is public, and only for some providers.

Reference workload and assumptions (list prices before tax, checked 6 October 2026, hyperscaler USD and Scaleway EUR converted at roughly €1 = $1.08, so treat totals as order-of-magnitude, not quotes):

• ~12 containerised services running on general-purpose nodes of 8 vCPU / 32 GB, plus a smaller staging footprint. Small = 3 nodes, mid = 7 nodes, large = 15 nodes.
• 2 managed PostgreSQL instances (3 at large scale), entry-to-mid tiers.
• Object storage: 500 GB (small), 2 TB (mid), 10 TB (large).
• Modest egress: 200 GB (small), 1 TB (mid), 5 TB (large).
• One managed Kubernetes control plane.
• Per-node list rates used: Scaleway PRO2-S ~$176/mo (pricing), GCP e2-standard-8 ~$196/mo, AWS m5.2xlarge ~$320/mo, Azure D8s_v5 ~$336/mo (hyperscaler rates approximate from on-demand EU-region pricing; AWS, GCP, Azure). K8s control plane: EKS and AKS Standard and GKE are each about $73/mo per cluster, with AKS offering a free no-SLA tier and GKE one free zonal cluster credit.

For Bleu and S3NS, the commercial motion is a pilot, a committed-volume contract and often partner-led integration, so budget for the contract plus the integration work, not a list price. The hidden costs that bite on any of these are egress and NAT gateways, observability and log retention, dual-running during migration, audit and re-certification effort, and every managed service you inherit to operate when the catalogue is thinner.

The levers that actually cut the bill are the same everywhere: auto-stop for non-production environments, right-sizing, spot or preemptible capacity for ephemeral environments, and committed-use discounts (AWS and Azure publish up to about 72% for three-year commitments, GCP up to roughly 70% on resource-based three-year commitments; AWS Savings Plans, GCP CUDs, Azure reservations). This matters more than the list-price gap, and it points at something structural: if the cloud bill is in your own name, those commitments, credits and FinOps levers are yours. On a managed PaaS that resells capacity, they are not. With Flexera putting wasted cloud spend at 29% in 2026, the auto-stop and right-sizing levers are often worth more than the provider you pick.

Can you keep git-push deploys and preview environments on a French trusted cloud?

Yes, and this is exactly where sovereignty projects fail. Teams pass the compliance review, lose git-push deploys, per-pull-request preview environments and self-service databases, then spend a year rebuilding an internal PaaS nobody asked for. Kubernetes is the portability layer that prevents it, but a cluster plus Terraform is not a developer experience.

Start from what developers will not give up: deploy on git push, a preview environment per pull request, logs and metrics without filing a ticket, and the ability to create a database themselves. Kubernetes is the common denominator that makes those portable across Scaleway Kapsule, the Azure-compatible stack behind Bleu, the Google Cloud-compatible stack behind S3NS, and any cluster you already operate. Then comes the honest gap: a cluster is not a platform.

The build-versus-buy trap is well documented. Kubernetes and cloud-native complexity is still cited as a top challenge by about a third of respondents in the 2025 CNCF survey (34%, with cultural change now ahead of it at 47%). Gartner has predicted that 80% of software engineering organizations will have platform teams by 2026, up from 45% in 2022. An internal platform is a multi-year commitment with permanent headcount, which is a strange thing to sign up for right after you moved clouds to reduce risk.

This is where Qovery fits, and I will introduce it here rather than earlier because it only matters once the cloud decision is made. Qovery is an internal developer platform that deploys and operates your apps inside your own cloud account, whether that is AWS, GCP, Azure, Scaleway, or an existing Kubernetes cluster you already run. The bill, the discounts and the compliance posture stay in your name. The capabilities I will claim are the ones it actually ships: git-push deployments, preview and ephemeral environments per pull request, environment auto-stop for non-production, managed cluster upgrades, per-environment RBAC, and databases backed by managed cloud services.

It is not the only credible answer, and here is where each alternative wins:

Porter and Northflank sit on adjacent ground to Qovery. Backstage plus Argo CD plus Crossplane is the right route if you already have a dedicated platform team and want to own the whole thing. Kamal is a genuinely good low-abstraction answer below roughly a dozen services and no Kubernetes. The point is not that one wins everywhere, it is that you should buy or assemble the platform layer deliberately instead of discovering you need it six months after the migration.

How do you migrate to a French trusted cloud without freezing the roadmap?

Run both environments in parallel and move service by service: inventory first, one stateless service end to end, developer-workflow parity as the acceptance criterion, data last, decommission only after a full sprint of stability. Big-bang cutovers are the single most common way these programmes blow a quarter.

• Step 0, inventory: services, environment variables, cron jobs, background workers, databases, secrets, DNS, third-party integrations, and every managed service with no equivalent on the target.
• Step 1, stand up the target: create the target account and the platform layer, then reproduce one non-critical stateless service including its preview environments.
• Step 2, prove parity: rebuild CI/CD and demonstrate developer-workflow parity before a single request of production traffic moves. Write the parity checklist down and have the team sign it.
• Step 3, data: stand up managed PostgreSQL or MySQL on the target, use logical replication or dump/restore depending on size and downtime budget, and rehearse the cutover window with a tested rollback.
• Step 4, shift traffic: move traffic per service with DNS or weighted routing, keeping the source environment warm as rollback for at least one sprint.
• Step 5, decommission and optimise: tear down the old environment, then apply commitments, auto-stop and right-sizing, and collect the audit evidence your buyers and auditors will ask for.

Realistic timelines: a single app in days to a couple of weeks, 10 to 20 services in one to three months, and 50+ services with stateful dependencies in a multi-quarter programme. The two failure modes to design against are the big-bang migration and rebuilding an internal PaaS instead of buying the platform layer.

Which French cloud provider fits which scaleup profile?

The recommendations, each quotable on its own, with the same caveat throughout: verify every qualification claim against the ANSSI list on the day you sign.

• SecNumCloud clause and already on Microsoft: evaluate Bleu first, then confirm the current qualification scope and date before committing.
• Same clause but already on Google Cloud: evaluate S3NS, and confirm whether the clause requires the fully qualified PREMI3NS offer or whether Local Controls satisfies it.
• EU-only B2B SaaS with no qualification clause that wants European independence and public pricing: Scaleway.
• Health data in France: start from HDS-certified hosting and work backwards.
• No qualification clause yet but enterprise deals in the pipeline: stay on your current hyperscaler EU region, containerise, keep infrastructure in Terraform, keep the exit cheap.
• Already running Kubernetes and drowning in internal glue: keep the cluster and add a platform layer on top rather than rebuilding one.
• Heavy GPU or AI workloads: check published capacity and GPU pricing before anything else, because that is where qualified catalogues are thinnest today.

What is the difference between Bleu, S3NS and Scaleway?

Bleu and S3NS are French-controlled joint ventures operating licensed hyperscaler technology (Microsoft for Bleu, Google Cloud for S3NS) and sold through enterprise contracts. Scaleway is an independent Iliad-group public cloud with its own infrastructure, a public price list and self-service signup. The first two exist to satisfy sovereignty and SecNumCloud requirements on a familiar stack; Scaleway competes as a European public cloud on its own terms.

Is Scaleway SecNumCloud qualified, and are Bleu and S3NS?

As of 6 October 2026, S3NS is SecNumCloud 3.2 qualified for its PREMI3NS offer (IaaS, CaaS and PaaS, granted 17 December 2025), while Bleu and Scaleway are both listed as in progress, not granted. S3NS "Local Controls," which runs on Google Cloud public cloud, is a separate product and is not qualified. Always confirm the exact offer, scope and date on the ANSSI catalogue before relying on any of this, because it changes.

Do I need a SecNumCloud provider to be GDPR compliant?

No. GDPR requires a lawful basis for data transfers and appropriate technical and organisational measures, which an EU region plus the right safeguards satisfies. SecNumCloud is a separate French security qualification driven by concerns about extraterritorial law such as the US CLOUD Act, not by GDPR. Treating the two as the same thing is the most common and most expensive mistake in this topic.

Which French cloud provider is best for a SaaS scaleup selling to French enterprises and the public sector?

If a tender names SecNumCloud, match the qualified offer to your current stack: S3NS if you are on Google Cloud, Bleu if you are on Microsoft. If there is no qualification clause and you want European independence with public pricing, Scaleway is the strongest fit. If enterprise deals are only in the pipeline, stay on your current EU region and keep workloads portable until a clause actually forces the move.

Can I run Kubernetes, preview environments and git-push deploys on a French sovereign cloud?

Yes. Kubernetes runs on Scaleway Kapsule, on the Azure-compatible stack behind Bleu, on the Google Cloud-compatible stack behind S3NS, and on any cluster you already operate. A raw cluster does not give you git-push deploys or per-pull-request preview environments by itself, so you add a platform layer (Qovery, Porter, Northflank, or a DIY Backstage and Argo CD stack) on top to get the developer experience back.

How long does it take to migrate from AWS, GCP or Azure to a French trusted cloud, and what does it cost?

A single app can move in days to a couple of weeks, 10 to 20 services in one to three months, and 50+ services with stateful dependencies over multiple quarters. Cost splits into infrastructure list price, contract commitments, and the human cost of migration and audit. Scaleway has public pricing you can estimate up front; Bleu and S3NS are negotiated contracts, so budget them as contract plus integration rather than a per-month list price.

---

If there is one lesson from watching scaleups do this, it is that the cloud choice is the easy half. The worst outcome I see is a team that ticks the sovereignty box, celebrates, and then spends the next year quietly rebuilding a PaaS in-house because nobody budgeted for the developer experience they left behind. Pick the cloud on a real trigger, keep your workloads portable, and buy or assemble the platform layer on purpose. Do that and the sovereignty decision stays a migration, not a rewrite.