Numspot vs OVHcloud vs Scaleway: which SecNumCloud-qualified sovereign cloud should a French software vendor pick in 2026?

Key Points:

• SecNumCloud qualifies a named service, not a company. ANSSI grants the visa to a specific offer, such as OVHcloud's "Hosted Private Cloud powered by VMware" or Outscale's "IaaS", in specific datacentres. A provider on the list can still sell you managed Postgres or managed Kubernetes outside the qualified scope, so check the ANSSI catalogue service by service before you sign.
• As of October 2026, 3DS Outscale, OVHcloud, Cloud Temple, Worldline and Cegedim hold IaaS qualifications on the ANSSI catalogue, and Numspot (IaaS, September 2026) and S3NS (December 2025) have announced theirs. Scaleway and Bleu are officially "en cours de qualification". Clever Cloud is not qualified and routes SecNumCloud workloads through partner infrastructure.
• Pick by workload, not by flag. Choose 3DS Outscale or Cloud Temple for ministry, defence and OIV/OES workloads with a strict named scope. Choose OVHcloud for catalogue breadth and the lowest egress bill, Scaleway for developer experience and Kubernetes maturity, and Numspot for a SecNumCloud-first platform backed by Docaposte and Banque des Territoires.
• Managed Kubernetes is the weak spot in almost every qualified scope. OVHcloud MKS and Scaleway Kapsule are excellent, but they sit outside SecNumCloud today. Cloud Temple's PaaS OpenShift is the main qualified managed Kubernetes on the ANSSI catalogue. Plan to install and run Kubernetes yourself on at least one of your target providers.
• If different customers push you onto different sovereign clouds, keep the deployment layer above the provider. Qovery deploys your apps into your own AWS, GCP, Azure or Scaleway account, or onto any Kubernetes cluster you already operate, including one on OVHcloud, Outscale, Cloud Temple or Numspot. Switching provider then costs you a cluster, not a rewrite. Qovery itself is not SecNumCloud-qualified. The provider underneath carries the visa.

Last year a CTO I know got a tender from a regional health group. Page 14 of the cahier des charges had one line: "hébergement sur une offre qualifiée SecNumCloud". His product ran on AWS eu-west-3, in a clean Terraform setup he was proud of. Six weeks before the deadline, he was rebuilding his deployment pipeline on a provider his team had never touched.

I have interviewed more than 200 CTOs, and I hear some version of that story every month. Very few French software vendors choose a sovereign cloud out of curiosity. A tender chooses it for them. European providers hold only around 15% of their own cloud market, while Amazon, Microsoft and Google hold 70% (Synergy Research Group, July 2025), so most teams start from a hyperscaler and have to work out the French landscape under deadline pressure.

This guide is the comparison I wish that CTO had. All qualification statuses are dated, sourced and checked against ANSSI's own documents as of 22 October 2026.

What is SecNumCloud, and why does it decide which cloud a French public sector vendor can use?

SecNumCloud is a security qualification issued by ANSSI, the French national cybersecurity agency. It covers a defined scope of cloud services, operated by a company protected from non-EU extraterritorial law. The French State's cloud doctrine makes it mandatory for its most sensitive data, so the visa, not price or developer experience, ends up deciding most sovereign cloud shortlists.

The current version of the standard is the referentiel SecNumCloud 3.2 of 8 March 2022. Most of its requirements are technical and organisational, close to ISO 27001 with stricter operational rules. Section 19.6 adds the legal part that the US hyperscalers cannot meet on their own. The provider's head office must be in the EU. Non-EU entities cannot hold more than 24% of capital or voting rights individually, or more than 39% collectively. And no non-EU subcontractor may have the technical ability to access customer data.

The doctrine that turns this into an obligation is "Cloud au centre". It started with circulaire n° 6282-SG of 5 July 2021 and was updated by circulaire n° 6404-SG of 31 May 2023. According to DINUM's summary, data "d'une sensibilité particulière" must be hosted on a commercial offer that "devra impérativement respecter la qualification SecNumCloud". That covers data whose breach could harm public order, public safety, health or intellectual property. Article 31 of the SREN law of 21 May 2024 wrote the requirement into law for State administrations and their operators.

The scope trap. A qualification names services and datacentres. If your managed Postgres or your managed Kubernetes cluster is not in that list, it is not qualified, even if the provider's logo is on the ANSSI page. I have seen vendors lose weeks because a sales deck said "SecNumCloud" and the decision document said "IaaS only".

Tenders also stack requirements. HDS (Hébergeur de Données de Santé) is a separate certification for health data. ISO 27001, 27017 and 27018 are baseline certifications that SecNumCloud does not replace on paper. The European EUCS scheme is still not adopted. A hospital tender can ask for HDS and SecNumCloud at the same time, and you need both.

As a software vendor, you inherit all of this through your customer's tender. That is why your deployment stack has to be portable before the tender arrives. I covered the requirement side in more depth in what French public sector buyers actually require from SaaS vendors.

How did we compare these sovereign clouds?

We scored each provider on seven criteria that a software vendor actually feels in production, and ignored marketing claims of "souveraineté" with no ANSSI decision behind them.

1. SecNumCloud scope: which named services are qualified, since when and until when, according to the ANSSI catalogue and the "en cours de qualification" list.
2. Managed Kubernetes: is there a managed container runtime, and is it inside or outside the qualified scope?
3. Catalogue depth: managed databases, S3-compatible object storage, load balancing, observability.
4. Published pricing: public per-hour rates, object storage per TB, and egress after the EU Data Act.
5. Migration effort from AWS, GCP or Azure: API compatibility and Terraform provider maturity.
6. Account ownership and exit: does the bill stay in your name, and can you leave without rewriting the app?
7. Public sector reach: shareholders, distribution and existing public buyers.

One caveat on sources. The most recent full ANSSI catalogue I could read is dated 5 August 2025. For qualifications granted after that date (Numspot, S3NS), I cite the provider's own announcement and say so. Before you answer a tender, check the live ANSSI page yourself.

Which sovereign cloud should you pick? The 2026 shortlist at a glance

For a ministry or defence workload with a strict named scope, 3DS Outscale or Cloud Temple wins. For catalogue breadth and the cheapest egress, OVHcloud wins. Scaleway wins on developer experience and Kubernetes maturity. Numspot fits teams that want a SecNumCloud-first platform with public sector shareholders. A two-person team with no Kubernetes appetite should pick Clever Cloud.

This table is a snapshot as of 22 October 2026. Scope wording comes from the ANSSI catalogue (5 August 2025 edition) unless marked "provider announcement".

Published list prices only cover the public cloud catalogues, not the qualified private offers. Use them to compare running costs for workloads that do not need the visa, not to budget a qualified deployment.

Sources: OVHcloud Public Cloud prices, Scaleway instance pricing, Scaleway storage pricing, AWS EC2 on-demand pricing, AWS S3 pricing. All checked 22 October 2026. Monthly figures are hourly rate × 730.

Is OVHcloud the safest default for a French public sector software vendor?

OVHcloud is the safest default when you need catalogue breadth and the lowest total bill. Two of its offers are SecNumCloud-qualified, and its public cloud has the most generous egress terms in this comparison. The catch is that the qualified offers and the Public Cloud catalogue are different products, and the tender only cares about the qualified ones.

The ANSSI catalogue lists "Hosted Private Cloud powered by VMware", qualified from 28/12/2023 to 29/12/2026, and "Bare Metal Pod", qualified from 24/03/2025 to 24/03/2028. Both are dedicated infrastructure. The newer SNC Cloud Platform is still listed as "en cours". OVHcloud's own page says "Certifications visées : SecNumCloud", and its Managed Kubernetes Service appears under "Services bientôt disponibles". So MKS and the managed databases on Public Cloud are real and usable, but outside the qualified scope today.

On price, OVHcloud is hard to beat. A b3-16 instance costs €0.1023/h, and outgoing public traffic is included in every region except three in Asia-Pacific (OVHcloud prices). The scale is real too: 46 datacentres, around 500,000 servers and 1.7 million customers in 140 countries (OVHcloud corporate), and a listing on Euronext Paris since October 2021.

The reality check is the Strasbourg fire of 10 March 2021. SBG2 was destroyed, four of SBG1's twelve rooms were damaged, and OVHcloud reported that 120,000 services were fully or partially affected (OVHcloud). Customers with backups in the same site lost them. The lesson applies to every provider here: put your backups in a second region, and write that into your tender answer.

Skip OVHcloud if you expect hyperscaler-grade managed services, AWS API compatibility, or a qualified one-click PaaS.

Where does Numspot actually fit, and is it mature enough to bet a tender on?

Numspot is the only provider here built SecNumCloud-first from day one. That makes it a strong fit for vendors whose customers want a trusted cloud with public sector shareholders. It also has the youngest catalogue in the group, so check every service your roadmap depends on before you commit.

Numspot is owned by Banque des Territoires, Docaposte, Dassault Systèmes and Bouygues Telecom and has operated since 2023. It reached J0 of the IaaS qualification in January 2025 and J1 in April 2025. It announced the SecNumCloud qualification of its IaaS on 1 September 2026. Its managed Kubernetes, PostgreSQL, Secret Manager, Container Registry and AI Platform passed J0 and J1 in May 2026, which means they are on the path but not qualified yet. I could not find a published investment figure, so I will not quote one.

The distribution argument is the real differentiator. Docaposte already sells to collectivités and hospitals, and Banque des Territoires is part of the Caisse des Dépôts group. For a vendor whose buyers already trust those names, that shortens the conversation with procurement.

Skip Numspot if you need a deep, qualified PaaS catalogue today or rely on a lot of Kubernetes-native tooling. If you choose it now, plan to run your own Kubernetes on qualified IaaS until the managed services finish their qualification.

Is Scaleway a credible sovereign choice when the tender asks for SecNumCloud?

Scaleway has the best developer experience and the most mature managed Kubernetes in this comparison, and it is a French company subject only to EU law. It is not SecNumCloud-qualified as of October 2026. Use it for public-sector-adjacent and regulated-but-not-qualified workloads, and do not promise it for data covered by "Cloud au centre" until ANSSI lists it.

The status is clear from both sides. ANSSI lists "Scaleway SecNumCloud (IaaS, PaaS)" as en cours, and Scaleway's security page says the same. Scaleway's August 2026 announcement gives the initial scope: Instances, GPU, Object and Block Storage, VPC, Load Balancer, IAM, Key Manager, Audit Trail and Elastic Metal, in a single Paris availability zone. Kapsule is on the later PaaS roadmap.

For everything else, Scaleway is a pleasure to use. The Terraform provider is well maintained, Kapsule's mutualised control plane is free, and object storage speaks the S3 API, so buckets move from AWS with little effort (Scaleway containers pricing). Instance list prices include egress. Most of the migration work sits in managed service parity: queues, IAM and anything AWS-specific.

Being French-owned (Iliad group) with no non-EU legal exposure is enough for many tenders that ask for "hébergement en France" or "cloud souverain" without naming SecNumCloud. Read the clause carefully. Skip Scaleway if the tender names SecNumCloud for that exact workload and accepts no equivalent. We compared EKS and Kapsule side by side if Kubernetes is your main concern.

What about 3DS Outscale, Cloud Temple, Clever Cloud, Bleu and S3NS?

3DS Outscale and Cloud Temple are the right answer for defence, ministries and OIV/OES-adjacent workloads. Clever Cloud is the French PaaS for teams that want zero infrastructure work. Bleu and S3NS bring Microsoft and Google technology under French control, and they are at different stages of qualification.

3DS Outscale (Dassault Systèmes) holds the oldest qualification on the list. Its "IaaS Cloud on Demand" was qualified on 2 December 2019, and its current "IaaS" qualification runs from 30/11/2023 to 30/11/2026, so check the renewal if your contract crosses that date. Outscale provides APIs "compliant with Amazon Web Services", which makes migration from EC2 and S3 much shorter. The managed PaaS layer is thinner than OVHcloud's.

Cloud Temple was first qualified for Secure Temple on 15 March 2022. Its catalogue entry now covers "IaaS Vmware, IaaS Opensource, stockage objet S3, brique HSM-KMS, Baremetal" plus a qualified "PaaS Openshift", valid until 30/05/2028. Cloud Temple announced the OpenShift qualification in May 2024. It beats everyone here when the tender requires qualified containers, not just qualified VMs.

Clever Cloud gives you git-push deployments with almost no operations work. Its SecNumCloud page says it is waiting for qualification and offers a SecNumCloud zone through partners such as Cloud Temple. It works very well for small teams, and gets limiting once you need Kubernetes-native tooling or several clouds.

Bleu (Orange and Capgemini, Microsoft technology) validated J0 in April 2025 and J1 in November 2025, and still describes itself as "en cours de qualification". S3NS (Thales, with Google Cloud technology) announced the SecNumCloud 3.2 qualification of PREMI3NS on 17 December 2025, covering IaaS, CaaS and PaaS. If your stack is already deep in Azure or GCP, these two keep your tooling. That convenience comes with dependence on a US software vendor's roadmap. More on that trade-off in Bleu, S3NS and Scaleway for SaaS scale-ups.

All of these providers have one thing in common. None of them solves application deployment, environments and day-two operations for you. That work stays with your team, on every provider you add.

How do you support several sovereign clouds at once without rebuilding your stack each time?

Standardise on containers and Kubernetes, then put a deployment platform above the provider so the cloud underneath becomes a replaceable detail. Changing provider should cost you a cluster and a Terraform module, not an application rewrite.

Vendors end up multi-cloud whether they want to or not. One ministry requires Outscale, a hospital group accepts OVHcloud Hosted Private Cloud, your private sector customers stay on AWS, and a large collectivité asks you to deploy on its own on-prem Kubernetes.

Standardise these: container images, Helm charts, Terraform modules per provider, secrets handling, the CI pipeline, and an observability contract (OpenTelemetry, Prometheus metrics).

Avoid depending on these: provider-specific services with no equivalent elsewhere, such as proprietary queues, serverless runtimes and bespoke IAM models. Each one is a rewrite waiting for the next tender.

This is where Qovery fits, and I'll keep it factual since it's my company. Qovery is an internal developer platform that deploys and operates your apps inside your own cloud account on AWS, GCP, Azure or Scaleway. It can also connect to any Kubernetes cluster you already run, including vanilla Kubernetes, OpenShift, k3s or Rancher on OVHcloud, Outscale, Cloud Temple or Numspot infrastructure. Your developers get the same workflow everywhere:

• git-push deployments, with preview environments for every pull request
• auto-start and auto-stop schedules for non-production environments
• RBAC per project and environment type
• managed cluster upgrades on Qovery-managed clusters (on your own cluster, you keep control of the timing)
• databases backed by managed cloud services such as RDS or Scaleway Managed PostgreSQL, where your provider offers them

That gives you Kubernetes without a team dedicated to managing it, and shipping without a dedicated DevOps hire.

The bring-your-own-cloud model matters for sovereignty. The account, the data and the bill stay in your name or your customer's name, which is exactly what a public buyer and an auditor want to see on paper.

To be explicit: Qovery is not SecNumCloud-qualified, and running Qovery does not satisfy a SecNumCloud requirement. The qualified provider underneath carries the visa, and you still need to confirm with your customer how a control plane outside the qualified perimeter fits their security analysis.

To be fair as well: a two-person team with no Kubernetes appetite will be happier on Clever Cloud than on anything Kubernetes-based, Qovery included. For running the same Kubernetes workloads on a sovereign cloud and AWS, the platform approach starts paying off from the second provider.

How do I deploy to my own sovereign cloud account or Kubernetes cluster from Claude Code or Cursor?

Install the Qovery Agent Skills once, then ask your coding agent in plain language to deploy into the cloud account or Kubernetes cluster you already own. The deploy skill shows you its plan and waits for your confirmation before it touches your infrastructure.

Install the skills globally for every compatible agent (Claude Code, Cursor, Codex, OpenCode, Gemini CLI):

curl -fsSL https://skill.qovery.com/install.sh | bash

Or scope the install to a single project:

curl -fsSL https://skill.qovery.com/install.sh | bash -s -- --project

Add the Qovery MCP Server to Claude Code. It uses OAuth and is read-only by default:

claude mcp add --transport http qovery https://mcp.qovery.com/mcp --callback-port 4242

Enable write access only when you want it. This also requires turning on write access in the Qovery Console:

claude mcp add --transport http qovery "https://mcp.qovery.com/mcp?read_write=true" --callback-port 4242

The skills cover the lifecycle: qovery-onboard, qovery-deploy, qovery-troubleshoot, qovery-optimize, qovery-speedup, qovery-preview and qovery-terraform. The skills deploy, and the MCP Server operates what already exists.

Then ask in plain language: "deploy this app to my Scaleway account with Qovery" or "deploy to my existing Kubernetes cluster on Outscale". The full reference is in the AI agent quickstart and the Claude Code integration.

Frequently Asked Questions

Which French cloud providers are SecNumCloud-qualified in 2026?

The ANSSI catalogue lists IaaS qualifications for 3DS Outscale, OVHcloud (Hosted Private Cloud powered by VMware and Bare Metal Pod), Cloud Temple (Secure Temple and PaaS OpenShift), Worldline and Cegedim, plus SaaS qualifications for vendors such as Oodrive and Whaller. Numspot (IaaS, September 2026) and S3NS (PREMI3NS, December 2025) have announced qualifications since the August 2025 catalogue. Always check the live ANSSI page before a tender.

Is Scaleway SecNumCloud-qualified?

No, not as of October 2026. ANSSI lists "Scaleway SecNumCloud (IaaS, PaaS)" as en cours de qualification, and Scaleway's own security page says the same. The announced initial scope covers Instances, storage, networking, IAM and Elastic Metal in one Paris zone. Kapsule managed Kubernetes comes later.

Is Numspot a real alternative to OVHcloud and Scaleway for public sector projects?

Yes for IaaS, which Numspot announced as SecNumCloud-qualified on 1 September 2026, and its shareholders (Banque des Territoires, Docaposte, Dassault Systèmes, Bouygues Telecom) carry weight with public buyers. Its managed Kubernetes and PostgreSQL had only passed J0 and J1 as of May 2026. Plan to run your own Kubernetes on its qualified IaaS for now.

Do I need SecNumCloud to sell software to the French public sector?

Only for some data. The "Cloud au centre" doctrine and article 31 of the SREN law require it for State data of particular sensitivity, while many collectivités and hospitals ask for French or EU hosting, HDS or ISO 27001 instead. Read the tender's hosting clause line by line, because it decides whether Scaleway or OVHcloud Public Cloud is acceptable.

Can I run managed Kubernetes on a SecNumCloud-qualified cloud?

Yes, but the choice is narrow. Cloud Temple's PaaS OpenShift is on the ANSSI catalogue, and S3NS announced CaaS within its qualification. OVHcloud MKS, Scaleway Kapsule and Numspot's managed Kubernetes are outside the qualified scope today, so most vendors install Kubernetes themselves on qualified IaaS.

How do I avoid a rewrite if a customer forces me to change sovereign cloud provider?

Package everything as containers with Helm charts, keep provider-specific services out of the critical path, and keep one Terraform module per provider. Then run a deployment layer such as Qovery above the cluster, so the developer workflow stays the same whether the cluster runs on AWS, Scaleway, OVHcloud or Outscale. The qualified provider still carries the SecNumCloud visa, not the deployment tool.