Outscale vs Cloud Temple vs OVHcloud: which SecNumCloud-qualified cloud fits your workload in 2026?

The most expensive SecNumCloud mistake I see is a team writing "OVHcloud is SecNumCloud-qualified" in an RFP answer and then building on managed Kubernetes, which sits outside the qualified offer. No company is qualified. ANSSI qualifies a named service inside a defined scope, with an expiry date, and the service your developers actually want to use often sits next to that scope rather than inside it.

Below I compare 3DS Outscale, Cloud Temple and OVHcloud on the same six criteria, cover the rest of the shortlist, and finish with the part every qualified provider leaves to you: giving developers a way to deploy.

Key Points:

• SecNumCloud is an ANSSI qualification granted per service, with a defined scope and an expiry date, never per company. Check the exact service name on the ANSSI list of qualified SecNumCloud providers before you sign.
• Pick 3DS Outscale when you want SecNumCloud IaaS with AWS-compatible APIs. Most of your Terraform, SDK and CLI habits carry over, so migration cost is the lowest of the three.
• Pick Cloud Temple when the workload is a VMware-style private cloud or a legacy regulated app you cannot refactor, and you want a qualified operator that runs it with you.
• Pick OVHcloud for published prices and breadth, but only its SecNumCloud offers count. Standard Public Cloud and Managed Kubernetes Service sit outside them, and managed Kubernetes is still "coming soon" on the qualified SNC Cloud Platform.
• None of these providers ships an internal developer platform. Qovery is not a SecNumCloud-qualified cloud. It runs on your own cloud account (AWS, GCP, Azure, Scaleway) or on your existing Kubernetes cluster, including one you run on a qualified provider, so the qualified perimeter and the cloud bill stay in your name.

What is SecNumCloud, and what does "qualified" actually guarantee?

SecNumCloud is a security qualification issued by ANSSI, France's national cybersecurity agency, against a published requirements framework. ANSSI grants it to a named service with a defined technical and geographic scope, for a limited period, and never to a whole company.

The version in force is the SecNumCloud reference framework v3.2, dated 8 March 2022. Its own change log describes 3.2 as the version "intégrant principalement des critères de protection vis-à-vis du droit extra-européen". Each qualification carries an expiry date: Cloud Temple, for example, publishes 30 May 2028 for both its qualified IaaS and PaaS on its compliance page.

What 3.2 adds on top of ISO 27001 and HDS is legal and ownership control: section 19.6 requires an EU head office and caps non-EU shareholding at 24% individually and 39% collectively, on top of EU-based operations and protection against non-EU extraterritorial laws.

Where it is mandatory: the French state's cloud au centre doctrine (circular of 5 July 2021, updated 31 May 2023) says that for particularly sensitive data, a commercial cloud "devra impérativement respecter la qualification SecNumCloud (ou une qualification européenne garantissant un niveau au moins équivalent)". Article 31 of the SREN law of 21 May 2024 extends the protection requirement to state administrations and their operators, applied by decree n° 2026-272 of 14 April 2026. In my experience, OIV/OSE operators and health buyers copy it into private tenders.

On the European side, EUCS is still a draft candidate scheme on ENISA's certification library. NIS2 is not yet transposed in France: the bill passed the Senate on 12 March 2025 and sits at the Assemblée nationale committee stage, with a future scope of 18 sectors and about 15,000 entities per a Senate report.

To verify any vendor claim, open the ANSSI list and check that the service name on it matches the line item in your contract. If they differ, you are outside the perimeter.

How did we compare the SecNumCloud-qualified clouds?

I scored each provider on six criteria that decide whether a regulated workload can actually ship, and not only pass an audit: qualification scope, API and ecosystem compatibility, Kubernetes, pricing model, operating model and developer experience.

1. Qualification scope: which exact services are inside, at which version, with which expiry.
2. API compatibility: does your Terraform, CLI and CI keep working, or do you rewrite?
3. Kubernetes: is a managed control plane inside the scope, or do you run your own cluster?
4. Pricing model: public list or quote, and what hides in support, egress, backup and DRP.
5. Operating model: self-service API cloud or managed operations with a named team.
6. Developer experience: what engineers touch daily, and how much glue you build.

Criterion 6 is where every qualified IaaS provider is weakest, because none of them sells an internal developer platform. That layer is a separate decision, and I come back to it at the end.

Which SecNumCloud provider is best for which workload?

Outscale wins on API compatibility and migration cost, Cloud Temple on managed private cloud and legacy lift-and-shift, and OVHcloud on published price and breadth. None of the three gives developers self-service environments, which stays a separate layer on top.

Statuses in this table come from each vendor's own published announcements, checked on 27 October 2026. ANSSI's list is the only source of truth and scopes change at each renewal, so re-check it on the day you sign.

Is Outscale the right SecNumCloud cloud if you already run on AWS?

Outscale is the best pick when you want SecNumCloud-qualified IaaS with an AWS-compatible API, because most of your existing Terraform, SDK and CLI workflows carry over with changed endpoints rather than a rewrite.

3DS Outscale, a Dassault Systèmes brand, was the first operator qualified SecNumCloud 3.2, on its Public Cloud services, in December 2023. The qualified region is cloudgouv-eu-west-1, spread across three sites in Pantin, Magny-les-Hameaux and Aubergenville according to the Outscale regions documentation. The eu-west-2 region on the same sites is a separate, non-SecNumCloud region, so pin the region in your contract.

API compatibility. Outscale documents AWS-compliant APIs for compute (FCU), load balancing (LBU), identity (EIM), DirectLink and object storage (OOS). The official Terraform provider is at v1.8.1 stable. EC2, VPC and S3 patterns map well. What does not map is the managed catalogue: no Lambda equivalent, no Aurora, no Bedrock-style AI platform.

Kubernetes. OUTSCALE Kubernetes Service (OKS) runs on the qualified infrastructure, but Outscale's June 2026 announcement says OKS is "engagé vers la qualification SecNumCloud 3.2". Treat it as not yet in scope, and expect to own node pools and upgrades either way.

Pricing. The public price list bills per second. In cloudgouv-eu-west-1, a custom VM costs €0.041 per vCore per hour (v7 CPU, MEDIUM) and €0.006 per GiB of RAM per hour, excluding VAT. A 2 vCore / 8 GiB VM comes to about €0.130/hour, roughly €95/month at 730 hours, storage excluded. The same VM in the non-qualified eu-west-2 is about 17% cheaper.

Who should not pick it: teams that depend on a deep managed-service catalogue, many regions, or a hyperscaler-grade SLA menu.

When is Cloud Temple a better choice than Outscale or OVHcloud?

Cloud Temple is the best pick for regulated workloads still running on VMware-style private infrastructure, or legacy apps you cannot refactor, because it sells qualified hosting plus operations rather than only a self-service API cloud.

It has the broadest qualified scope of the three. Secure Temple covers VMware IaaS, open-source IaaS, S3 object storage, HSM-KMS encryption, Bare Metal, VM Instances and VPC, and its PaaS OpenShift was the first PaaS qualified SecNumCloud in France in May 2024. The FR1 region runs three availability zones in the Paris area, more than 30 km apart, with under 4 ms latency between them, per its regional documentation.

Lift-and-shift fit. You move VMs, not architecture. The VMware heritage means your vSphere runbooks, backup tooling and DRP habits transfer, and Cloud Temple can take operations, patching and DRP into the contract with a named team.

Kubernetes. OpenShift is inside the qualified scope. Cloud Temple's Managed Kubernetes (Talos, Cilium, ArgoCD, three AZs, 99.90% SLA) is "available on SecNumCloud-qualified" services, but it does not appear in the qualified-scope list itself, so ask for it in writing.

Pricing. Cloud Temple publishes indicative public rates, which surprised me. A standard VM Instance is €13.98 per vCPU and €3.58 per GiB of RAM per month, so 2 vCPU / 8 GiB is about €56.60/month, before a €184.80 monthly tenant fee and €151.20 per availability zone. In the RFP, still demand: storage and backup retention prices, egress, DRP, support tiers, and exit and reversibility clauses.

Who should not pick it: cloud-native teams that want instant API provisioning at scale and a large programmable surface more than a managed operations contract.

Does OVHcloud's SecNumCloud qualification cover the services you actually want?

OVHcloud is the cheapest per instance and the broadest of the three, but only its dedicated SecNumCloud offers carry the qualification. Standard Public Cloud and its Managed Kubernetes Service sit outside, so a stack built on them is not inside a qualified perimeter.

OVHcloud's SecNumCloud page lists four qualified offers: SNC Cloud Platform, Managed VMware vSphere (qualified December 2020), SAP HANA on Private Cloud, and Bare Metal Pod (SecNumCloud 3.2, March 2025). The big change this year is SNC Cloud Platform, qualified on 1 September 2026, which brings public-cloud-style compute, block storage and S3-compatible object storage into dedicated SNC zones.

Managed Kubernetes, databases and metal instances are listed as "coming soon" on SNC Cloud Platform. If your design says "OVHcloud MKS" and your contract says "SecNumCloud", one of them is wrong today.

The hybrid pattern. Many teams put regulated data in the SNC zone and the rest on standard Public Cloud. It works, but you run two networks, two IAM setups and usually two pipelines, and someone has to prove to the auditor which workload lives where.

Pricing. This is a real advantage: SNC Cloud Platform has a public pay-as-you-go price list. A b3-8 instance (2 vCore, 8 GB) costs €0.0913/hour, about €66.67/month excluding VAT, against €0.0512/hour for the standard Public Cloud b3-8 on the regular price page. That puts qualified compute about 78% above standard, and below Outscale's equivalent qualified VM. Business support is mandatory on SNC, so add it to the budget.

Who should not pick it: teams that need every component, including managed Kubernetes and managed databases, inside one qualified perimeter today.

Which other French providers belong on a SecNumCloud shortlist?

Beyond the big three, Oodrive, S3NS, Orange Business and NumSpot hold SecNumCloud qualifications, and Bleu and Scaleway are in the process. Each answers a narrower question than general-purpose regulated compute.

• Oodrive is the answer when the workload is files, board documents and e-signature. Oodrive Work and Oodrive Board were qualified under 3.2 in 2025, and Oodrive was the first French SaaS qualified, in 2019.
• S3NS, Thales's joint venture using Google Cloud technology, announced SecNumCloud 3.2 qualification for PREMI3NS on 17 December 2025. Its offer page lists Compute Engine, Cloud Storage and GKE Autopilot, and marks Cloud Run and Gemini as "qualification en cours". Check the ANSSI list for exact scope.
• Bleu, Capgemini and Orange's company running Microsoft technology, states on its services page "SecNumCloud 3.2 ANSSI Qualification en cours", with milestone J1 validated in November 2025. It is not qualified as of this writing.
• Orange Business Cloud Avenue qualifies only its SecNum variants: Cloud Avenue SecNum since July 2025 and SecNum Dynamic since October 2026. Ask for the "SecNum" product name on the order form.
• NumSpot reports IaaS qualification in September 2026, with its managed Kubernetes still in progress.
• Scaleway is the honest non-SecNumCloud comparison: French, strong developer experience, mature managed Kubernetes (Kapsule). Its SecNumCloud page says qualification is "not yet granted", and Kapsule is not in the initial scope.

For pure regulated compute in 2026, Outscale, Cloud Temple and OVHcloud still cover most RFPs I see. We published a deeper comparison of Bleu, S3NS and Scaleway if a hyperscaler-compatible stack is the requirement.

What does a SecNumCloud cloud still leave your engineering team to build?

Every SecNumCloud-qualified provider sells infrastructure and compliance. None of them gives developers environments, deployments, preview environments or per-environment access control, so that layer stays your team's problem, and it is usually the bigger cost.

After signature you still own cluster upgrades, networking and secrets, CI/CD wiring, per-environment RBAC, staging and preview environments, and cleanup of forgotten environments. A smaller catalogue makes it harder, because every missing managed service turns into YAML and on-call.

The people cost dwarfs the VM cost. Talent.com puts the average DevOps engineer salary in France at €54,000 a year, before employer charges. That one hire is more than 45 years of the 2 vCPU / 8 GB qualified VMs priced above. And the Stripe Developer Coefficient found French developers spend 20.9 hours a week on maintenance, the highest of the countries surveyed.

Where Qovery fits. Qovery runs on your own cloud account (AWS, GCP, Azure, Scaleway) or on your existing Kubernetes cluster, including a cluster you run on Outscale, Cloud Temple or OVHcloud. The qualified infrastructure, the data and the cloud bill stay in your name. On top, your developers get git-push deployments, preview environments per pull request, environment auto-stop for non-production, managed cluster upgrades, per-environment RBAC, and databases backed by managed cloud services where your provider offers them.

Qovery is not SecNumCloud-qualified and does not replace a qualified provider. If the requirement is "the compute itself must sit inside a SecNumCloud perimeter", the answer is one of the qualified IaaS providers above, and Qovery only helps on top of it. Check with your auditor how a deployment control plane outside the perimeter fits your own qualification argument.

And sometimes Qovery is the wrong tool. Five engineers with one legacy VMware app that needs hosting and operations should sign with Cloud Temple and stop there. No platform layer needed.

How do I deploy to my own cluster with Qovery from Claude Code or Cursor?

If your cluster already runs on a sovereign or qualified provider, you can wire Qovery into your coding agent with two commands, then ask it in plain language to deploy, with every action proposed for your approval.

Install the Agent Skills once for every compatible agent (Claude Code, Cursor, Codex, OpenCode, Gemini CLI). This installs qovery-onboard, qovery-deploy, qovery-troubleshoot, qovery-optimize, qovery-speedup, qovery-preview and qovery-terraform globally:

curl -fsSL https://skill.qovery.com/install.sh | bash

Prefer a project-scoped install:

curl -fsSL https://skill.qovery.com/install.sh | bash -s -- --project

Add the MCP Server to Claude Code. It uses OAuth and is read-only by default:

claude mcp add --transport http qovery https://mcp.qovery.com/mcp --callback-port 4242

Enable write access only when you explicitly want it. This also requires enabling write access in the Qovery Console:

claude mcp add --transport http qovery "https://mcp.qovery.com/mcp?read_write=true" --callback-port 4242

Then ask the agent: "deploy this service to my own Kubernetes cluster with Qovery". It proposes the actions and you approve them. The skills handle deployment, and the MCP Server operates what already exists. The full walkthrough is in the AI agent quickstart and the Claude Code integration page.