7 best sovereign cloud options for selling software to the French public sector in 2026

Key Points:

• AWS European Sovereign Cloud is not SecNumCloud-qualified. It is an AWS-operated, legally separate EU cloud with its first region in Brandenburg, Germany, run by EU-resident personnel. If a French tender names the ANSSI SecNumCloud visa, AWS European Sovereign Cloud does not clear it.
• SecNumCloud is granted by ANSSI per offering, per scope, with a date - not to a company. It covers more than 350 technical and organisational requirements plus a legal immunity criterion against extraterritorial law such as the US CLOUD Act. Always name the qualified offering and check the ANSSI register before claiming compliance.
• Providers with SecNumCloud-qualified offerings today include OVHcloud, 3DS Outscale, Cloud Temple, NumSpot, S3NS and Orange Business. Standard AWS, Azure and Google Cloud regions, including AWS Paris (eu-west-3), are not on the register.
• The decision rule is one line. If the cahier des charges names SecNumCloud, qualification ANSSI or the cloud de confiance doctrine, you need a qualified offering. If it only requires EU data residency, GDPR and EU operational control, AWS European Sovereign Cloud and other EU regions can qualify and the choice becomes commercial.
• For software vendors, the real cost is not sovereignty - it is the second deployment target. Vendors built on proprietary managed services (Aurora, SQS, Bedrock) pay the biggest rework bill. Vendors standardised on Kubernetes usually re-target a sovereign provider without rewriting the application.
• Qovery is not a sovereign cloud and holds no SecNumCloud qualification. Its role is portability: it deploys into your own AWS, GCP, Azure or Scaleway account, or your existing Kubernetes cluster, including a cluster inside a SecNumCloud-qualified provider, so one team can serve a hyperscaler and a sovereign region without a second platform team.

In July 2025, Orange Business got its Cloud Avenue SecNum offering qualified SecNumCloud by ANSSI. A few months later it added a second qualification, Cloud Avenue SecNum Dynamic, a dual-site offering with GPU capacity for AI workloads. Every time one of these lands, a sales team somewhere asks me the same question: is this the same thing as the AWS European Sovereign Cloud we already shortlisted?

Here is the one-line answer, up front: AWS European Sovereign Cloud is not SecNumCloud-qualified, so the two are not substitutes - they answer different questions. One is an ANSSI visa that a French public tender can require by name. The other is AWS building a legally separate European cloud. A buyer who wrote SecNumCloud into the cahier des charges cannot accept the second in place of the first, no matter how good the engineering is.

I have spent 15+ years in cloud and interviewed more than 200 CTOs and platform leads. The pattern that burns software vendors is always the same: they discover the SecNumCloud requirement at the administrative stage of a tender, not the technical one. The product never gets a demo. It gets filtered out of the pile before anyone logs in. So this is a buyer's guide for SaaS vendors and ISVs who keep stalling on the sovereignty question, written for 2026. I will be precise about who is qualified and for what, fair to AWS, and clear about where Qovery fits and where it does not.

If you want the deeper regulatory background, we also wrote a companion piece on what SecNumCloud, HDS, and "Cloud au Centre" actually require.

What is SecNumCloud, and what did Orange Business actually win?

SecNumCloud is a security visa issued by ANSSI, the French national cybersecurity agency, that qualifies a specific cloud offering against more than 350 technical and organisational requirements plus a legal immunity criterion: the provider must be out of reach of extraterritorial law such as the US CLOUD Act. Orange Business's qualification covers named offerings on the ANSSI register, not the whole company.

The current version is SecNumCloud 3.2. On top of ISO 27001, SOC 2 and HDS, it adds a sovereignty layer that the others do not have. Per the ANSSI referential (PDF), the provider's registered office and technical infrastructure must sit in the EU, operations and support staff must be EU-based, and non-EU entities are capped at 24% of capital and voting rights individually and 39% collectively, with no veto rights or control of the governing bodies. That capital cap is the clause that keeps US-owned hyperscalers off the list.

Why it is mandatory for parts of the French state:

• The "cloud au centre" doctrine, set by circulaire n°6282/SG of 5 July 2021, makes cloud the default for new state projects and requires SecNumCloud for sensitive data.
• A circular of 31 May 2023 tightened the definition of "particularly sensitive" data, and the SREN law of 21 May 2024 (Article 31) gave the requirement a statutory basis for state administrations and their operators.
• The obligation extends in practice to OIV and OSE (operators of vital importance and essential services), which are also in scope for NIS2.

One correction I make constantly: "Provider X is SecNumCloud" is almost always wrong. SecNumCloud is granted per offering and per scope, with a qualification date. Write "Cloud Avenue SecNum, qualified for IaaS" or "OVHcloud Hosted Private Cloud SecNumCloud", not "Orange is SecNumCloud". And remember that HDS (health data hosting) is a separate French certification; for sensitive health workloads the direction of travel is toward requiring SecNumCloud underneath HDS.

The one link that settles any dispute is the ANSSI register of qualified products and services. It is the only authoritative source for who holds a qualification today, for which scope, and since when. Check it before you write a compliance claim into a bid.

What is the AWS European Sovereign Cloud, and is it SecNumCloud-qualified?

The AWS European Sovereign Cloud is a physically and logically separate AWS cloud for Europe, operated by EU-resident AWS personnel under an EU-incorporated legal structure, with its first region in Brandenburg, Germany. It is not SecNumCloud-qualified, so on its own it does not answer a French tender that names the ANSSI visa.

What AWS has publicly committed, and delivered:

• A €7.8 billion investment in the European Sovereign Cloud.
• A first region in Brandenburg, Germany, which AWS launched in January 2026.
• A new EU-controlled parent company led by EU citizens and subject to EU law, with an EU-resident managing director, operated exclusively by EU residents, and an independent technical capability to keep running without non-EU infrastructure.

Where it genuinely helps: EU data residency, EU operational control, EU-based support and billing, and continuity commitments for EU-wide public and regulated buyers. For a lot of regulated work outside the French state scope, this is a serious, well-engineered answer.

Where it does not help a French public tender:

• No entry on the ANSSI register. Not being listed is the whole story for a tender that names SecNumCloud.
• The US parent ownership question runs straight into the 3.2 immunity and capital criteria.
• AWS Paris (eu-west-3) is not qualified either. A French region is data residency, not SecNumCloud.

Two French joint ventures took the opposite route and built specifically to pursue the ANSSI visa:

• S3NS (majority-owned by Thales, Google Cloud technology) announced SecNumCloud 3.2 qualification for its PREMI3NS offering on 17 December 2025, covering IaaS, CaaS and PaaS scopes across more than twenty services. Verify the current scope on the register.
• Bleu (Capgemini and Orange, Microsoft technology) is not yet qualified. Per Capgemini and Orange, Bleu is in commercial operation and in the ANSSI qualification process, with reporting putting the target around the end of 2026. Treat Bleu as "in progress", not qualified, until the register says otherwise.

To be fair to AWS: the European Sovereign Cloud is one of the most expensive sovereignty commitments any hyperscaler has made, and for many EU buyers it is the pragmatic choice. It just does not clear a French tender that names the ANSSI visa.

SecNumCloud vs AWS European Sovereign Cloud: which one does a French public tender actually accept?

If the tender text references SecNumCloud, qualification ANSSI or the cloud de confiance doctrine, only an ANSSI-qualified offering is compliant and AWS European Sovereign Cloud is excluded. If the tender only requires EU data residency, GDPR and EU operational control, both can qualify and the decision becomes commercial.

The three-line decision rule:

1. Read the cahier des charges. Search it for "SecNumCloud", "qualification ANSSI" and "cloud de confiance".
2. If any of those is named, you need a qualified offering. AWS European Sovereign Cloud and standard EU regions are out, full stop.
3. Check how the data is classified (sensitive state data, OIV/OSE, health). Classification, not your preference, decides the bar.

A few things vendors get wrong:

• The public buyer carries the obligation, but you inherit it contractually as the software vendor, subcontractor or hosting provider. "Our cloud is compliant" is your problem to prove.
• Failure shows up as administrative disqualification, before the product demo. You lose on a checkbox.
• The regulatory floor is still moving. NIS2 is not yet transposed in France - the Résilience bill was expected in the National Assembly around October 2026, and the European Commission referred France to the CJEU in July 2026 for late transposition. Separately, the EU Cloud Services Scheme (EUCS) dropped its sovereignty/immunity requirements from the March 2024 draft and remains unresolved, so for now the French SecNumCloud requirement stands on its own national basis, not an EU-wide one.

Practical advice: answer French state deals with a qualified target and keep a hyperscaler target for everything else. Do not migrate the whole company to satisfy one class of tender.

Here is the side-by-side that matters for a bid:

Source for qualification status: the ANSSI register. Confirm every row against it before you quote it in a bid.

How did we pick the 7 options on this shortlist?

We ranked the options on six criteria that decide whether a software vendor can win and then actually deliver a French public-sector deal, not on raw cloud performance.

• Criterion 1 - qualification status: is the specific offering on the ANSSI register, in progress, or out of scope, and on which referential version.
• Criterion 2 - legal immunity: ownership structure, share of non-EU capital, exposure to the US CLOUD Act or other extraterritorial law.
• Criterion 3 - managed Kubernetes: is there a conformant managed Kubernetes service inside the qualified scope, or do you run your own control plane.
• Criterion 4 - catalogue breadth: managed Postgres, object storage, observability, GPU, or bring your own.
• Criterion 5 - portability: open APIs, CNCF-conformant Kubernetes, a maintained Terraform provider, and whether you can leave without a rewrite.
• Criterion 6 - delivery cost: how many engineers it takes to operate this target in addition to your primary cloud.

To be clear: this ranks fit for software vendors selling to French public buyers, not cloud quality in the abstract. A provider can be excellent and still be the wrong bid for your product.

Which sovereign cloud options should a software vendor shortlist in 2026?

Seven options cover the realistic field: OVHcloud, 3DS Outscale, Cloud Temple, NumSpot, S3NS, Orange Business and AWS European Sovereign Cloud. Qovery sits on top of whichever you choose as the portability layer, not as a cloud of its own.

OVHcloud, Outscale and Cloud Temple: which French-owned provider fits which workload?

These three hold the longest-standing SecNumCloud-qualified offerings and are the safest default when a tender names the ANSSI visa: OVHcloud for breadth and public pricing, 3DS Outscale for AWS-API compatibility, Cloud Temple for highly regulated and hosted-private workloads.

• OVHcloud. The qualified offering to name is Hosted Private Cloud SecNumCloud (and more recently Bare Metal Pod 3.2). OVHcloud is French-owned, publishes a public price list, and has a large European footprint. The honest caveat: the qualified scope is far narrower than the full OVHcloud catalogue, so confirm each service you need is inside the qualified perimeter.
• 3DS Outscale (Dassault Systèmes). Outscale was the first cloud operator qualified SecNumCloud 3.2 on its Public Cloud, and its AWS-compatible API is a genuine shortcut for vendors already on AWS primitives. The trade-off is a thinner managed-service catalogue; you bring more of the stack yourself.
• Cloud Temple. A SecNumCloud-qualified, hosted-private provider with a strong fit for OIV/OSE and defence-adjacent buyers. Pricing is quote-based and the model is closer to managed private cloud than self-service public cloud.

Who should not pick these three: vendors whose product depends on Aurora, SQS, Bedrock or managed GPU inference as managed services. None of them replicates that catalogue one-for-one.

A concrete rework pattern I see: a vendor running on managed Postgres plus object storage plus a container runtime usually re-targets one of these with configuration changes and a new Terraform target - days to a couple of weeks. A vendor leaning on five proprietary AWS services (say Aurora Serverless, SQS, DynamoDB, Cognito, Bedrock) is looking at a re-architecture per service, which is where sovereign deals actually die on cost.

NumSpot, S3NS and Orange Business: are the newer trusted-cloud offerings ready for production?

These three were built explicitly for the cloud de confiance market and are production-ready for standard web, API and data workloads, but remain thinner on managed services than a hyperscaler. Pick them when the deal requires qualification plus a familiar operating model.

• NumSpot is backed by Banque des Territoires, Docaposte, Dassault Systèmes and Bouygues Telecom, built on Outscale's IaaS layer, and aimed at public-sector and health buyers. Its IaaS is SecNumCloud-qualified (September 2026) with PaaS in progress, so verify whether the managed services you need are inside scope yet.
• S3NS (Thales majority-owned, Google Cloud technology) is the closest thing to hyperscaler ergonomics inside a French legal structure. Its PREMI3NS offering is SecNumCloud 3.2 qualified across IaaS, CaaS and PaaS as of December 2025, the broadest qualified scope on the market. Confirm the exact service list on the register rather than from a marketing page.
• Orange Business holds Cloud Avenue SecNum (qualified July 2025) and added Cloud Avenue SecNum Dynamic with dual-site high availability and GPU capacity for AI. The differentiator is operator-grade network, connectivity and support.

What is genuinely missing versus a hyperscaler, across all three: the depth of managed AI/ML and GPU services, the breadth of managed databases, the maturity of Terraform providers and SDKs, and the surrounding ecosystem tooling.

Honest take: if your product needs managed GPU inference today, none of these is the easy answer. Orange Business and S3NS give you GPU compute, but you will largely self-host the inference stack on top of it rather than consume a managed equivalent of Bedrock or Vertex AI.

If you want a Kubernetes-first view of the wider European field, we compared the best sovereign cloud providers for Kubernetes separately.

Where does Qovery fit, and how do you serve a hyperscaler and a sovereign cloud with one team?

Qovery is not a sovereign cloud and holds no SecNumCloud qualification. It is the layer that lets one engineering team deliver the same application into several clouds, because Qovery deploys into your own cloud account or your existing Kubernetes cluster instead of hosting your workloads itself.

How it works: Qovery runs on AWS, GCP, Azure, Scaleway, or an existing Kubernetes cluster - including a Kubernetes cluster running inside a SecNumCloud-qualified provider. The sovereign deployment target becomes a configuration in Qovery rather than a second platform team with its own tooling.

Why this bring-your-own-cloud model matters for sovereignty: the cloud contract, the data, the cloud bill and any committed discounts stay in your name or your customer's name. That is exactly what a public buyer's security questionnaire asks about. Qovery never sits between you and the cloud provider as the data controller.

Concrete capabilities that cut the cost of running a second target:

• Git-push deployments and preview environments per pull request.
• Environment auto-stop for non-production, so the sovereign target does not bleed money when idle.
• Managed cluster upgrades and per-environment RBAC.
• Databases backed by the underlying cloud's managed services.

Where Qovery is not the answer, said plainly:

• If you need the sovereign provider's own managed Postgres inside the qualified scope, that dependency belongs to the provider, not to Qovery.
• If you deploy once a quarter into a single region, you do not need an internal developer platform at all.

The honest hook is narrow: Kubernetes you do not operate day to day, and a second cloud target without a second DevOps hire. And the compliance boundary, once, clearly: Qovery is a control plane and tooling choice. Your qualification comes from the underlying SecNumCloud-qualified offering, never from Qovery.

How do I set this up with Qovery from Claude Code or Cursor?

Install the Qovery Agent Skills once and your coding agent can scaffold, deploy and troubleshoot the application on your own cloud account or your existing Kubernetes cluster, asking you to approve each action before it runs.

• Install the skills globally for every compatible agent (Claude Code, Cursor, Codex, OpenCode, Gemini CLI):

  BASH

  Copy

  curl -fsSL https://skill.qovery.com/install.sh | bash
  

• Same install, scoped to the current project only:

  BASH

  Copy

  curl -fsSL https://skill.qovery.com/install.sh | bash -s -- --project
  

• Add the Qovery MCP Server to Claude Code with OAuth, read-only by default:

  BASH

  Copy

  claude mcp add --transport http qovery https://mcp.qovery.com/mcp --callback-port 4242
  

• Same, with write access, which also requires enabling write access in the Qovery Console:

  BASH

  Copy

  claude mcp add --transport http qovery "https://mcp.qovery.com/mcp?read_write=true" --callback-port 4242
  

After installing, ask the agent in plain language, for example "deploy this app to my existing Kubernetes cluster with Qovery". The skills cover onboarding, deploy, preview environments, troubleshooting, optimisation and Terraform; the MCP Server operates what already exists. See the AI agent quickstart and the Claude Code integration.