SecNumCloud: what France’s ANSSI qualification guarantees

SecNumCloud is the qualification that ANSSI, France’s national cybersecurity agency, grants to cloud offers that meet its set of requirements. It guarantees a high level of security and protection against non-European laws: head office in the European Union, mainly European ownership, data stored and processed in the EU. It is a French scheme that covers one specific offer, for a limited period, and the only list that counts is ANSSI’s.

Everything below was checked on 23 October 2026 on cyber.gouv.fr, ANSSI’s website (catalogue of qualifications updated on 16 October 2026, list of qualifications in progress, the standard itself), and on Légifrance, the official French legal database. These sources are in French; quotes are translated.

What is SecNumCloud?

It is a set of requirements (a standard), published by ANSSI, that a cloud provider must meet to have its offer qualified. The current version is 3.2, dated 8 March 2022 (standard on cyber.gouv.fr, in French). Its main addition was criteria for protection against non-European law, such as the US CLOUD Act.

How to read an announcement:

• The qualification covers a service, not a company: a host can have one qualified offer and ten that aren’t.
• It covers four types of service: infrastructure (IaaS: servers, storage), platform (PaaS), containers (CaaS) and online software (SaaS).
• It is assessed by an approved body, then granted by ANSSI. The catalogue lists four for SecNumCloud: AFNOR Certification, BYCYB, Certi-Trust France and LSTI.
• It has an end date. In the catalogue, most qualifications run for three years.

What the standard requires

Most of the standard covers classic security: encryption, physical security, access and incident management, business continuity. What sets it apart is its chapter 19.

Where the data is (19.2). The provider must store and process its clients’ data in the European Union, and run the service from the EU. Technical data (logs, directory, certificates) too. Only support may work from a non-EU country, on documented operations controlled from the EU.

Who controls the provider (19.6). This is the “protection against non-European law” part:

• its registered office, central administration and main establishment are in an EU member state;
• companies based outside the EU cannot hold, directly or indirectly, more than 24% of its capital or voting rights each, or more than 39% together, nor have a right of veto or appoint the majority of its managers;
• a non-European subcontractor must not have the technical ability to access the data;
• the provider must be able to keep the service running even if a supplier drops it (“operational autonomy”);
• it must notify its clients within one month of any change affecting these requirements.

Which providers are SecNumCloud qualified?

In ANSSI’s catalogue updated on 16 October 2026, thirteen providers have at least one qualified offer, for thirty services in total.

Source: ANSSI’s catalogue of qualified products and services (in French), section 3.3, consulted on 23 October 2026.

Two dates to watch: the qualification of Outscale (a Dassault Systèmes subsidiary, which hosts Albert, the French state’s AI, among others) expires on 30 November 2026, and that of OVH’s VMware offer on 29 December 2026. No renewal yet appeared in the catalogue of 16 October 2026: check the current version before relying on it.

S3NS deserves its own line: it is “a one-of-a-kind alliance between Thales and Google Cloud”, according to its website, and its offer is built on Google Cloud technology. It has been qualified since 17 December 2025, and these hybrid offers have been debated, to the point that ANSSI publicly defended the strength of its qualification (Banque des Territoires, 13 January 2026, in French): the qualification says the operator meets the standard, chapter 19.6 included, not that the technology is European.

Which providers are in the process of qualification?

The list of qualifications in progress (in French) had fourteen providers on 23 October 2026: Adista, Aqua Ray, Bleu (Cloud de Confiance Bleu), Blue, Cegedim.cloud (a change to its offer), Free Pro, GIP Mipih, Interstis, ITS Integra, Keyes (Belgium), Numspot (its PaaS part), Prolival, Scaleway (Scaleway SecNumCloud, IaaS and PaaS: qualification in progress) and Scalingo.

ANSSI notes that only the projects providers have agreed to make public are listed. Above all, “in progress” doesn’t mean qualified: a service hosted at a provider in progress cannot call itself SecNumCloud today, and no end date for the assessment is published.

Who has to use SecNumCloud?

Since the French ministerial order of 12 August 2026, published in the Journal officiel (France’s official gazette) on 14 August and in force the next day, standard 3.2 is mandatory for commercial clouds serving French central government departments, the public bodies they oversee and public interest groupings, for data “of particular sensitivity”: data whose breach would harm public order, public safety, people’s health or lives, or intellectual property (order on Légifrance, in French). It implements article 31 of the French law of 21 May 2024 to secure and regulate the digital space, known as the SREN law.

The same order accepts, instead of an ANSSI qualification, a certification from the EU or from another European Economic Area state that ANSSI recognises as equivalent.

A private company is not covered by this text. It may still come across SecNumCloud in a contract: a French public contract, or a client in health, defence or energy, may require it from its suppliers. What applies to your company is a question for your data protection officer or lawyer.

How to check that an offer is really qualified

1. Write down the exact name of the service you are offered, not just the host’s name.
2. Look it up in ANSSI’s catalogue, in the section “Services d’informatique en nuage (SecNumCloud)” (cloud computing services), and check the date the document was updated.
3. Read the qualification end date. If it falls during your contract, ask in writing what is planned.
4. Look at the type of service. Software (SaaS) hosted on qualified infrastructure is not qualified itself: only the infrastructure is. No AI service appears in the catalogue of 16 October 2026: those that call themselves SecNumCloud run on qualified infrastructure.
5. Be wary of “in progress” and “SecNumCloud compliant”: only a listing in the catalogue counts.

What SecNumCloud doesn’t guarantee

• That your own processing complies with the GDPR. The standard governs the host; what you do with the data remains your responsibility (see AI and GDPR).
• Health data hosting certification (HDS). That is a separate French certification, with its own rules.
• The software running on top. An AI running on qualified infrastructure is not a qualified AI.
• The future. A qualification expires, and a provider’s ownership can change.

To place SecNumCloud among the other questions (who makes the AI, where it runs, under which law), read the overview of French AI; the CLOUD Act is explained in ChatGPT for business, and the rest is in the sovereign topic.