A public tender reads "sovereign cloud required." Three vendors answer with the same word on the cover, yet none promise the same thing. One highlights France-only location, another an ANSSI SecNumCloud qualification, a third customer-managed keys on a US hyperscaler with a Paris region. The jury marks all bids "sovereign-compliant" without mapping subprocessors, backup copies, or the legal entity that actually operates the stack.
"Sovereign cloud" became a commercial catch-all before it became architecture. For a technical lead or public buyer, the question is not who flies the biggest flag but which sovereignty dimension the contract guarantees — legal, operational, technical, or economic — and on what exact scope.
Four sovereignty dimensions — rarely all present
Legal sovereignty covers applicable law, authority access, and extraterritorial statutes such as the Cloud Act. Operational sovereignty is about who administers, from which country, with what console and support access. The technical layer spans production and replica location, encryption, and key control. Economic sovereignty points to capital structure, governance, and the vendor's parent company.
| Marketing term | Precise question | Expected proof |
|---|---|---|
| Sovereign cloud | Which dimension? | Certificate + DPA |
| Trusted cloud | HDS or ISO scope? | Certificate annex |
| SecNumCloud | Which product is qualified? | ANSSI reference + date |
Two providers may both say "sovereign" while excelling on opposite dimensions: one on physical location, another on state qualification, neither on the full subprocessor chain.
Francophone players: same word, different scopes
OVHcloud offers scale with European regions and partial HDS or SecNumCloud coverage depending on product. 3DS Outscale positions explicitly on French sovereign cloud for regulated markets. Cloud Temple stresses trusted cloud and high operational sovereignty requirements.
Work starts after the slogan: map your application stack — databases, files, logs, backups, managed operations — onto the actually certified scope, as with health data and HDS. An enterprise badge does not automatically cover shared hosting or object storage running alongside.
Sovereignty without an architecture diagram and subprocessor list remains a tender buzzword.
What contracts say — and what they sidestep
Request the data processing agreement, location annex, and authorized subprocessor list. Check whether backup copies may leave the European Union, who can restore at 4 a.m., and whether US providers handle monitoring or support. Cross-read GDPR, HDS, SecNumCloud so frameworks are not conflated.
The peak: sovereignty is sold by the kilometer, verified by the millimeter
Decide and move forward without blind spots
Start by framing your real scenario on one page: volumes, client constraints, required support level, and a thirty-six-month budget including domain, backup, and essential add-ons. Compare at least two hosts via the directory and compare tool with identical assumptions, archive pricing grids dated on subscription day, then have both the contract signer and daily infrastructure operator validate the short list.
Frequently asked questions
Does sovereign cloud mean 100% French?
No. Operational and legal sovereignty break into capital, location, admin access, subprocessors, and ANSSI qualification. Marketing "100% France" is rarely end-to-end verifiable without detailed technical annexes.
Are SecNumCloud and sovereign cloud the same?
SecNumCloud is ANSSI qualification on a defined scope. "Sovereign cloud" is broader marketing — sometimes aligned, sometimes approximate. Compare the qualification number and the product line it covers.
Which French hosts target sovereignty?
OVHcloud, 3DS Outscale, Cloud Temple, and the Bleu alliance are visible names, each with different scopes and certifications. None are interchangeable without reading the certificate for your product.
Does sovereign cloud protect against the Cloud Act?
Partially, if the chain is EU-qualified and US access is excluded — never automatically. DPA, parent company, and subprocessor analysis remain mandatory.
Sovereign on the slide? Ask who types the root password — and from which jurisdiction.