Your IT lead picks Scaleway for a "sovereign cloud" project: API, managed databases, object storage. The sales deck cites SecNumCloud, Paris and Amsterdam datacenters, French company. Six months later, audit asks: are the S3-compatible bucket, marketplace add-on, and third-party logs in scope?
The answer is not on the homepage. It lives in the exact product, region, and attestation — not in "sovereign" applied to the whole catalogue. Confusing brand and certified perimeter is the costliest mistake in sensitive cloud files.
Scaleway sovereignty: what the label covers
Scaleway positions as European cloud with strong developer culture, sovereignty score 9.4/10 in our directory, and SecNumCloud on selected sensitive offers. Documented datacenters in Paris and Amsterdam.
Three levels to separate without merging:
- EU hosting — data in EU, GDPR;
- French cloud — French entity and DC (partial);
- SecNumCloud — ANSSI-certified perimeter against extraterritorial access.
A "sovereign" project in contractual terms needs level 3 on the right building block — not the Scaleway logo in general. Every service enabled in the console must be mapped to one of these levels.
| Service type | Question to ask |
|---|---|
| Instances / VPC | FR region locked? |
| K8S Kapsule | SecNumCloud perimeter? |
| Object storage | Cross-region replication? |
| Marketplace (DB, SaaS) | Subprocessor and location? |
| Support & logs | Where do tickets transit? |
Broad catalogue, uneven perimeter
Scaleway shines on VPS, instances, K8S, object storage, serverless — excellent price/performance (9/10 price). But a rich catalogue implies third-party services and add-ons that do not automatically inherit SecNumCloud.
Grey zones recur: marketplace image not maintained by Scaleway; backup replicated outside chosen region; external CDN or DNS integration; third-party monitoring (Datadog, etc.). Each can fall outside certified perimeter without a console warning.
"Sovereign cloud" on a slide does not certify every box checked in the console.
Paris vs Amsterdam: the detail that changes a file
Amsterdam improves Benelux latency and EU redundancy. For a French publisher bound by "data in France" clauses, that is a watch point: select fr-par, document it contractually, verify backup copies.
Our OVH Public Cloud vs Scaleway comparison helps situate both French clouds — always at product level, not brand.
SecNumCloud: read attestation, not marketing FAQ
As with HDS, request attestation number and validity, technical perimeter (compute, storage, network, backups), listed subprocessors, and explicit exclusions. Scaleway communicates on SecNumCloud — use that to demand the document, especially for B2G clients. Cross-check it with your architecture diagram: a qualified managed database does not compensate for an out-of-scope object bucket or logs exported to an undocumented third-party service.
The crux: sovereign is a perimeter, not a brand
Marketing often merges levels. Audit reads service by service.
Decide and move forward without blind spots
Map your architecture service by service before signing. Lock fr-par region if France is contractually mandatory. Request SecNumCloud attestation for the target perimeter and explicitly exclude or document marketplace add-ons and third parties.
See Scaleway profile, directory, and guide SecNumCloud vs European cloud to cross-check products, regions, and certifications.
Frequently asked questions
Are all Scaleway services sovereign?
No. SecNumCloud targets specific offers and regions. Marketplace and third parties may fall outside — verify service by service.
Does SecNumCloud cover my Kubernetes cluster?
Check docs and attestation: defined perimeter, not all Kapsule automatically. Request attestation for your exact architecture.
Scaleway vs OVHcloud on sovereignty?
Both EU; Scaleway SecNumCloud + dev culture, OVHcloud HDS + broad catalogue. Compare exact product, not slogan.
Do NL datacenters change the picture?
Amsterdam helps EU latency; for France requirement, lock fr-par contractually.
Before signing "sovereign Scaleway cloud", ask for a list: which services, which region, which attestation number?