A public tender requires "SecNumCloud hosting". You switch to a qualified cloud — but deploy on an offer not listed in the attestation, with backup outside scope. Audit fails: label was on the brand, not your architecture.
SecNumCloud = cloud service qualification under ANSSI framework (sovereignty, security, residence/opposability). Requiring the label without reading scope = classic mistake.
What SecNumCloud guarantees — and excludes
On qualified scope, SecNumCloud guarantees reinforced security requirements, strict governance, chain control, and protection against unauthorized access including extraterritorial — per current framework.
SecNumCloud does not guarantee: automatic GDPR compliance, health HDS certification, coverage of entire client ecosystem (third-party CDN, non-qualified SaaS).
| Question | To verify |
|---|---|
| Exact product | SecNumCloud IaaS 3.2 vs other |
| Region / zone | Qualified France / EU |
| Backup / DR | Included or out of scope |
| Subprocessors | Qualification list |
Who really needs it?
Often required or strongly recommended: administrations, vital infrastructure operators, some local authorities, state projects.
Often oversized: SMB brochure site, blog, standard e-commerce without sector constraint.
Intermediate case: regulated B2B publisher — risk analysis + enterprise client requires SecNumCloud.
Visible qualified actors: OVHcloud, 3DS Outscale, Cloud Temple — always verify exact product.
The peak: label without scope
Decide and move forward without blind spots
First validate whether SecNumCloud is a real obligation (client, sector, contract). Download ANSSI attestation and product annex. Map your architecture — compute, storage, backup, logs — to qualified scope. Cross-check GDPR, HDS, SecNumCloud if health. See our guides and directory.
Frequently asked questions
Does SecNumCloud replace GDPR?
No — cybersecurity and sovereignty vs data protection. Both may apply.
Must every client require SecNumCloud?
No — mainly public, vital operators, sensitive state workloads.
How to verify scope?
ANSSI attestation: number, products, framework version.
SecNumCloud and HDS?
Complementary — check both scopes if health and sovereignty.
Requiring SecNumCloud without reading attestation buys an acronym — not qualification of your actual workload.