What Is SecNumCloud, and Why US Clouds Don't Have It

SecNumCloud is the cybersecurity qualification that ANSSI, France's national cybersecurity agency, awards directly to cloud service providers after an independent audit of both technical controls and legal exposure. It is the toughest sovereign cloud scheme operating in Europe, sitting behind French public sector procurement rules and a growing list of private sector contracts in health, finance and defence adjacent sectors. The confusion that brings most buyers to this question starts with marketing: American hyperscalers advertise "sovereign cloud" services in France without holding the qualification in their own name. This piece uses the SecNumCloud framework page in the CertReports index to separate the providers that hold it directly from the providers that route around it through a French subsidiary.

What is SecNumCloud, exactly?

ANSSI built SecNumCloud around two separate questions. The first is familiar from any cloud security review: does the provider run adequate technical and organisational controls across infrastructure, access management, incident response and supply chain. The second question is specific to France and the wider EU sovereignty debate: can a non-European government compel access to the data regardless of where the servers physically sit. SecNumCloud answers the second question by requiring that the qualified entity, its capital structure and its operational staff sit outside the reach of laws such as the US CLOUD Act. That second requirement is why the qualification cannot simply be inherited by a hyperscaler's European region or its EU-registered legal entity. The entity ANSSI audits has to be structurally insulated from extraterritorial orders, not just geographically located in France. Germany runs a comparable idea through BSI's C5 scheme, though C5 is lighter on the ownership question and heavier on technical attestation, which is one reason the two schemes are not interchangeable for a buyer comparing options across borders.

SecNumCloud 3.2: the current version

ANSSI has revised the SecNumCloud reference document several times since the scheme launched. Version 3.2 is the current baseline that accredited assessors audit against, and it tightened the governance and ownership criteria compared with version 3.1, partly in response to debate over how far a joint venture structure has to go before ANSSI treats it as genuinely insulated from a foreign parent's legal obligations. The version number matters to a buyer for the same reason an ISO 27001 certificate's edition matters: a qualification issued against an older reference document does not automatically carry over to a newer one, and the published scope documents, not a vendor's marketing page, are the place to check which version a given qualification was actually audited against.

Qualification, not certification

ANSSI itself calls this a qualification, sometimes a visa de sécurité, awarded after an audit carried out by an assessor accredited under the PASSI scheme and a formal decision issued by ANSSI. That is a meaningful distinction from a self-asserted label. Vendors and resellers often shorten it in sales conversations to "SecNumCloud certified", which blurs who actually ran the audit and who issued the result. This mirrors a wording problem CertReports has documented elsewhere, including why there is no such thing as "SOC 2 certified": a report, a qualification or an attestation is not the same thing as a certificate, and the gap between the two is exactly where buyers get misled during procurement.

Which providers hold it directly

The honest list of direct SecNumCloud holders is short, and it is mostly French-headquartered providers that built their compliance programme around French public sector procurement from the start. The table below reflects the general shape of the market rather than a single frozen snapshot, so always check ANSSI's own published list and the vendor's own trust centre before relying on either for a contract decision.

3.2

Current SecNumCloud reference version

Published by ANSSI, supersedes version 3.1

0

Of the big three US hyperscalers hold SecNumCloud directly

in the CertReports index on 2026-10-20

2

Joint ventures built specifically to pursue the qualification

Bleu for Microsoft Azure, S3NS for Google Cloud

The sovereign subsidiary model: Bleu and S3NS

Microsoft and Google chose a similar fix for the same structural problem. Rather than attempt to restructure the parent company, each set up a separate French joint venture: Bleu, owned by Orange and Capgemini and licensing Microsoft's cloud technology, and S3NS, owned by Thales and licensing Google Cloud's technology. Both were built specifically to pursue SecNumCloud qualification as independent French entities, which is the only way ANSSI's ownership criteria can plausibly be satisfied. Neither arrangement gives Microsoft Azure or Google Cloud, as global brands, the qualification itself. The qualification, once and if it is granted, belongs to Bleu or to S3NS, and it covers only the specific service each one operates, not the wider hyperscaler product catalogue a buyer might already be using under a global master agreement. That distinction matters at renewal time, because a workload that needs SecNumCloud cannot simply stay on the standard Azure or Google Cloud estate and claim coverage by association.

SecNumCloud qualification provides assurance about the level of security of a cloud service and guarantees that the service is protected against access by non-European law.

What US hyperscalers show instead

AWS, Microsoft and Google all publish long lists of certifications and attestations on their own trust pages, and it is worth checking what actually sits in that list rather than assuming SecNumCloud is quietly folded in. Zoom's entry in the index is a useful stand-in for this pattern because its trust centre lists a wide spread of regional and government schemes side by side, including FedRAMP in the US and BSI's C5 in Germany. Look at how many sovereign and sector schemes a provider lists, then check specifically for the one that is missing from that list.

Zoom · Trust report

Collaboration · Public evidence as of 26 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 18 vendor-stated.

• C5Vendor-statedTrust centre · 26 Oct 2026
• DPFVerifiedValid to 19 Dec 2026
• SOC 2Vendor-statedType II report
• FedRAMPVendor-statedTrust centre · 26 Oct 2026
• PCI DSSVendor-statedTrust centre · 26 Oct 2026
• ISO 27001Vendor-statedTrust centre · 26 Oct 2026
• CSA STARVendor-statedTrust centre · 26 Oct 2026
• Cyber EssentialsVendor-statedTrust centre · 26 Oct 2026
• ISO 27701Vendor-statedTrust centre · 26 Oct 2026

10 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Zoom publishes or offers, as of 26 Oct 2026.

• Standard contractual clauses · On request
• AI and data use policy · On request

1Security practices

Public statements from Zoom, shown as statements, not attestations, as of 26 Oct 2026.

• Penetration testing · report available

Why this matters for NIS2 and regulated sectors

France's own rules already push certain operators, especially those classed as OIV or OSE under national law, toward SecNumCloud or an equivalent for the most sensitive workloads, and the direction of EU policy reinforces rather than relaxes that pressure. NIS2 extends supplier due diligence obligations to a much larger set of EU entities, and while NIS2 itself does not name SecNumCloud as a mandatory requirement, it does require organisations to assess the security practices of their cloud and ICT suppliers before relying on them for essential or important services. A buyer who assumes a hyperscaler's FedRAMP authorisation, ISO 27001 certificate or SOC 2 report satisfies a French sovereign cloud requirement is making a category error, because none of those schemes test the legal insulation question that sits at the centre of SecNumCloud. They test different things, for different regulators, and stacking them does not add up to the one thing a French procurement officer is actually asking for.

How buyers should verify a SecNumCloud claim

1. 1

   Separate the brand from the audited entity

   Ask whether the qualification belongs to the global cloud brand or to a specific national subsidiary such as Bleu or S3NS, and get the legal entity name confirmed in writing.

2. 2

   Check the reference version

   Confirm whether the qualification was audited against SecNumCloud 3.2 or an older version, since the ownership and governance criteria changed materially between revisions.

3. 3

   Read the scope, not the headline

   A SecNumCloud qualification usually covers a specific service or region, not a provider's entire global product catalogue, so check exactly what is in scope before assuming coverage extends to your workload.

4. 4

   Apply the same scepticism to adjacent schemes

   The subsidiary pattern shows up again whenever a US provider claims a government scheme; the same questions that separate GovRAMP from FedRAMP and StateRAMP apply here too.
5. 5

   Go to the primary source

   Treat a vendor's own trust page as a starting point rather than a verdict, in the same way this index recommends reading a trust centre properly before citing any framework in a questionnaire response.