SecNumCloud: ANSSI's framework for trusted cloud

SecNumCloud is the ANSSI framework used to qualify a “trusted” cloud service: high-level technical and organisational security, data processed in the European Union and protection from non-European extraterritorial laws. SecNumCloud qualification, valid for three years, is granted by ANSSI to a specific service, not to a provider. Since 2026, it has been the mandatory reference for sensitive French State data entrusted to a commercial cloud.

ANSSI, France's national cybersecurity agency, grants several “security seals” to products and services it has had evaluated. SecNumCloud is the one for cloud computing services. It covers infrastructure (IaaS), platform (PaaS) and software (SaaS) services, as well as container services.

Three ideas sum up what a SecNumCloud qualification covers:

• a service, not a company: ANSSI is clear in its FAQ that SecNumCloud recognises a specific cloud service, not a cloud provider. The same provider may offer qualified services and others that are not;
• technical and organisational security: governance, risk management, access control, encryption, operations, incident management, continuity, subcontracting;
• legal protection: the data must not be obtainable by a third-country authority outside European law.

That last point is what makes the framework unique. It addresses a specific concern: laws such as the US CLOUD Act can compel a provider subject to them to hand over data, including data stored in Europe. A data centre in Paris is therefore not enough; what matters is the provider's legal and ownership structure.

Qualification does not, however, guarantee the security of what the client deploys on the service. ANSSI points out that the client organisation remains responsible for the security of its own systems, access and data.

Sovereign cloud, trusted cloud, SecNumCloud: not the same thing

The three terms are often used interchangeably. They should not be. “Sovereign cloud” is a marketing claim with no legal definition: it usually means a European provider or data hosted in France, and says nothing about the level of security or control by shareholders. “Trusted cloud” is the term the French State has used since 2021 for services protected both from cyberattacks and from extraterritorial laws; in public doctrine, it refers specifically to SecNumCloud. Finally, a SecNumCloud-qualified service is the only one of the three whose promises have been checked by an approved evaluator and then validated by ANSSI.

In practice, when a service is described as sovereign, the right question is not “where are your servers?” but “which exact service is qualified, since when, and on which layer?”.

The current version of the SecNumCloud framework is 3.2, published by ANSSI in March 2022. It gained new weight in 2026: an order of 12 August 2026, published in the Official Journal on 14 August, approved it as the requirements framework for the French State's cloud providers, under the SREN law. As Silicon notes, the order does not change the framework's technical content; it changes its legal weight.

Protection from extraterritorial laws

This is the main addition in version 3.2. According to the ANSSI FAQ and analyses by Génération NT and Silicon, the provider must notably meet the following conditions:

• its head office, decision-making centre and service administration are located in the European Union;
• the share of its capital held by non-European entities is capped (24% for a single entity, 39% in total);
• no non-European entity holds a veto over its decisions;
• data is stored and processed in the European Union, and the service is operated from within the Union.

Other changes in version 3.2

• Penetration testing throughout the qualification cycle, rather than at a single point in time.
• Qualification by composition: a SaaS or PaaS vendor relying on infrastructure that is already qualified can inherit its guarantees and focus the evaluation on its own layer, reducing effort and cost.
• Closer alignment with the future European EUCS scheme, especially its highest level.

In total, the framework includes more than 360 requirements according to Silicon, covering technical security, access management, governance, audit, the supply chain and business continuity.

The State: from the “cloud first” doctrine to the SREN law

The requirement was built up in stages. Circular No. 6282/SG of 5 July 2021 set out the State's “cloud au centre” (cloud first) doctrine: cloud becomes the default hosting for new State digital projects. The circular of 31 May 2023 clarified it by defining particularly sensitive data (data covered by a legally protected secret, or needed for the State's essential missions), which must be hosted on a SecNumCloud-qualified service when entrusted to a commercial cloud, as Localtis explained at the time.

The SREN law of 21 May 2024 gave this requirement a legal basis. Its Article 31 requires State administrations, their operators and certain public interest groupings that entrust particularly sensitive data to a commercial cloud to use services protected from any unauthorised access by third-country authorities. Decree No. 2026-272 of 14 April 2026 set out the details, with a temporary derogation regime when no suitable offer exists, and the order of 12 August 2026 named SecNumCloud 3.2 as the framework. Under the order, compliance is shown by an ANSSI qualification or by a European certification recognised as equivalent by ANSSI. The Ministry of the Economy's legal department has published a technical note and model clauses for public buyers.

Local authorities, healthcare, companies: no general obligation

Local authorities and healthcare institutions are not directly covered by Article 31. Many public buyers nevertheless require SecNumCloud hosting for sensitive data in their tenders, or reward it in scoring. In the private sector, neither NIS 2 nor DORA mandates SecNumCloud, but both require organisations to control supplier risk, and a qualified service is strong evidence for the most sensitive systems. Finally, companies bidding for public cloud contracts, or working as subcontractors, see these requirements passed down into their contracts, as Quantic Avocats points out.

For public bodies, the SecNumCloud question often comes up during the security accreditation of an information system: the hosting choice is one of the risks the accreditation authority accepts, or not. Phinasoft's risk analysis module helps document that decision.

Qualification is a lengthy process, initiated by the cloud provider. It goes through numbered milestones, from J0 to J3, and involves an evaluation centre approved by ANSSI, which audits the service, and then ANSSI, which decides.

Qualification is valid for three years, subject to annual surveillance audits, and can be renewed through the same milestones (ANSSI FAQ). The agency does not publish a typical duration; providers who have spoken publicly describe a process lasting more than a year and demanding significant resources.

These four acronyms come up in the same tenders. They do not measure the same thing, and a provider can hold several. Pick a criterion to compare.

SecNumCloud and HDS

HDS certification is mandatory in France for hosting health data on behalf of a third party. It requires storage in the EU or EEA and transparency about foreign laws, without requiring immunity. SecNumCloud goes further on sovereignty but does not replace HDS: a qualified cloud hosting health data must also be certified. In May 2026, according to France's Digital Health Agency, eight of the ten SecNumCloud-qualified hosts were also HDS certified.

SecNumCloud and ISO 27001

ISO 27001 certifies an information security management system, over a scope chosen by the organisation. It is a useful foundation that many providers already hold, but it says nothing about data location or extraterritorial laws. Phinasoft's compliance assessments help manage the ground the two share.

SecNumCloud and EUCS

EUCS is the European cloud certification scheme being prepared by ENISA under the Cybersecurity Act. In early 2026, its final version had still not been adopted: member states are debating whether to cover strategic risks on top of technical requirements, according to Cullen International. In January 2026 the Commission also proposed a revision of the Cybersecurity Act to speed up the development of schemes. The August 2026 order already provides that a European certification recognised as equivalent by ANSSI can demonstrate compliance.

The lists change as new qualifications are granted: rely on the official list of qualified services published by ANSSI, and on the list of providers undergoing qualification. During 2026, there were around ten qualified services. Before signing, check:

• the qualified layer: an IaaS qualification does not automatically cover the same provider's PaaS or SaaS services;
• the exact scope of the service you are buying, against the one that was evaluated;
• the date and validity of the qualification, and the provider's commitments if it is lost;
• reversibility: exit conditions, formats, timelines;
• the provider's subcontractors, and their own exposure to extraterritorial laws.

These checks are part of third-party risk management. They matter all the more in light of supply chain attacks, where a compromised provider becomes the entry point to its clients.

Where Phinasoft fits in

Phinasoft is French cyber risk management software that helps public administrations and local authorities manage their cybersecurity governance. It can be installed on-premise on your own infrastructure or hosted on a French sovereign cloud (OVH or Outscale) with a SecNumCloud option. It supports your security accreditation work, your risk analyses with the ANSSI-labelled EBIOS RM module, your compliance assessments (IGI 1300, ANSSI hygiene guide, NIS 2, ISO 27001, security policy) and the assessment of your providers and subcontractors. To discuss your own context, you can request a demo.