- «Trusted Cloud» is the label for the government’s cloud policy (2021): the ANSSI’s SecNumCloud certification, plus immunity from extraterritorial laws such as the Cloud Act. Since version 3.2 of the framework, this immunity has been a requirement of SecNumCloud itself.
- Legal doctrine permits the use of foreign technology provided that it is operated entirely under license by a European entity, outside the scope of U.S. law. Standard 3.2 establishes these criteria for capital and operational control.
- The «cloud-first» policy dates back to the circular of July 5, 2021; it was updated in 2023.
- Outscale, OVHcloud, and Oodrive are cited by the trade press as de facto eligible providers.
What exactly is the "trusted cloud"?
The «Trusted Cloud» is a certification under the French government’s cloud strategy, stemming from the 2021 “Cloud-First” doctrine. Originally, it referred to two things combined: the ANSSI’s SecNumCloud certification and immunity from the U.S. Cloud Act, granted when the provider’s technology is operated entirely by a European entity, including under license. Since version 3.2 of the SecNumCloud framework, this immunity from extraterritorial laws has become part of the certification requirements themselves: the label and the certification have merged.
Trusted cloud, sovereign cloud, SecNumCloud: What's the difference?
The term “sovereign cloud” refers, in a broad sense, to an infrastructure under French or European jurisdiction. SecNumCloud is the security certification issued by ANSSI, which, since version 3.2, verifies immunity from the Cloud Act. The “trusted cloud” is the term used by government policy to describe this level of requirements, which also includes an incentive for interoperability through the GAIA-X initiative.
- Sovereign cloud: A court: French or European.
- SecNumCloud: A technical certification issued by ANSSI.
- Trusted Cloud: The name given by the government to this level: SecNumCloud 3.2, including immunity.
Where did this label come from, and why now?
The French government established this policy through the «Cloud at the Center» circular dated July 5, 2021, updated in 2023, to strengthen the protection of sensitive data belonging to French citizens and businesses. The stated goal: to place the cloud at the center of the government’s digital transformation, without relying on a provider subject to extraterritorial legislation.
Why is this important for an organization choosing a web hosting provider?
A company that processes sensitive, personal, or regulated data limits its legal exposure by choosing a hosting provider whose technology falls outside the scope of the Cloud Act. This is a legal decision-making criterion, rather than a marketing pitch. In the event of a U.S. subpoena, a provider subject to the Cloud Act may be compelled to hand over data, regardless of where it is stored.
The Outscale Dassault Systèmes Cloud and the Trusted Cloud
The Outscale Dassault Systèmes cloud has been certified as SecNumCloud 3.2, the current version of the ANSSI standard, for its cloudgouv-eu-west-1 region (source: outscale.com/our-certifications). The industry press (LeMagIT) lists Outscale among the de facto providers eligible for the “trusted cloud,” alongside OVHcloud and Oodrive. Ohmycad operates this infrastructure and offers the SecNumCloud option via the cloudgouv-eu-west-1 region when certification is required.
Conclusion
A trusted cloud is both a legal and technical selection criterion: it distinguishes providers whose technology falls outside the scope of the Cloud Act from those who merely promise that their data is located in a specific location.
Ohmycad operates the Outscale Dassault Systèmes cloud, which is SecNumCloud 3.2-certified and cited by the industry press as one of the de facto providers eligible for the “trusted cloud.” The SecNumCloud option is enabled via the cloudgouv-eu-west-1 region when required by your regulations or your end customer.
Before choosing a hosting provider, verify its credentials, jurisdiction, and the operator that actually runs the infrastructure: this is what distinguishes true compliance from a promise of compliance.
Learn more about Ohmycad's sovereign cloud offering →
For more information: sovereignty and compliance · IT outsourcing and operations
Sources
- economie.gouv.fr, the government's cloud strategy
- LeMagIT, "Cloud de Confiance," a new certification
- outscale.com, certifications
FAQ
Frequently asked Questions
Is the "Trusted Cloud" a certification like SecNumCloud?
No. SecNumCloud is a qualification issued by ANSSI, with a public registry. The “trusted cloud” is a policy label without its own certification: it referred to SecNumCloud plus immunity from the Cloud Act, an immunity that version 3.2 of the standard now incorporates.
Does the Outscale Dassault Systèmes cloud have the "Trusted Cloud" certification?
It has been awarded the SecNumCloud 3.2 designation for its cloudgouv-eu-west-1 region and has been cited by the trade press as one of the de facto providers eligible for the “trusted cloud” designation. The label itself is not an official certification with a public registry, unlike SecNumCloud.
Is SecNumCloud required for all Ohmycad customers?
No, it is still optional and is enabled at the request of the end customer or as required by regulations.
What does GAIA-X have to do with this?
GAIA-X is a Franco-German initiative aimed at facilitating data portability and the ability to switch cloud providers. The "trusted cloud" strategy encourages its adoption without mandating it.
Need sovereign, managed, and encrypted hosting within your organization? An Ohmycad engineer will get back to you with a customized quote, not a generic price list: to be called back. The full list of offerings is on the page sovereign cloud.
