Sovereignty
SecNumCloud explained: qualification, list, timelines
What the French ANSSI's SecNumCloud qualification proves, where to find the official list of qualified offers, and how long a qualification takes.
What SecNumCloud is
SecNumCloud is the French ANSSI's set of requirements for cloud service providers. The version in force is 3.2.
Qualification is granted per offer, after an audit, and is valid for three years with a mid-term surveillance audit. It does not qualify a company “as a whole”: the same provider can have one qualified offer and another merely in the qualification process.
SecNumCloud combines a thorough security audit with extraterritorial-immunity criteria covering control of capital, headquarters and applicable law, which must all sit within the European Union.
Per offer, by audit
The qualification covers a specific offer, not the entire company.
Extraterritorial immunity
Criteria on capital, headquarters and applicable law, located in the EU.
Valid for three years
With a mid-term surveillance audit to maintain the qualification.
What the qualification really proves
SecNumCloud is roughly equivalent to a third-party-audited SEAL-3 level: European control and a stack protected against a non-European supply disruption.
It is a strong signal, but it applies to the qualified infrastructure or platform offer, not automatically to every service built on top of it. An application service hosted on a qualified offer does not inherit the qualification.
The European CADA proposal's levels 3 and 4 and SecNumCloud converge in substance; France is pushing for mutual recognition. The debate about joint ventures involving a non-European player remains open at European level.
Read what is qualified
Always ask which specific offer is qualified, and whether the service you use is part of it. The qualification of an infrastructure building block does not, by default, cover the application layers above it.
Who is qualified, and where to check
The only authoritative list is the one published by ANSSI on cyber.gouv.fr. Do not rely on a list copied onto a third-party site: statuses change.
As an example of verifiable public statuses: S3NS announced the SecNumCloud 3.2 qualification of its PREMI3NS offer in December 2025; Scaleway, which passed the initial milestone in January 2025, is still in the qualification process at the date of this page. These statuses are indicative and must be re-checked at the source.
For the complete, up-to-date list of qualified offers and offers in the qualification process, refer directly to ANSSI.
Single source
The official list of qualified and in-progress offers is on cyber.gouv.fr.
Beware copies
A list copied elsewhere can be out of date: a status may change from one quarter to the next.
When to require it
SecNumCloud is mandatory for certain state data and recommended for operators of vital importance and sensitive data, under the French “cloud at the centre” doctrine.
For the private sector it is a strong trust signal, but not always necessary: cost and the scope of qualified services should be weighed against the real need. In many cases, assessing sovereignty across the three dimensions is enough.
If your data must never leave your network anyway, a disconnected on-premise architecture answers the question by design, without depending on a label.
Frequently asked questions
Does SecNumCloud qualify a company or an offer?
How long does a SecNumCloud qualification take?
Where can I find the official list of SecNumCloud providers?
Primary sources
- ANSSI — SecNumCloud for cloud service providers accessed 2 Oct 2026
- ANSSI — offers in the SecNumCloud qualification process accessed 2 Oct 2026
- Thales — SecNumCloud qualification of S3NS's PREMI3NS offer Dec 2025
- Scaleway — SecNumCloud status accessed 2 Oct 2026
Let's discuss your compliance requirements
We review your real constraints, standard by standard, without overselling.