--- title: "SecNumCloud Explained: Qualification, List, Timeline | Natalia" description: "SecNumCloud explained: what the French ANSSI qualification proves, where to find the official list, and the observed timelines. Sourced guide." url: https://getnatalia.com/en/sovereignty/secnumcloud lang: en --- Sovereignty # SecNumCloud explained: qualification, list, timelines What the French ANSSI's SecNumCloud qualification proves, where to find the official list of qualified offers, and how long a qualification takes. October 2, 2026 7 min ## Contents 1. [What SecNumCloud is](https://getnatalia.com/en/sovereignty/secnumcloud#section-0) 2. [What the qualification really proves](https://getnatalia.com/en/sovereignty/secnumcloud#section-1) 3. [Who is qualified, and where to check](https://getnatalia.com/en/sovereignty/secnumcloud#section-2) 4. [When to require it](https://getnatalia.com/en/sovereignty/secnumcloud#section-3) 5. [FAQ](https://getnatalia.com/en/sovereignty/secnumcloud#section-4) ## What SecNumCloud is SecNumCloud is the French ANSSI's set of requirements for cloud service providers. The version in force is 3.2. Qualification is granted per offer, after an audit, and is valid for three years with a mid-term surveillance audit. It does not qualify a company “as a whole”: the same provider can have one qualified offer and another merely in the qualification process. SecNumCloud combines a thorough security audit with extraterritorial-immunity criteria covering control of capital, headquarters and applicable law, which must all sit within the European Union. ### Per offer, by audit The qualification covers a specific offer, not the entire company. ### Extraterritorial immunity Criteria on capital, headquarters and applicable law, located in the EU. ### Valid for three years With a mid-term surveillance audit to maintain the qualification. ## What the qualification really proves SecNumCloud is roughly equivalent to a third-party-audited SEAL-3 level: European control and a stack protected against a non-European supply disruption. It is a strong signal, but it applies to the qualified infrastructure or platform offer, not automatically to every service built on top of it. An application service hosted on a qualified offer does not inherit the qualification. The European CADA proposal's levels 3 and 4 and SecNumCloud converge in substance; France is pushing for mutual recognition. The debate about joint ventures involving a non-European player remains open at European level. ### Read what is qualified Always ask which specific offer is qualified, and whether the service you use is part of it. The qualification of an infrastructure building block does not, by default, cover the application layers above it. ## Who is qualified, and where to check The only authoritative list is the one published by ANSSI on cyber.gouv.fr. Do not rely on a list copied onto a third-party site: statuses change. As an example of verifiable public statuses: S3NS announced the SecNumCloud 3.2 qualification of its PREMI3NS offer in December 2025; Scaleway, which passed the initial milestone in January 2025, is still in the qualification process at the date of this page. These statuses are indicative and must be re-checked at the source. For the complete, up-to-date list of qualified offers and offers in the qualification process, refer directly to ANSSI. ### Single source The official list of qualified and in-progress offers is on cyber.gouv.fr. ### Beware copies A list copied elsewhere can be out of date: a status may change from one quarter to the next. ## When to require it SecNumCloud is mandatory for certain state data and recommended for operators of vital importance and sensitive data, under the French “cloud at the centre” doctrine. For the private sector it is a strong trust signal, but not always necessary: cost and the scope of qualified services should be weighed against the real need. In many cases, assessing sovereignty across the three dimensions is enough. If your data must never leave your network anyway, a disconnected on-premise architecture answers the question by design, without depending on a label. ## Frequently asked questions ### Does SecNumCloud qualify a company or an offer? A specific offer, not the entire company. The same provider can have one qualified offer and another in the qualification process. Always ask which offer is concerned and whether the service you use is actually part of it. ### How long does a SecNumCloud qualification take? The observed time between the initial milestone and qualification is generally eighteen to thirty-six months, because it requires a thorough audit. A provider that has started the process is not qualified until ANSSI lists it on its official register. ### Where can I find the official list of SecNumCloud providers? Only on cyber.gouv.fr, the ANSSI website. It is the sole authoritative source, for qualified offers and for those in the qualification process. A list copied onto a third-party site may be out of date. ## Primary sources - [ANSSI — SecNumCloud for cloud service providers](https://cyber.gouv.fr/secnumcloud-pour-les-fournisseurs-de-services-cloud) accessed 2 Oct 2026 - [ANSSI — offers in the SecNumCloud qualification process](https://cyber.gouv.fr/offre-de-service/solutions-certifiees-et-qualifiees/services-de-securite-evalue/solutions-en-cours-de-qualification/prestataires-secnumcloud/) accessed 2 Oct 2026 - [Thales — SecNumCloud qualification of S3NS's PREMI3NS offer](https://www.thalesgroup.com/en/news-centre/press-releases/s3ns-announces-secnumcloud-qualification-premi3ns-its-trusted-cloud) Dec 2025 - [Scaleway — SecNumCloud status](https://www.scaleway.com/en/security-and-compliance/secnumcloud/) accessed 2 Oct 2026 ## Related pages - ### Sovereign cloud guide The three dimensions, extraterritorial risk and the seven questions to ask. - ### SEAL levels 0 to 4 The European grid that SecNumCloud compares to. - ### Sovereignty overview Natalia's positioning and its three angles. ## Let's discuss your compliance requirements We review your real constraints, standard by standard, without overselling. [Request a demo](https://getnatalia.com/en/contact)