Sovereignty
In a procurement file, a sovereign cloud is a service whose operator, applicable law and administrative access are known, and whose data can be taken back. The marketing definition varies. The criteria, on the other hand, lend themselves to a grid.
Writing “sovereign cloud” in a call for tenders amounts to asking a question to which every bidder answers yes. The answers become impossible to compare, and the choice is made on price or on the impression left by the presentation.
A grid forces every bidder to answer the same question, with supporting evidence. It also protects the buyer after signature: a commitment written into the tender response can be carried over into the contract, whereas an adjective cannot be verified. The concept itself is explained in what is a sovereign cloud. This page is for purchasing.
Use this one.
A digital service is treated as sovereign, for a European buyer, when the company that operates it falls under European law, the data entrusted to it and its backups remain within the stated geographical perimeter, operational access is identified, and the client can export its data and then have it deleted.
This sentence is a working tool. It is not a section of the Data Protection Act 2017, which does not award a “sovereign” label.
In Mauritius, the Data Protection Act 2017 is enforced by the Data Protection Office, headed by the Data Protection Commissioner. It applies to controllers and processors established in Mauritius or using means of processing there, and requires their registration with the Commissioner (section 14), appropriate security measures including pseudonymisation and encryption (section 31), and notification of a breach no later than 72 hours after becoming aware of it (section 25). A transfer outside Mauritius requires demonstrated appropriate safeguards, the explicit consent of the individual, or a necessity provided for by law (section 36).
Each part of the sentence refers to one or more of the criteria below. That is what makes it usable: it can be broken down into questions and the answers scored.
Each criterion is proven by a document, not by an adjective.
The ten criteria do not carry the same weight for every buyer. For email and file sharing, criteria 1, 3, 4, 5 and 9 generally make the difference between offerings. Criterion 10 is eliminatory when required, and neutral otherwise. Decide on the weighting before opening the responses, not after.
Location is not law. A datacenter in Frankfurt operated by an American company remains a service of that company. The American CLOUD Act targets data held by a provider subject to United States jurisdiction, regardless of the country where the disk is located. See protecting a business from the CLOUD Act and the comparison European cloud or American cloud.
European law does not mean no requisitions. A French, German or Dutch judge can order an operator within their jurisdiction to disclose data. The difference lies in the court, the procedure and the means of appeal. A grid that suggested otherwise would mislead the buyer.
Software and operator are distinct. Nextcloud is published by Nextcloud GmbH, in Germany. Zimbra is published by Synacor, in the United States. BlueMind is a French company. In all three cases, the sovereignty of your service depends on who installs it, who backs it up and who answers the phone. The software vendor’s nationality matters mainly if it has access to the data: it is then addressed under criterion 7.
SecNumCloud is narrow. It is an ANSSI qualification, offering by offering, with a scope and an end date. It is often required for sensitive government data. It is disproportionate as the sole criterion for an SME looking for email and file sharing. It is insufficient if invoked without reading the decision.
No offering covers every use of Microsoft 365. Advanced Excel, Power BI, the Teams ecosystem and business add-ins have no general equivalent among European operators. The sovereignty criterion does not settle this point. It comes on top of it. If these uses are central, the grid may lead to keeping Microsoft 365 with full knowledge of the facts: see Microsoft 365 versus a sovereign solution.
Replace “sovereign cloud” with the ten criteria, each with an expected piece of evidence. You can then compare a Microsoft offering with data residency, a Google offering with a data region, a Swiss offering such as Infomaniak, and an offering operated in France. The comparison becomes a reading of evidence, not a battle of adjectives.
| Criterion | Question put to the bidder | Expected document |
|---|---|---|
| 1. Operating company | Which company operates the service, and who controls it? | Company registration extract, group organisation chart |
| 2. Governing law | Which law, which court? | Clause in the general terms and conditions and in the data processing agreement |
| 3 and 4. Perimeter and location | Which categories of data, in which countries? | Table by category: content, backups, logs, support |
| 5. Administration | Who administers, from where, with what trail? | Description of the teams and of logging |
| 6. Keys | Who can decrypt, and in which cases? | Description of the encryption scheme |
| 7. Processors | Who receives a copy or access? | Named list with countries |
| 8. Authorities | What do you do when faced with a request? | Written procedure |
| 9. Reversibility | How do we get everything back, and how quickly? | Export procedure, formats, trial run |
| 10. Qualification | Is the proposed offering qualified? | Reference in the ANSSI catalogue, if required |
Hypothetical case. A mid-sized services company is renewing its email and file sharing. The first version of its specification asks for “a sovereign cloud solution with hosting in Europe”. All three bidders answer yes.
The IT department rewrites the tender using the grid. The answers become readable. The first bidder hosts in Europe but belongs to a group subject to American law: criterion 1 not met, criteria 3 and 4 well documented. The second is a European company, but entrusts night-time support to a processor outside the area: criterion 5 to be negotiated. The third meets the legal criteria but does not cover one business use: management must make the call. The grid did not make the choice for the company. It made the choice explicit.
No. The Data Protection Act 2017 does not award a “sovereign” label. SecNumCloud is an offering qualification issued by ANSSI, not a general definition. The definition proposed here is a working tool for a buyer.
Not in general. The criterion concerns the company that operates the service and the company that controls it. A subsidiary can invoice in euros and host in Europe while belonging to a group subject to American law. The page European cloud or American cloud details this difference.
They should all be asked, to obtain comparable answers. Their weight, however, depends on your data and your obligations. A weighting set in advance avoids adjusting the grid to the preferred bidder.
Yes, and that is its value. These software vendors’ data residency arrangements are assessed under criteria 3 and 4. The vendor’s nationality is assessed under criterion 1. The page Microsoft 365, Google Workspace or Klytic helps you choose between these offerings.
Klytic ticks part of the grid and not the rest. The operator is Dedicace Software, a French company. The client chooses Klytic hosting in any geographical area corresponding to the applicable jurisdiction, subject to the availability of the required services, for example in Europe or Mauritius, or on the client’s servers. The email software vendor is American (Zimbra / Synacor), the documents software vendor is German (Nextcloud), with a dedicated instance per client.
On the keys criterion, the data is held entirely by the client, or by Klytic on the client’s behalf, in a geographical area that falls under the applicable jurisdiction. It is encrypted natively, or according to the client’s choice. The key is held by the client or kept in its account, and Klytic has no access to it. The stages where encryption is managed by Klytic are detailed on the page protecting a business from the CLOUD Act. The contract must describe this custody and this encryption.
Klytic does not hold a SecNumCloud qualification. Presenting it otherwise would be inaccurate.
This page describes a general framework. It does not replace an analysis of your contract.
Legal status as of 5 October 2026. This text does not replace a contract review. In Mauritius, the Data Protection Act 2017 governs the processing of personal data and its transfer outside the country; the Data Protection Office oversees its application. The ANSSI catalogue is authoritative for SecNumCloud.
Accessed in October 2026.
Email, documents, video conferencing, CRM and telephony, hosted in the zone that matches your jurisdiction, for example in Europe or Mauritius, or on your premises.
Welcome offer
No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.
