{"id":402,"date":"2026-10-05T22:27:08","date_gmt":"2026-10-05T20:27:08","guid":{"rendered":"https:\/\/mu.klytic.com\/?page_id=402"},"modified":"2026-10-06T10:10:22","modified_gmt":"2026-10-06T08:10:22","slug":"sovereign-cloud-definition","status":"publish","type":"page","link":"https:\/\/mu.klytic.com\/en\/sovereign-cloud-definition\/","title":{"rendered":"Sovereign cloud: definition, criteria and limits"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Home<\/a>\u203a<\/span>Guides<\/a>\u203a<\/span>Sovereignty<\/a><\/p>

Sovereignty<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t

Sovereign cloud: definition, criteria and limits<\/h1>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In a procurement file, a sovereign cloud is a service whose operator, applicable law and administrative access are known, and whose data can be taken back. The marketing definition varies. The criteria, on the other hand, lend themselves to a grid.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Updated October 2026<\/b><\/span>9 min<\/b> read<\/span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Why a grid rather than a label<\/h2>

Writing \u201csovereign cloud\u201d in a call for tenders amounts to asking a question to which every bidder answers yes. The answers become impossible to compare, and the choice is made on price or on the impression left by the presentation.<\/p>

A grid forces every bidder to answer the same question, with supporting evidence. It also protects the buyer after signature: a commitment written into the tender response can be carried over into the contract, whereas an adjective cannot be verified. The concept itself is explained in what is a sovereign cloud<\/a>. This page is for purchasing.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

A usable definition<\/h2>

Use this one.<\/p>

A digital service is treated as sovereign, for a European buyer, when the company that operates it falls under European law, the data entrusted to it and its backups remain within the stated geographical perimeter, operational access is identified, and the client can export its data and then have it deleted.<\/p><\/blockquote>

This sentence is a working tool. It is not a section of the Data Protection Act 2017, which does not award a \u201csovereign\u201d label.<\/p>

In Mauritius, the Data Protection Act 2017 is enforced by the Data Protection Office, headed by the Data Protection Commissioner. It applies to controllers and processors established in Mauritius or using means of processing there, and requires their registration with the Commissioner (section 14), appropriate security measures including pseudonymisation and encryption (section 31), and notification of a breach no later than 72 hours after becoming aware of it (section 25). A transfer outside Mauritius requires demonstrated appropriate safeguards, the explicit consent of the individual, or a necessity provided for by law (section 36).<\/p>

Each part of the sentence refers to one or more of the criteria below. That is what makes it usable: it can be broken down into questions and the answers scored.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

Ten criteria<\/h2>

Each criterion is proven by a document, not by an adjective.<\/p>

  1. Operating company.<\/strong> Company name, country of head office, and parent company. A European subsidiary of an American group can invoice in euros while belonging to a group subject to American law. This is the criterion that determines whom a foreign authority can approach.<\/li>
  2. Governing law of the contract.<\/strong> Applicable law and competent court. Check that the general terms and conditions and the data processing agreement say the same thing.<\/li>
  3. Data perimeter.<\/strong> Content (emails, files), backups, technical logs, support data. Content alone is not enough: a commitment that covers only mailboxes leaves the copies aside.<\/li>
  4. Location.<\/strong> Country or region for each category in point 3. \u201cEurope\u201d must be specified: European Union, EFTA, or a named country.<\/li>
  5. People who administer.<\/strong> Operator employees, processors, on-call staff outside the area. Remote access, even temporary, is processing. Also ask whether this access is logged and whether the client can consult the log.<\/li>
  6. Encryption keys.<\/strong> Who holds them, who can use them for a restore, who can hand them over to a third party. The question is not \u201cis the data encrypted?\u201d, but \u201cwho can decrypt it?\u201d.<\/li>
  7. Processors.<\/strong> Up-to-date list: antispam, backup, support, audience measurement, identity. A processor subject to another law can cancel out the effect of criterion 1.<\/li>
  8. Requests from authorities.<\/strong> Internal procedure when an authority requests data, and the law applicable to that request. Ask whether the provider undertakes to inform the client, insofar as the law permits.<\/li>
  9. Reversibility.<\/strong> Formats, timeframe, cost, and what cannot be exported (chat histories, internal rules, logs). The safest approach is to test an export before signing.<\/li>
  10. Any qualification.<\/strong> If the buyer requires SecNumCloud, the name of the qualified service must be the one in the ANSSI catalogue. An offering hosted on qualified infrastructure does not inherit the qualification. Since version 3.2 of its framework (2022), SecNumCloud includes requirements for protection against non-European laws, covering head office, control of capital, location and personnel.<\/li><\/ol>

    How to weight them<\/h3>

    The ten criteria do not carry the same weight for every buyer. For email and file sharing, criteria 1, 3, 4, 5 and 9 generally make the difference between offerings. Criterion 10 is eliminatory when required, and neutral otherwise. Decide on the weighting before opening the responses, not after.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    The limits, stated clearly<\/h2>

    Location is not law.<\/strong> A datacenter in Frankfurt operated by an American company remains a service of that company. The American CLOUD Act targets data held by a provider subject to United States jurisdiction, regardless of the country where the disk is located. See protecting a business from the CLOUD Act<\/a> and the comparison European cloud or American cloud<\/a>.<\/p>

    European law does not mean no requisitions.<\/strong> A French, German or Dutch judge can order an operator within their jurisdiction to disclose data. The difference lies in the court, the procedure and the means of appeal. A grid that suggested otherwise would mislead the buyer.<\/p>

    Software and operator are distinct.<\/strong> Nextcloud is published by Nextcloud GmbH, in Germany. Zimbra is published by Synacor, in the United States. BlueMind is a French company. In all three cases, the sovereignty of your<\/em> service depends on who installs it, who backs it up and who answers the phone. The software vendor\u2019s nationality matters mainly if it has access to the data: it is then addressed under criterion 7.<\/p>

    SecNumCloud is narrow.<\/strong> It is an ANSSI qualification, offering by offering, with a scope and an end date. It is often required for sensitive government data. It is disproportionate as the sole criterion for an SME looking for email and file sharing. It is insufficient if invoked without reading the decision.<\/p>

    No offering covers every use of Microsoft 365.<\/strong> Advanced Excel, Power BI, the Teams ecosystem and business add-ins have no general equivalent among European operators. The sovereignty criterion does not settle this point. It comes on top of it. If these uses are central, the grid may lead to keeping Microsoft 365 with full knowledge of the facts: see Microsoft 365 versus a sovereign solution<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    How to write it into a specification<\/h2>

    Replace \u201csovereign cloud\u201d with the ten criteria, each with an expected piece of evidence. You can then compare a Microsoft offering with data residency, a Google offering with a data region, a Swiss offering such as Infomaniak, and an offering operated in France. The comparison becomes a reading of evidence, not a battle of adjectives.<\/p>

    Criterion<\/th>Question put to the bidder<\/th>Expected document<\/th><\/tr><\/thead>
    1. Operating company<\/td>Which company operates the service, and who controls it?<\/td>Company registration extract, group organisation chart<\/td><\/tr>
    2. Governing law<\/td>Which law, which court?<\/td>Clause in the general terms and conditions and in the data processing agreement<\/td><\/tr>
    3 and 4. Perimeter and location<\/td>Which categories of data, in which countries?<\/td>Table by category: content, backups, logs, support<\/td><\/tr>
    5. Administration<\/td>Who administers, from where, with what trail?<\/td>Description of the teams and of logging<\/td><\/tr>
    6. Keys<\/td>Who can decrypt, and in which cases?<\/td>Description of the encryption scheme<\/td><\/tr>
    7. Processors<\/td>Who receives a copy or access?<\/td>Named list with countries<\/td><\/tr>
    8. Authorities<\/td>What do you do when faced with a request?<\/td>Written procedure<\/td><\/tr>
    9. Reversibility<\/td>How do we get everything back, and how quickly?<\/td>Export procedure, formats, trial run<\/td><\/tr>
    10. Qualification<\/td>Is the proposed offering qualified?<\/td>Reference in the ANSSI catalogue, if required<\/td><\/tr><\/tbody><\/table><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    Example: a mid-sized services company issuing a tender<\/h2>

    Hypothetical case. A mid-sized services company is renewing its email and file sharing. The first version of its specification asks for \u201ca sovereign cloud solution with hosting in Europe\u201d. All three bidders answer yes.<\/p>

    The IT department rewrites the tender using the grid. The answers become readable. The first bidder hosts in Europe but belongs to a group subject to American law: criterion 1 not met, criteria 3 and 4 well documented. The second is a European company, but entrusts night-time support to a processor outside the area: criterion 5 to be negotiated. The third meets the legal criteria but does not cover one business use: management must make the call. The grid did not make the choice for the company. It made the choice explicit.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t

    \n\t\t\t\t\t\t\t\t\t

    Common mistakes<\/h2>