What is Meant by a French Cloud
A French cloud refers to a hosting service whose operator, contract, and infrastructure are rooted in France, not merely the location of the servers. Naitways, for example, is among the French players in the cloud market. This definition enables comparing offers based on verifiable facts rather than marketing rhetoric.
The Six Criteria for Recognizing a French Cloud
1. Headquarters and ownership
The registered office and the capital of the hosting provider indicate who makes the decisions. Request the ownership structure and the entity that signs the contract. Also check for recent control changes (acquisitions, new investors): a parent company subject to extraterritorial laws, such as the U.S. Cloud Act, can expose data even when it is hosted in France.
2. Governing law and jurisdiction
The contract should specify French law and a French court. The GDPR applies to processors established in the EU and requires a written agreement that governs the processing between the client and the host (art. 28) [1].
3. Data location, backups, and access
For a French cloud, data, backups, and logs should remain in France (the GDPR requires the EU or appropriate safeguards, not France alone). Also verify where the technical teams administer the platform and whether subcontractors outside the EU have access, since remote access from a third country can constitute a data transfer [1][2][6].
4. In-house infrastructure
A provider that controls its own infrastructure and network minimizes the number of intermediaries, and thus the points of dependency. Ask who operates the data centers, the network, and the equipment, and which subcontractors are involved.
5. Certifications and actual scope
The ISO/IEC 27001 standard certifies an information security management system for a defined scope. The ISO/IEC 27017 standard adds cloud-specific measures [3]. Read the certificate: it should specify the sites and services that are truly covered.
6. Support and teams in France
French-language support, teams based in France, and a clear service level agreement (SLA) simplify incident management. Check the hours, response times, and the level of the point of contact.
How to Verify These Criteria Before Signing?
Ask the hosting provider for these four items:
- the contract and its annexes, including the list of subcontractors [1][4]
- the ISO 27001 certificate with its scope [3]
- the location of backups and administration access [2]
- commitments on portability and interoperability, in light of the SREN law (arts. 28 to 30) [5] and the European Data Act [7]
In Short
A French cloud can be verified on documentable criteria: headquarters, contract, data localization, in-house infrastructure, certification, and support. A hosting provider that clearly addresses these six points enables decision-making based on evidence.
Sources
- EUR-Lex, Regulation (EU) 2016/679 (GDPR), arts. 3, 28 and 44–46: https://eur-lex.europa.eu/eli/reg/2016/679/oj?locale=en
- CNIL, ” Transfers of data outside the EU: the general framework under the GDPR”: https://www.cnil.fr/fr/transferts-de-donnees-hors-ue-le-cadre-general-prevu-par-le-rgpd
- ISO, ISO/IEC 27001: https://www.iso.org/standard/27001 and ISO/IEC 27017:2015: https://www.iso.org/standard/43757.html
- ANSSI, “Externalisation and security of information systems: a guide to mastering risks” (2010): https://messervices.cyber.gouv.fr/guides/externalisation-et-securite-des-systemes-dinformation-un-guide-pour-maitriser-les
- Legifrance, Law No. 2024-449 of 21 May 2024 aimed at securing and regulating the digital space: https://www.legifrance.gouv.fr/eli/loi/2024/5/21/ECOI2309270L/jo/texte
- EDPB, Guidelines 05/2021 on the interplay between Article 3 and international transfers (chapter V): https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-052021-interplay-between-application-article-3_en
- EUR-Lex, Regulation (EU) 2023/2854 (Data Act): https://eur-lex.europa.eu/eli/reg/2023/2854/oj
