French sovereign cloud, what it actually means

The phrase “French sovereign cloud” is everywhere, and often meaningless. Before choosing a host on that basis, it is worth understanding what sovereignty actually protects, and what a provider can honestly claim.

What sovereignty covers

The sovereignty of a hosting service plays out on several distinct levels:

• the physical location of the servers and the backups;
• the nationality of the operator and of its parent company;
• the law applicable to the data, which depends above all on who controls the company;
• technical autonomy: hardware, software and the supply chain.

A server located in France but operated by the subsidiary of a US group is not shielded from US law. Location alone is not enough.

Why the Cloud Act changes everything

The CLOUD Act (2018) allows US authorities to demand from any company subject to US law the data it holds, including when that data is stored abroad. The decisive criterion is not where the server sits, but the operator’s ties to US jurisdiction.

The direct consequence: hosting “in France” with a provider controlled from the United States does not remove that legal risk. Real sovereignty requires an operator that is not subject to this extraterritorial law.

What a host can — and cannot — claim

An honest host distinguishes between its offerings:

• our managed infrastructure (web, WordPress, gaming) runs on our own hardware, in France;
• our VPS and dedicated servers run on Hetzner infrastructure in the European Union (Germany, Finland), operated by a European company, outside the scope of the Cloud Act.

What we do not claim: no SecNumCloud label, no “certified sovereign” badge, no compliance we have not had audited. Those terms have precise meanings and can be verified.

How to verify a claim

Before signing, check four things:

• who controls the company (ownership, parent company, governing jurisdiction);
• where the data is, backups included, region by region;
• which certifications are actually held, and their exact scope;
• who operates the hardware day to day.

A transparent provider answers these questions without hedging. Vagueness is already an answer.

To understand our position plan by plan, see our sovereignty page. For the servers concerned, see our VPS.