In this context, the question is no longer whether to migrate, but how to structure what already exists, maintain control over day-to-day operations, and retain ownership of environments and data.

On Tuesday 28 April at 11:30 AM, Clever Cloud and Cycloid are hosting a webinar to address these challenges.

Two complementary perspectives on a shared challenge

We are offering a cross-functional discussion to provide concrete insight into these topics.

Cycloid covers the structuring and governance of environments through a unified internal developer platform and portal. Clever Cloud addresses managed operations, operational maintenance (MCO) and operational sovereignty.

Join Florent Perreux (Chief Sales Officer @ Clever Cloud), Steven Le Roux (CTO @ Clever Cloud), Alexandre Blin (Business Director SEMEA @ Cycloid) and Olivier de Turckheim (Solution Architect @ Cycloid) to understand how to align governance and operations without adding complexity.

Agenda

🔹 Why cloud modernisation goes beyond migration;plus à une migration;

🔹 Structuring and governance challenges in multi-cloud environments;

🔹 Operational challenges related to operations and maintenance;

🔹 How to align governance and operations without multiplying complexity;

🔹 A live Q&A session to ask your questions directly.

Why attend?

✅ Understand the root causes of complexity in cloud projects;

✅ Identify the levers to structure your usage and reduce vendor dependency;

✅ Gain a clearer understanding of operational and sovereignty challenges;

✅ Benefit from concrete real-world experience;

✅ Engage directly with experts.

Register now

🗓️ Tuesday 28 April 2026

⏰ 11:30 AM – 12:00 PM

💻 Online webinar on Livestorm

Facing these challenges? Join us on 28 April!

This transformation is taking place within a context of cost reduction, rationalization of existing infrastructures, and the pooling of IT resources.

In this constrained environment, the question is not only which provider or technology to choose, but which application execution model is best suited to the project at hand. PaaS (Platform as a Service) is one of the available options, provided its benefits, limitations, and applicable frameworks are clearly understood.

Challenges and issues specific to the public sector

Public organizations face structural constraints that directly influence their technical decisions. Budget pressure is constant, with explicit objectives to control or even reduce IT operating costs. Technical teams are often understaffed, with recruitment challenges for specialized roles such as system administrators, developers, cybersecurity experts, and cloud or DevOps engineers.

In addition, public organizations often rely on a heterogeneous and sometimes aging application landscape, built on technologies or environments that are no longer maintained or are difficult to evolve. Security, availability, and regulatory compliance requirements are high, while project timelines must remain aligned with the operational needs of administrations, local authorities, and public institutions.

How PaaS can address these challenges in the public sector

Using a cloud platform can address part of these challenges, without being a universal solution. One of its main benefits is the reduction of operational workload. In practice, this means that operating systems, application runtimes, deployment processes, restarts, and monitoring mechanisms are managed at the platform level. Technical teams no longer need to handle day-to-day infrastructure management and can focus on developing, improving, and maintaining applications.

From a security and update perspective, an application hosting solution also helps maintain technical environments more consistently up to date. In the public sector, where legacy management is a key concern, this reduces risks associated with obsolete systems, unmaintained dependencies, and delayed security patching. While this approach does not eliminate existing legacy systems, it helps structure their operation and supports gradual modernization without requiring a full overhaul of the information system.

In this context, a PaaS for public services can be a relevant lever, provided it is selected for clearly identified use cases.

Not all public projects fall under the same deployment framework

Public sector digital projects vary widely. An internal business application, a citizen-facing digital service, a data platform, or a research project do not involve the same constraints or levels of requirements.

Some contexts, particularly those related to defense or the processing of sensitive information, require enhanced guarantees in terms of security, control, and sovereignty. In such cases, specific qualification frameworks such as SecNumCloud may be required, limiting the available technical options. PaaS is therefore not suitable for all scenarios, and its use must be assessed based on data sensitivity and applicable regulatory requirements.

Existing public frameworks for deploying PaaS

Contrary to common belief, public sector organizations already have operational frameworks to access compliant cloud and application hosting services.

For administrations and public institutions, using UGAP provides access to a national purchasing body with pooled and legally secure contracts.

At a regional level, initiatives such as La Fabrique IA Territoriale, led by GIGALIS, offer local authorities and institutions in the Pays de la Loire region a structured framework to access digital and cloud services, with a focus on mutualization and support.

In the healthcare sector, hospitals can rely on Resah, which references solutions tailored to the specific requirements of healthcare environments.

These frameworks do not define technical use cases but provide concrete access points to services compliant with public procurement regulations.

When PaaS is particularly relevant

A managed cloud model is especially well suited when the goal is to build a new application without the need to handle system administration. It is also relevant for modernizing or refactoring existing applications, where the main objective is to simplify operations while improving reliability and security.

For application projects requiring fast deployment cycles, better cost predictability, and reduced administrative overhead, a cloud offering for public sector organizations can be a consistent choice, provided the functional and regulatory scope is clearly defined.

Key considerations before making this choice

Before choosing a PaaS, several factors must be carefully evaluated: the actual scope of platform responsibility, reversibility conditions, data location and protection, and alignment between data sensitivity and the guarantees provided. These elements determine whether the model is appropriate and sustainable over time.

Are you working on an application project within a public service and wondering whether a PaaS model is relevant in your context?

Identifying the right contractual framework helps save time and ensures compliance with public sector digital projects.

Or access Clever Cloud directly via public platforms:
UGAP for administrations and public institutions, La Fabrique IA Territoriale for organizations in the Pays de la Loire region, and Resah for healthcare institutions.

At the same time, in its  summary published earlier this year, the cybersecurity body CERT-FR, operated by the French National Cybersecurity Agency (ANSSI), reports that 218 cyber incidents were handled in 2024 involving local authorities. In its 2024 activity report,
ANSSI also describes the cyber threat as “systemic” for the public and social sectors.

In this context, choosing a secure cloud solution for public administrations has become a central concern for CIOs, CISOs, and digital project managers.

The objective is not simply to select a high-performance infrastructure, but to ensure that the chosen cloud solution meets the legal, regulatory, technical, and operational requirements specific to the public sector.

Understanding what cloud security means in the public sector

The data handled by public administrations — personal data, health data, financial information, and sensitive data related to public infrastructures — are subject to strict regulatory frameworks, notably enforced by the CNIL and the GDPR. In addition, the public sector is expected to rely on recognised security certifications, such as ISO/IEC 27001, HDS for health data, and, for the most critical environments, SecNumCloud.

These requirements demonstrate that a secure cloud goes far beyond firewalls or encryption alone. It requires a comprehensive, structured, and auditable approach to security.

Digital sovereignty: a criterion that has become essential

For a public administration, it is essential to know where data is hosted and under which jurisdiction it falls, in order to comply with the GDPR and to properly govern any potential data transfers outside the European Union.

A sovereign cloud implies not only that data is hosted within the European Union, but also that it is not subject to extraterritorial legislation, such as the US Cloud Act (2018), which allows a foreign government to request access to data stored by a provider under its jurisdiction.

Digital sovereignty also contributes to the resilience of information systems. By limiting technical, contractual, or legal dependencies on a single provider, public administrations retain the ability to react quickly when constraints arise—for example, by changing providers or relocating a service when regulatory, operational, or strategic conditions require it. This margin of manoeuvre is an important factor in maintaining control and ensuring the long-term sustainability of public digital services.

Sovereignty is therefore a key differentiating criterion when choosing between a European provider and a US-based provider.

Beyond compliance: essential technical requirements

To ensure a level of security appropriate for the public sector, a cloud solution must provide strong isolation between environments, systematic encryption of data in transit and at rest, host hardening, as well as continuous monitoring mechanisms (logs, metrics, alerts).

Identity and access management (IAM), multi-factor authentication, and the application of the principle of least privilege are part of a Zero Trust approach, now recommended by ANSSI to reduce the attack surface.

Security also relies on operational resilience: service continuity, recovery capabilities, high availability, and fault-tolerant architectures.

The role of automation in risk reduction

Automation is often seen as a convenience for developers; in the public sector, it is above all a lever for reducing human-related risks.

Automated deployments, automatic scalability, and self-healing mechanisms help limit operational errors, which account for a significant proportion of security incidents.

By reducing the number of manual operations, organisations lower the risk of misconfiguration and improve the overall availability of services.

Total cost of ownership and governance

Choosing a secure cloud is not just a matter of comparing list prices.

Public sector organisations must take into account the notion of total cost of ownership (TCO):

• Infrastructure costs,
• Internal staffing costs,
• Operational complexity,
• Maintenance,
• Time spent handling incidents,
• Effort required to migrate a service or ensure its reversibility.

A platform that automates most operational tasks and enables reproducible environments can significantly reduce internal workload, and therefore the overall cost.

How to objectively assess market solutions

To evaluate a cloud solution intended for the public sector, it is essential to rely on factual criteria: the level of sovereignty, available certifications, technical capabilities, reversibility, the availability of private cloud or on-premise options, the existence of air-gapped environments, the quality of support, and compatibility with existing tools.

The most common mistakes include choosing a provider out of habit, focusing solely on price, or confusing data localisation with legal sovereignty.

Another recurring mistake is overestimating the complexity of migration. In many cases, a test or a Proof of Concept is sufficient to validate feasibility.

A simple method for choosing the right cloud solution

The most effective approach consists in:

This approach provides a balanced view of security, compliance, performance, and sustainability.

What Clever Cloud brings to these challenges

Clever Cloud is a European hosting provider certified ISO/IEC 27001:2022 and HDS, offering public cloud, private cloud, on-premise and air-gapped environments. For highly regulated requirements, a zone already qualified SecNumCloud is available on request through our partnership with Cloud Temple. This makes it possible to meet “trusted cloud” requirements while benefiting from the Clever Cloud platform.

The platform follows a security-by-design approach based on environment isolation, system hardening, strong authentication, and built-in observability.

Automated deployments, automatic scaling (auto-scaling), and self-healing mechanisms reduce operational effort and limit human error.

Data remains hosted in Europe, and data portability is ensured, with no proprietary lock-in.

Support is human-led and provided from France.

Finally, for public organisations that rely on pooled public procurement frameworks, it is worth noting that Clever Cloud is listed on the “Nuage Public” (UGAP) framework. Public administrations can therefore subscribe to our services within an already validated public purchasing framework, simplifying administrative procedures and accelerating service deployment.

Towards a secure, sovereign, and sustainable public cloud

For a public administration, choosing a secure cloud solution means finding the right balance between sovereignty, compliance, technical security, productivity, and cost control.

By relying on clear criteria and official reference frameworks (ANSSI, ISO, GDPR, HDS), it becomes possible to select a solution genuinely suited to the needs of the public sector—one that can ensure both service continuity and the protection of citizens’ data.

Would you like to evaluate a sovereign and automated cloud platform?

Contact us

In addition to cloud credits, the selected startups benefit from personalised onboarding with our engineers, coaching, access to workshops and masterclasses, as well as visibility across our media channels and events.

The objective is clear: to enable them to focus on their core business while relying on a reliable, automated and sovereign cloud infrastructure.

The new startups of the 3rd UP cohort

This year, seven innovative young companies are joining the UP program. They cover a wide range of sectors – e-commerce, finance, health, energy and data – with one thing in common: using technology to tackle concrete challenges.

Chaynon: fighting against refund fraud

Chaynon offers a decision-support tool for marketplaces and e-merchants to combat refund fraud. Their solution detects suspicious behaviours, helping to reduce losses linked to abuse while protecting merchants’ margins.

Klafuti: automating accounting data

Klafuti has designed a SaaS platform for accounting professionals (accountancy firms, chartered accountants, etc.) that automates the extraction, transformation and integration of accounting data. This approach simplifies the day-to-day work of experts and frees up time for strategic advisory.

Wattflow : optimising energy in professional buildings

Wattflow orchestrates the heating, ventilation and air conditioning systems of office and commercial buildings by communicating directly with the machines. The result: up to 40% savings on energy and associated costs, along with improved comfort for occupants. By directly connecting to technical equipment, Wattflow combines energy efficiency with enhanced user experience.

thaink²: simplifying Data & AI projects

thaink² Analytics is the Data & AI platform that simplifies your projects end to end. A no-code SaaS, intuitive and designed by experts. No more unstable data pipelines or ML/AI models stuck at the POC stage. The goal: to make AI operational and accessible to all companies, without technical complexity.

LiteoMED: a digital ecosystem for oncology

LiteoMED provides a comprehensive platform dedicated to oncologists. It combines precision medicine with a patient-centred approach, allowing practitioners to save time while improving care delivery and patient follow-up.

Kocliko: reducing energy costs and carbon in collective housing

Kocliko deploys a unique deeptech solution for intelligent control of collective heating, combining AI, certified sensors and a digital twin to sustainably reduce consumption, emissions and tenants’ charges.

Cloud Data Engine: securing distributed data exchanges

Cloud Data Engine specialises in the operational management of data spaces and the automation of compliance for decentralised data ecosystems (dataspaces, catalogues, marketplaces, etc.).

Why join the UP program?

The program is designed as a real springboard for startups. By joining UP, they gain access to high-level technical support, mentoring sessions, and increased visibility within our network and among our partners.

At Clever Cloud, we believe the cloud should be an accelerator, not a barrier, in the entrepreneurial journey. That’s why we invest in these promising young companies and give them the means to grow faster.

Are you a startup looking to join the UP program?

Apply now to be part of the next cohort!

An unprecedented initiative led by Gigalis

Created in 2000 by the Pays de la Loire Regional Council, Gigalis has established itself as a key player in public digital services. Transformed into a Public Interest Group (GIP) in January 2025, it now supports regional authorities and institutions with sovereign services in connectivity, cybersecurity, cloud, and the pooling of digital procurement. It is within this dynamic that, on September 1st, the Fabrique IA Territoriale was officially launched — a unique initiative in France bringing together public actors and private companies to address the challenges of artificial intelligence and open source.

Three complementary lots to structure the AI ecosystem

The framework agreement designed by Gigalis has been divided into three lots, covering the entire lifecycle of AI projects.

1. The first focuses on consulting and raising awareness around artificial intelligence, and was awarded to a group of national and regional players including Linagora, Onepoint, Pyxis support, Synchrone et Wavestone.
2. The second, dedicated to community integration, brings together Atos, DRI, Metapolis, Beewant, Reel IT, Cross Data, PARTHEMA, DATA INCEPTIO.AI et Valeuriad.
3. Finally, the third lot, centered on infrastructure, hosting, deployment, and operations using open source technologies, was awarded to Clever Cloud, Linagora, DRI, Siium et Reel IT.

This organization ensures strong complementarity and makes it possible to provide public sector actors with a coherent, sovereign, and tailored offering that fully meets their needs.

Clever Cloud’s expertise for Lot 3

Clever Cloud’s participation in the Fabrique IA Territoriale is fully aligned with our mission: providing a European, secure cloud that frees public organizations from technical constraints. In practice, our approach relies on proven open source technologies, integrated into an automated infrastructure to ensure interoperability, performance, and security. At the same time, we guarantee high availability, continuous monitoring, and measurable commitments through transparent quality indicators.

Beyond the technical aspects, our contribution also consists in transferring knowledge to gradually make beneficiaries autonomous. This transfer of expertise lies at the heart of our approach: supporting, securing, and sustaining digital projects without creating dependency on external providers.

A commitment to digital sovereignty in the region

The Fabrique IA Territoriale is more than just a framework agreement: it embodies a collective vision of trusted digital services, designed for local territories. By joining this initiative, Clever Cloud strengthens its commitment to offering a credible European alternative to major international providers. This approach enables local authorities to benefit from modern, resilient infrastructures while supporting the regional digital ecosystem.

For Clever Cloud, this participation illustrates the convergence between our values and those promoted by Gigalis: sovereignty, cooperation, and sustainability. We believe that an ethical and responsible digital environment must be built on open, secure, and accessible solutions for all public sector actors.

Conclusion and outlook

Our role within the Fabrique IA Territoriale reaffirms our determination to support the digital transformation of public services, giving them the means to manage their projects with efficiency and transparency. Alongside committed partners, we put automation, security, and sovereignty at the service of collective intelligence and local innovation.

To learn more about how Clever Cloud can support your public sector or territorial projects:

Contact us

For Madietenligne, a platform that supports over 2,500 dieticians in managing their business, ensuring compliance was becoming more and more complex... until they migrated to Clever Cloud's HDS-certified PaaS.

On Tuesday June 17, 2025 at 11:30 a.m., Madietenligne looks back at this strategic shift during an HDS-certified webinar.

Why an HDS compliance webinar?

As a certified healthcare data host for the 6 activities covered by the standard, Clever Cloud supports editors who want to focus on their core business, without sacrificing security or sovereignty.

In this webinar, we will discuss:

• A clear overview of HDS obligations and their practical impact on your solution;
• HDS compliance “fast-track”: benefit immediately from a certified, sovereign cloud, with no regulatory or administrative formalities to deal with;
• Behind the scenes of Madietenligne's < 3 week migration, and the gains observed (security, scalability, sovereignty);
• Any points you'd like to clarify, through a live Q&A session.

The program

Join Florent Perreux (Chief Sales Officer @ Clever Cloud) and Eddy Montus (Co-founder @ MaDietEnLigne) as they explore, step by step, the challenges and rewards of migrating to a sovereign, HDS-compliant cloud.

On the agenda:

🔹 The challenges of HDS compliance for companies processing healthcare data ;

🔹 The concrete benefits of an HDS-certified PaaS ;

🔹 The experience of a customer committed to security and sovereignty issues ;

🔹 A Q&A session to ask your questions.

Why participate?

🔖 Understand HDS obligations and how to meet them;

🎯 Discover a real-life case study from a committed SaaS healthcare publisher;

👑 Explore a sovereign, scalable and compliant cloud solution;

❓ Chat live with our speakers.

🗣️ "In less than three weeks, we migrated our dev and prod environments.  And most importantly, I'm more than satisfied with the service and excellent support!"— Eddy Montus, Co-founder @ Madietenligne

Register now

📅 Tuesday, June 17, 2025

⏰ 11:30 AM - 12h00 PM

💻 Livestorm online webinar

You code, we guarantee HDS compliance, combined with sovereign, scalable and automated hosting. Join us on June 17 to find out how! 🚀

The protection of health data now concerns many sectors of activity. Software publishers, healthcare establishments, public services, laboratories… More and more players need to guarantee secure hosting for this sensitive data.

Ready to secure and optimise your data hosting? Contact our teams to find out more!

Make an appointment now!

Understanding Health Data Hosting ("Hébergement des Données de Santé" - HDS) cloud certification

What is health data?

Any information that makes it possible to identify a person and learn about their state of health, whether physical or mental, is health data (information collected during medical monitoring, results of medical examinations, information relating to an illness, allergy, treatment or disability, etc.).

What is HDS certification?

HDS (Health Data Hosting) certification aims to enhance the security and confidentiality of personal health data, thereby guaranteeing a trusted environment for e-health and patient monitoring. To meet these high standards, it is based on ISO-compliant standards and the RGPD. Issued by an accredited independent body, it covers six areas of activity: the provision and maintenance in operational and security conditions of physical sites, the hardware infrastructure, the virtual infrastructure, the platform for hosting IS applications processing personal health data, as well as the administration and operation of the IS and the backup of personal health data.

Why choose an HDS cloud?

A legal obligation for players in the healthcare sector

All players (public or private) who host, use or store health data for a third party (with the exception of IT archiving services, which are not affected by these obligations) must be HDS-certified. Only health establishments that manage their own information systems are exempt (L.1111-8 of the Public Health Code).

Data security and confidentiality

Unlike an on-premise infrastructure, where the company would have to manage data hosting, operation and security itself, a Platform as a Service HDS cloud like Clever Cloud enables these critical aspects to be automated. This guarantees rapid deployment, automatic scalability, one-click database control, advanced security (encryption, service continuity, anonymisation) and effortless maintenance, all in a certified way.

By choosing an HDS cloud, you can concentrate on your core business, while ensuring that your infrastructure complies with the highest standards of healthcare data protection.

Rely on Clever Cloud for HDS hosting of your sensitive data

Contact our teams!