Clever Cloud: a sovereign cloud created in France

What is a sovereign cloud?

A sovereign cloud is a cloud service whose data, infrastructure and operation fall under a controlled legal framework, with no exposure to extraterritorial legislation. The location of datacenters is not enough. What determines a cloud’s sovereignty is the law that applies to the operator, its ownership structure and its control over the operational chain. Only on those conditions does a cloud genuinely serve the strategic autonomy of the organisations that rely on it.

The U.S. CLOUD Act, adopted in 2018, and Section 702 of FISA allow U.S. authorities to obtain data held by companies subject to U.S. law, including when that data is stored in another country. Comparable mechanisms exist in other non-European jurisdictions.

For Clever Cloud, sovereignty rests on concrete, verifiable criteria:

• European ownership and governance;
• no exposure to extraterritorial legislation;
• control over the software technologies used;
• strict compliance with European law.

Choosing digital sovereignty

A strategic and democratic choice

This is an essential democratic challenge, because technological and economic dependence reduces our collective ability to make free decisions.

As the foundation of many products and services, cloud hosting and deployment technologies are particularly exposed to these dependency issues. They call for real vigilance on digital sovereignty, for private and public sector players alike.

Supporting European innovation

By designing its own technologies rather than assembling those of non-European players, Clever Cloud offers an alternative that helps preserve competition and the freedom to innovate in the European cloud market.

Digital sovereignty is not about isolation, but a condition for lasting and competitive innovation in Europe.

Makers at heart: building our own technologies

Because we design and run our own software, we understand the needs of the developers and startups who place their trust in us. Relying mainly on third-party software would mean giving up on building the technologies we need for ourselves.

This control is verifiable. Sōzu, the reverse proxy and load balancer that sits in front of every application running on the platform, and Biscuit, our authorization token format, are two open source components built at Clever Cloud. We are also a member of the Eclipse Foundation.

Convinced that cooperation between European players is decisive for the quality and completeness of sovereign cloud offerings, we choose to work with French and European industrial partners such as OVHcloud, Outscale, Scaleway, Kalray, Vates and 2CRSi.

Clever Cloud is thus part of an ecosystem of European players working every day to defend and improve our digital sovereignty. Quentin Adam, co-founder and CEO of Clever Cloud, is vice-chairman of the Open Internet Project, an association that defends free and undistorted competition in European digital markets.

Cloud computing, the European way

Building a sovereign cloud is not only about supporting our countries’ economies and contributing to the European Union’s strategic autonomy. It also means making different technological choices that let Clever Cloud deliver its services while respecting European values and legislation.

U.S. intelligence laws allow access to data entrusted to hosting providers controlled by U.S. entities. Clever Cloud is not exposed to the CLOUD Act or Section 702 of FISA: its capital and head office are European, and the company has no subsidiary in the United States.

A sovereign cloud is therefore not limited to the location of datacenters: it requires legal, technological and operational control over the entire cloud value chain.

Clever Cloud falls exclusively under French and European law. The data its customers entrust to it is processed under the General Data Protection Regulation (GDPR) and European cybersecurity requirements. The company operates 8 datacenters in the European Union, 7 of them in France, all under European jurisdiction and outside the reach of extraterritorial legislation. It also offers regions outside Europe for deployments that require them. Its level of security is audited: Clever Cloud is certified ISO/IEC 27001 and HDS across the 6 activities of the standard.

Checking that a provider is European tells you who controls it today, not who will control it tomorrow. The digital industry never stops moving, and the ownership of a company can change over the years. In June 2026, Clever Cloud introduced the Ultimate Sovereignty Clause, a contractual mechanism designed to strengthen the resilience and digital sovereignty of critical services over time. Its aim is not to prevent a change of control, but to enable the European organisations that depend on a critical service to keep operating it, even if the provider’s control, ownership or framework of trust were to change: temporary continuity of the service, then a controlled migration to a European environment. Clever Cloud built it for its own contracts, but also to be reusable by any European provider and to become a shared best practice.

Last but not least, Clever Cloud helps reveal and retain local talent in Europe, creating the European technologies of today and tomorrow.

SecNumCloud, ensuring the highest level of data security

Clever Cloud is currently undergoing SecNumCloud qualification on its own infrastructure. This certification attests to the highest possible level of security. You can already use Clever Cloud on Cloud Temple’s SecNumCloud-certified infrastructure.

Clever Cloud thus already complies with the legal criteria defined by the French National Agency for Information Systems Security (ANSSI) in the SecNumCloud standard.

Frequently asked questions about sovereign cloud

What is a sovereign cloud?

A sovereign cloud is a cloud service whose data, infrastructure and operation fall under a controlled legal framework, with no exposure to extraterritorial legislation. Sovereignty does not depend only on where data is stored, but on the law that applies to the operator, its ownership structure and its control over the operational chain.

Is a sovereign cloud limited to hosting data in France or Europe?

No. Hosting data on European soil is not enough to place it beyond the reach of extraterritorial legislation. A provider controlled by a U.S. entity falls under U.S. law regardless of where its datacenters are located. Location is a necessary condition, not a sufficient one.

Is Clever Cloud subject to the CLOUD Act or FISA?

No. The CLOUD Act and Section 702 of FISA apply to providers that fall under United States jurisdiction, regardless of where the data is stored. Clever Cloud is a French company, established in Europe, whose capital and head office are European and which has no subsidiary in the United States: it does not fall under U.S. jurisdiction and is therefore not exposed to these laws.

How can you check whether a cloud is genuinely sovereign?

Four criteria are verifiable by the customer: the operator’s ownership and governance, the absence of exposure to extraterritorial legislation, control over the software technologies used, and compliance with European law. Security certifications such as ISO 27001, HDS or SecNumCloud attest to a level of rigor, but they do not replace these criteria.

Sovereign cloud and health data hosting: what is the link?

HDS certification and protection against extraterritorial legislation are two distinct requirements: a hosting provider can be HDS-certified while still falling under U.S. law. Clever Cloud is certified HDS across the 6 activities of the standard (certificate no. FR094504, valid until 19 December 2027) and is not exposed to extraterritorial legislation. Health data hosting at Clever Cloud takes place within a certified scope, on our certified regions in France.

Is a sovereign cloud always SecNumCloud certified?

No. SecNumCloud is a highly demanding security qualification issued by ANSSI, but sovereignty mainly rests on legal, ownership and governance criteria. An offering can be sovereign without being SecNumCloud-qualified. The qualification is, however, required for certain uses, notably hosting sensitive central-government data under the “Cloud at the centre” doctrine.

Is a European cloud necessarily sovereign?

No. A cloud can be operated in Europe while still being subject to extraterritorial laws if it depends on a non-European player. An offering presented as sovereign may rely on European infrastructure while remaining under non-European legal control.