Definition
Cloud de Confiance (Trusted Cloud) is a French government qualification framework for cloud computing services that meet specified sovereignty, security, and data protection requirements — ensuring that sensitive government and enterprise data stored on these platforms remains under French and European legal jurisdiction, protected from extraterritorial legal access by foreign governments (particularly US authorities under the CLOUD Act). A Cloud de Confiance provider must hold SecNumCloud certification from ANSSI (the French National Cybersecurity Agency) — the highest cloud security certification in France — and must be structured so that no foreign entity can be legally compelled to access data held on the platform, meaning US-headquartered companies (Amazon, Microsoft, Google) cannot qualify in their standard corporate structures, even if they operate data centers in France.
Role in France 2030
Cloud de Confiance is a cornerstone of France 2030’s digital sovereignty strategy, directly implementing the principle that sensitive French government and critical infrastructure data must be processed and stored under guaranteed French jurisdiction. The framework was developed in parallel with France 2030’s announcement, reflecting the Macron government’s determination to operationalize digital sovereignty rather than merely declare it as a principle.
The practical consequence of Cloud de Confiance is a market segmentation that protects French sovereign cloud providers from direct competition by US hyperscalers (Amazon Web Services, Microsoft Azure, Google Cloud) in the most sensitive data workloads. French government ministries, defense contractors, healthcare operators handling patient data, and financial institutions holding regulated data are directed toward Cloud de Confiance-certified providers for their most sensitive workloads. The three primary Cloud de Confiance providers — OVHcloud (Roubaix), Scaleway (Iliad group, Paris), and Outscale (Dassault Systèmes subsidiary) — are France 2030 beneficiaries receiving infrastructure investment support, cloud R&D co-funding, and preferential procurement direction.
A nuanced aspect of the Cloud de Confiance framework is its relationship to large US cloud providers. ANSSI created a qualification pathway (the “cloud de confiance” operating model) that allows US technology companies to license their cloud software to French entities operating the infrastructure — in theory enabling Microsoft Azure OpenAI Service or AWS infrastructure to be offered through a French legal entity with no US parent access to data. Microsoft’s arrangement with Capgemini (its “Cloud de Confiance” offering) and Google’s exploration of similar structures represent the US hyperscalers’ attempt to participate in this protected market through structural engineering rather than direct operation. France 2030 must balance protecting French sovereign cloud operators while avoiding creating a legal fiction that provides the appearance of sovereignty without the substance.
France 2030’s investments in OVHcloud and Scaleway extend beyond government data hosting. Both companies are developing AI infrastructure — GPU cloud computing for AI training and inference — that is essential for France’s sovereign AI strategy. Mistral AI, France’s flagship large language model company, uses French GPU cloud infrastructure for model training; maintaining a competitive French GPU cloud market ensures that French AI development does not depend exclusively on US hyperscaler GPU allocations.
Key Facts
- SecNumCloud certification: ANSSI’s highest cloud security standard; required for Cloud de Confiance qualification; excludes providers with foreign legal jurisdiction vulnerabilities
- CLOUD Act risk: US Cloud Act (2018) enables US authorities to compel US-headquartered companies to provide data stored anywhere globally — the fundamental risk that Cloud de Confiance addresses
- Primary providers: OVHcloud (largest EU cloud provider by revenue), Scaleway (Iliad subsidiary), Outscale (Dassault Systèmes) — all France 2030 beneficiaries
- French government data policy: sensitive ministries required to use Cloud de Confiance-qualified providers for Restricted and Sensitive data classifications
- GPU cloud: OVHcloud and Scaleway are France 2030’s primary sovereign GPU compute providers, essential for French AI sovereignty alongside the Jean Zay supercomputer
Why It Matters
For investors, Cloud de Confiance creates a durable, regulation-protected market for French sovereign cloud providers — not a temporary government preference but a structural legal framework that prevents US hyperscalers from competing for the most sensitive French government and regulated enterprise workloads. This protection is sustainable because its basis (French jurisdiction over French government data, protection from US extraterritorial law) is politically durable across French political parties and aligned with EU digital sovereignty objectives that are also strengthening.
The size of the protected Cloud de Confiance market is meaningful but bounded: the French government and regulated industries represent a significant portion of total French cloud spending, but the broader commercial cloud market (SMEs, consumer services, most enterprise applications) remains open to global competition. OVHcloud and Scaleway must therefore succeed in both markets — sovereign protected and globally competitive — to achieve the scale that justifies their France 2030 investment. The challenge is that hyperscaler advantages in global scale, product breadth, and marketing budgets remain formidable outside the sovereign protected segment, requiring French cloud providers to differentiate on sovereignty, customer proximity, and pricing rather than product equivalence.