Hosting in France: why and how to migrate to a sovereign cloud
Between GDPR and the US CLOUD Act, hosting data in France is becoming a strategic issue. An overview of the sovereign alternatives and of the migration itself.
The question of data sovereignty is no longer reserved for government bodies and large corporations. More and more smaller and mid-sized companies are asking where their data sits – and they are right to.
Why the question is worth asking
GDPR imposes clear obligations
The General Data Protection Regulation requires the personal data of European residents to be processed under compliant conditions. Hosting data with an American provider exposes you to real legal risk, even if the servers are physically in Europe.
The CLOUD Act creates a legal contradiction
The CLOUD Act (a 2018 US law on access to data) allows the American authorities to demand access to data stored by American companies, whatever the country it is hosted in. That means your data hosted with the large American providers (AWS, Google Cloud, etc.) is potentially accessible to the US authorities, even from a data centre in Paris.
Sector requirements are tightening
Healthcare (HDS, the French certification for hosting health data), finance, defence, local authorities: many sectors now require hosting certified SecNumCloud (a security certification issued by ANSSI, the French national cybersecurity agency) or, at a minimum, hosting on French soil.
The French and European alternatives
| Provider | Key strengths | Certification |
|---|---|---|
| OVHcloud | Broad IaaS/PaaS range (infrastructure and platform as a service), data centres in France | SecNumCloud (in progress on some products) |
| Scaleway | Modern interface, good value for money, Paris and Amsterdam | – |
| o2switch | 100% French host, a single all-inclusive plan | Data centres in Clermont-Ferrand |
| Clever Cloud | French PaaS, simplified deployment | Data centres in France |
How to approach the migration
1. Identify the data involved
Not all of your data carries the same level of sensitivity. Start by mapping:
- Personal data (customers, employees, patients)
- Sensitive business data (contracts, intellectual property)
- Non-sensitive data (brochure website, public documentation)
2. Consider a hybrid approach
Migrating to a sovereign cloud does not necessarily mean migrating everything. A hybrid approach is often the sensible one:
- Sovereign cloud: personal data, critical business data
- International cloud: non-sensitive collaboration tools, CDN, global services
3. Anticipate the cost of leaving
American providers charge egress fees (charges for moving your data out) that can be significant. Build those costs into your migration budget. Worth noting: OVHcloud and Scaleway apply more favourable exit policies.
4. Plan the transition
Work in stages, starting with the least critical services. Allow for a period of running in parallel to validate performance and reliability before you switch off the old hosting.
A strategic investment
Migrating to sovereign hosting represents an up-front effort, but it is also a powerful commercial argument with customers and partners who care about how their data is protected. It is a choice that strengthens trust – and compliance.