SecNumCloud: every qualified cloud service on ANSSI's list

ANSSI, France's national cybersecurity agency, qualifies cloud services under SecNumCloud and lists them in its catalogue. The edition updated on 27 October 2026 lists 30 services from 13 providers. Here is each one as ANSSI lists it, with the decision behind it and the version of the requirements that decision cites. We last read the catalogue on 9 November 2026 and have kept every edition since 9 October 2026.

The qualified services

Type is the column ANSSI marks: software, platform, container or infrastructure as a service (SaaS 17, PaaS 2, CaaS 1, IaaS 12). The decision number links the decision PDF the catalogue links. "Edition cited" is the version of the SecNumCloud requirements named in that decision, read on 9 November 2026. We hold no copy of decision 559 (OVH Bare Metal Pod): the catalogue's link for 559 returned HTTP 404 on 9 November 2026, so no edition is shown. A provider name links to its page here where the registry follows it.

Which edition: version 3.2

The catalogue does not say which version of the requirements a service was qualified against; each decision does, in its preamble. 29 of the 30 decisions cite the same one, the « référentiel d'exigences applicables aux prestataires de services d'informatique en nuage (SecNumCloud), version 3.2 du 8 mars 2022 »: version 3.2 of the requirements for cloud service providers, dated 8 March 2022. That includes the oldest decisions on the list, from 30 November 2023, and the newest, from 22 September 2026.

29 of the decisions also state, in their article 4, that the service meets recommendation R9 of the French State's cloud doctrine, « et notamment qu'il offre une protection vis-à-vis du droit extra-européen »: in particular, that it offers protection from non-European law. Each decision ends with an annex of conditions of use under which the qualification holds. For Outscale's IaaS Cloud on Demand, for example, access through mobile apps is not covered: « l'accès des utilisateurs au service via des applications mobiles n'est pas couvert par la qualification » (decision 2118). Read the annex of the decision for the service you use.

Ending within four months

The end date is the decision's own. A renewal appears as a new decision with a new number, so until the catalogue lists one, this is the date in force.

What changed on the list

We have read the catalogue 8 times since 9 October 2026, across 3 editions (updated 15 September 2026, 16 October 2026 and 27 October 2026). No service has left the list in that time.

• 2026-10-18: added, Ecritel, “Ecritel Secure Backup (SaaS)”, SaaS, qualified from 2026-09-22 (edition updated 2026-10-16).
• 2026-10-18: added, Ecritel, “Ecritel Secure Cloud (IaaS)”, IaaS, qualified from 2026-09-22 (edition updated 2026-10-16).
• 2026-10-18: added, Orange Business Services, “Cloud Avenue Secnum Dynamic”, IaaS, qualified from 2026-09-22 (edition updated 2026-10-16).
• 2026-10-18: Cloud Temple, decision 3389, service name changed from “IAAS - Secure Temple (IaaS Vmware, IaaS Opensource, stockage objet S3, brique HSM-KMS, Baremetal)” to “IAAS - Secure Temple (IaaS Vmware, IaaS Opensource, stockage objet S3, brique HSM-KMS, Baremetal, VPC, VMI)”.
• 2026-10-18: Cloud Temple, decision 3389, type marked changed from “PaaS, IaaS” to “IaaS”.

Providers in qualification

ANSSI's SecNumCloud page also lists qualifications under way. It writes that only the projects providers agreed to make public appear, and that a suspended project is removed: « Seuls apparaissent les projets de qualification que les prestataires ont accepté de rendre publics. » None of these is qualified for the service named. Read on 9 November 2026.

The registry's vendors

The registry checks all 160 vendors it follows against ANSSI's list each week. 3 have services on it: 3DS Outscale, OVHcloud and S3NS. What each says about SecNumCloud on its own certification page:

• 3DS Outscale lists “SecNumCloud 3.2” (read 2026-10-08). Scope as recorded: qualification issued by ANSSI for cloud services.
• OVHcloud lists “ANSSI SecNumCloud” (read 2026-10-05). Scope as recorded: French ANSSI qualification for trusted cloud service providers.
• S3NS lists “SecNumCloud 3.2” (read 2026-10-08). Scope as recorded: PREMI3NS, the Trusted Cloud by S3NS, a public cloud solution based on Google Cloud technology; qualified by ANSSI (French National Cybersecurity Agency). Services list marks Cloud Run, Secret Manager and Access Transparency as "QUALIFICATION IN PROGRESS".

S3NS is a Thales subsidiary that operates Google Cloud technology; ANSSI lists the service under Thales Cloud Sécurisé, and the qualification covers that service, not Google Cloud.

What SecNumCloud is

SecNumCloud is ANSSI's qualification for cloud service providers. The catalogue gives its legal basis: providers « sont qualifiés par l'ANSSI au titre de l'article 14 du décret n°2015-350 », under article 14 of decree no. 2015-350. A conformity assessment body evaluates the service against the requirements, and ANSSI decides. The decision names one service of one provider, a type, an end date and conditions of use, which is why a provider can hold several decisions and why a company name on the list says nothing about its other services.

Questions

Which cloud providers are SecNumCloud qualified?

ANSSI's catalogue, updated 27 October 2026, lists 30 qualified services from 13 providers: Cegedim, Cloud Solutions, Cloud Temple, Ecritel, Index Education, Numspot, Oodrive, Orange Business Services, Outscale, OVH, Thales Cloud Sécurisé, Whaller and Worldline. The qualification is given to a named service, not to the provider as a whole.

Which version of SecNumCloud applies?

Version 3.2 of the requirements, dated 8 March 2022. 29 of the 30 qualification decisions on the list cite it; for OVH Bare Metal Pod we hold no legible copy of the decision. The catalogue itself does not print the version; the decisions do.

How long is a SecNumCloud qualification valid?

Each decision gives its own end date. 24 of the 30 services on the list run three years from the start date to the end date; 6 run shorter. 2 end within four months of our last reading: Outscale IaaS Cloud on Demand (30 November 2026) and OVH Hosted Private Cloud powered by VMware (29 December 2026).

Is a provider "in qualification" qualified?

No. ANSSI lists 14 providers whose qualification is under way, only those that agreed to be named, and removes a project that is suspended. Being on that list says a qualification was applied for, not that it was granted.

How can I check a SecNumCloud claim?

Find the exact service, not just the company, in ANSSI's catalogue, then open the decision it links. The decision gives the service's name, its type, its end date and, in an annex, the conditions under which the qualification is valid.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “SecNumCloud qualified services, from ANSSI's catalogue”, https://eucsoft.com/en/certifications/secnumcloud/, data read up to 2026-11-09.

How this was read

Each week the registry stores ANSSI's catalogue PDF as published and reads section 3.3.1, the qualified cloud services: provider, service, the type marked, the two dates and the decision number. The decision PDFs it links were fetched on 9 November 2026; most are scans, read with OCR, so the edition is taken from the text only where the version and its date can be read in full. Matching a service to a vendor here is done by a person, in the vendor's file, never by name similarity. Other national schemes (ENS, C5, HDS) are on the certifications page; the international standards: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, BSI C5, TISAX, SOC 2. Full method on the methodology page.