Is Bleu GDPR compliant?

No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Bleu itself publishes, each answer linked to its source and the date we read it.

How does Bleu transfer personal data out of the EU?

We found no entry for Bleu on the official Data Privacy Framework List.

Does Bleu offer EU data residency?

The EU is the default region for this vendor.

Bleu

Cloud infrastructure · bleucloud.fr · last read 2026-11-09

At a glance

Is Bleu GDPR compliant?: No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Bleu itself publishes, each answer linked to its source and the date we read it.
Is Bleu ISO 27001 certified?: Bleu states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. In Bleu's words (in French): “Les services de Bleu sont déjà certifiés ISO 27001 et HDS.” We read this on 2026-11-09. Source and date
How does Bleu transfer personal data out of the EU?: We found no entry for Bleu on the official Data Privacy Framework List. Source and date
Does Bleu offer EU data residency?: The EU is the default region for this vendor. Source and date

The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.

Identity

Legal entity	Bleu
HQ	FR
Parent company	—
Ultimate ownership	FR
EU contracting entity	Bleu
LEI	9695008DMOHXXZ7NDO72
US CLOUD Act reach	No US company in the ownership chain on record
Source	bleucloud.fr · 2026-11-09

Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.

The company that operates Bleu, who owns it and which law its contract names, beside the other sovereign offerings: who operates each sovereign cloud, under which law.

Bleu data residency

Region	EU data location	Minimum plan	Source	Observed
EU	EU by default	—	bleucloud.fr	2026-11-09

EU: The document says all of Bleu's datacenters are located in France, so customer data stays in the EU without the customer choosing it. No plan or price is mentioned.

The same question for every vendor: where SaaS vendors store EU data.

What Bleu says about its sovereign cloud, beside the other offerings: sovereign clouds.

Subprocessor chain

No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.

Processing terms

No data processing agreement read yet.

These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.

Assurance

Is Bleu ISO 27001 certified?

Bleu states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. We read this on 2026-11-09.

Claimed “Les services de Bleu sont déjà certifiés ISO 27001 et HDS.” (in French)

Source: bleucloud.fr, 2026-11-09

Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.

Scheme	Status	Scope	Source	Observed
HDS	Claimed	Les services de Bleu	bleucloud.fr	2026-11-09
ISO 27001 · ISO27001	Claimed	Les services de Bleu	bleucloud.fr	2026-11-09

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.

Official registers

Register	Offering, as the register names it	Status	Level	Valid until	Observed
Global LEI Index (GLEIF)	BLEU · BLEU	ISSUED	FR	2027-04-28	2026-11-09

ACN qualified cloud (Italy): checked 2026-11-09, no entry under Bleu
DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Bleu
Data Privacy Framework List (US): checked 2026-11-09, no entry under Bleu
ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Bleu
EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Bleu
FedRAMP Marketplace (US): checked 2026-11-09, no entry under Bleu
SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Bleu

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Documents

What we read, how it was disclosed, and when.
Document	Disclosure	Transcription	HTTP	Observed
certifications	Public	full	200	2026-11-09
identity	Public	full	200	2026-11-09
residency	Public	full	200	2026-11-09

History

Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.

Every reviewed change across the registry, newest first: vendor changes.