3DS Outscale
Cloud infrastructure · en.outscale.com · last read 2026-10-12
Identity
| Legal entity | OUTSCALE |
|---|---|
| HQ | FR |
| Parent company | GROUPE INDUSTRIEL MARCEL DASSAULT |
| Ultimate ownership | FR |
| EU contracting entity | — |
| LEI | 969500J8NAAJIUFQUC34 |
| US CLOUD Act reach | No US company in the ownership chain on record |
| Source | en.outscale.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | docs.outscale.com | 2026-10-08 |
EU: The document lists public Regions in France (eu-west-2 and cloudgouv-eu-west-1) and says data remains in the Region where you stored it. It names no plan or cost for using them.
Subprocessor chain
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · fr.outscale.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | Processor informs the Controller of any planned addition or replacement of further processors; no notice period or method stated |
| Breach notification | as rapidly as possible once aware, at the latest within 48 hours, by email |
| Audit | Audit by a third-party auditor approved by Outscale, at most once a year and at the customer's cost, after a reasoned request on matters not covered by labels and certifications. Outscale also provides documents showing compliance with GDPR Art. 28. |
| Audit | Client supervises the processing, including through audits and inspections of Outscale; no scope, frequency or cost stated |
| Audit | Customer may conduct penetration testing (itself or via an independent third-party auditor not linked to Outscale's competitors), with one month's prior notice and a support ticket; Outscale may refuse the auditor on objective independence grounds; listed actions excluded |
| Audit | documentation to prove compliance; audits under article 17 "Audits", including inspections by the Client or an auditor it appoints |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| HDS | Claimed | hosting for health data on the OUTSCALE Cloud | en.outscale.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | across its entire company and Cloud infrastructure | en.outscale.com | 2026-10-08 |
| ISO 27017 · ISO27017 | Claimed | — | en.outscale.com | 2026-10-08 |
| ISO 27018 · ISO27018 | Claimed | protection measures for personal data processed in the cloud | en.outscale.com | 2026-10-08 |
| CISPE Code of Conduct | Claimed | customers' data stored and processed exclusively within the European Economic Area | en.outscale.com | 2026-10-08 |
| SecNumCloud 3.2 | Claimed | qualification issued by ANSSI for cloud services | en.outscale.com | 2026-10-08 |
| TISAX | Claimed | hosting for sensitive data in the automotive sector | en.outscale.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Outscale, Inc | Inactive - Lapse | non-HR data | 2020-09-29 | 2026-10-09 |
| Global LEI Index (GLEIF) | OUTSCALE · OUTSCALE | ISSUED | FR | 2026-11-29 | 2026-10-09 |
| SecNumCloud qualified services (ANSSI, France) | Outscale IaaS Cloud on Demand · Outscale IaaS Cloud on Demand | qualified | SecNumCloud | 2026-11-30 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under 3DS Outscale; OUTSCALE
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under 3DS Outscale; OUTSCALE
- Data Privacy Framework List (US): checked 2026-10-12, 1 entry under 3DS Outscale; OUTSCALE
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under 3DS Outscale; OUTSCALE
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under 3DS Outscale; OUTSCALE
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, 1 entry under 3DS Outscale; OUTSCALE
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| 3DS Outscale (service) | — | Service only | unknown | en.outscale.com | 2026-10-11 |
Vulnerability reporting: the well-known path returns an HTML page, not a security.txt (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.