What Is SecNumCloud?
SecNumCloud is a security qualification created by ANSSI, France's national cybersecurity agency, for cloud service providers. It certifies that a cloud provider meets a defined set of technical and organizational security requirements, and — in its current version — that the provider is shielded from non-EU legal jurisdiction, addressing digital sovereignty concerns for sensitive data. SecNumCloud qualification covers areas including access control, cryptography, incident management, personnel security, and supply chain assurance, and requires an audit by an accredited assessor before a provider can advertise the label. It is increasingly referenced or required for hosting sensitive public-sector data, health data, and other regulated workloads in France, and is often compared to Germany's C5 or the EU's proposed cloud certification scheme (EUCS) as part of a broader European push toward sovereign cloud infrastructure.
Why It Matters
SecNumCloud qualification says a great deal about where and under what legal jurisdiction data sits, but it says little about who — or what — can access that data once it's hosted. Every workload migrated to a SecNumCloud-qualified environment still runs on service accounts, API keys, and machine identities that connect applications, backups, and management tools to the cloud platform, and those credentials are exactly where breaches concentrate: 80% of identity breaches now involve a non-human identity (OWASP NHI Top 10, 2025). A sovereign, well-audited cloud infrastructure does not protect against an over-privileged service account or a leaked API key sitting inside it. Organizations choosing SecNumCloud providers for sovereignty or compliance reasons often assume the infrastructure-level qualification also covers their own identity hygiene — it does not. As NIS2 enforcement begins in France on October 1, 2026, entities relying on SecNumCloud infrastructure will still need to independently demonstrate control over the non-human identities operating within it.
How Cydenti Helps
Cydenti gives organizations visibility into the non-human identities — service accounts, API keys, and machine credentials — operating inside their cloud environments, including those hosted on SecNumCloud-qualified infrastructure. It maps which identities exist, what they can access, and where cross-cloud or cross-account exposure creates risk that infrastructure-level qualification alone doesn't address. This complements SecNumCloud's platform-level guarantees with identity-level assurance: knowing not just that the infrastructure is sovereign and audited, but that the credentials running inside it are inventoried, least-privilege, and monitored. For teams building a sovereignty or compliance case around SecNumCloud, that identity layer is worth understanding in more detail.
Explore →Frequently Asked Questions
Does SecNumCloud certify data security or just data location?
Both, but with different weight. SecNumCloud requires meeting technical security controls (access control, cryptography, incident response) and, in its enhanced version, guarantees immunity from non-EU legal jurisdiction over the data. It qualifies the provider's infrastructure and operations — it does not certify how a customer manages identities and access within that infrastructure.
Is SecNumCloud mandatory for all French companies?
No. It's currently required or strongly recommended mainly for public-sector entities, operators of vital importance, and organizations handling specific categories of sensitive or regulated data. Many private companies choose SecNumCloud-qualified providers voluntarily for sovereignty assurance or to simplify compliance with frameworks like NIS2.
Discover the machine identities you didn't know you had
— in 27 minutes, for free.
NIS2 enforcement begins October 1, 2026. The Audit Flash delivers your complete NHI exposure snapshot — service accounts, orphaned credentials, OAuth grants, AI agents — with a first report in 3 hours. No commitment.
No commitment • No credit card • Data hosted in Europe • Response within 24h