Glossary of cloud sovereignty.

A

ANSSI

Agence nationale de la sécurité des systèmes d'information (French National Cybersecurity Agency). The French cybersecurity authority; it draws up the reference frameworks (SecNumCloud) and qualifies sovereign providers.

AWS (Amazon Web Services)

The world's leading cloud provider (a subsidiary of Amazon). More than 200 services, 33 regions, around 32 per cent of the IaaS-PaaS market. Subject to US law. Dedicated page →

Azure

Microsoft's public cloud, second in global market share (around 23 per cent). Tightly integrated with the Microsoft 365 and Active Directory ecosystem. Dedicated page →

B

Bare metal

A dedicated physical server rented without a hypervisor layer, as opposed to shared VMs. Delivers stable performance, useful for databases and sensitive workloads.

Bleu

Orange-Capgemini joint venture selling in France a cloud offer based on Microsoft Azure technology, under French governance and seeking SecNumCloud. French governance and technical qualification do not neutralise US law (FISA 702, CLOUD Act) as long as the Microsoft software stack, which ANSSI cannot audit, is embedded.

BYOK (Bring Your Own Key)

A model in which the customer generates and holds the encryption keys; the provider has no access to them. HYOK variant: the key never leaves the customer's infrastructure.

C

CLOUD Act

US law of 2018 (Clarifying Lawful Overseas Use of Data Act). Allows US authorities to require a provider subject to US law to hand over data stored outside the USA. Dedicated page →

Sovereign cloud

A cloud service operated under European jurisdiction with no capital, contractual OR technological dependency on a foreign power. SecNumCloud qualification covers its technical and organisational side, but is not enough on its own: a US software stack (even located in France) remains exposed to FISA 702 / CLOUD Act.

CNIL

Commission nationale de l'informatique et des libertés. The French personal data protection authority; it enforces the GDPR.

Confidentiality

The property ensuring that data is accessible only to authorised people. Relies on encryption, access management and classification.

Container

An isolated execution unit sharing the host machine's operating system kernel. Docker and Kubernetes are the de facto standards. Lighter than a VM but with weaker isolation.

CSP (Cloud Service Provider)

A provider of cloud services. Covers IaaS, PaaS, SaaS and mixed combinations.

D

Data centre

A physical hosting facility housing servers and network equipment. Classified by Uptime Institute redundancy level (Tier I to IV).

DataOps

A methodology that applies DevOps principles to data management: automated pipelines, testing, observability, governance.

DINUM

Direction interministérielle du numérique (Interministerial Digital Directorate). The French body that steers the digital transformation of the State and publishes the Cloud au Centre doctrine.

DORA

Digital Operational Resilience Act, a 2022 European regulation that requires financial entities to achieve a level of operational resilience and to oversee critical ICT third-party providers.

DPO

Data Protection Officer. A role mandatory under the GDPR for most organisations processing personal data. Independence and reporting to the highest level are required.

E

Edge computing

Processing data as close as possible to its source (sensor, gateway, regional data centre) rather than in a central cloud. Reduces latency and bandwidth consumption.

EHDS

European Health Data Space. A European regulation creating a common health data space with primary (care) and secondary (research, regulation) purposes.

ENISA

European Union Agency for Cybersecurity. Among other things, it leads the work on the future EUCS cloud certification scheme. Dedicated page →

EUCS

European Cybersecurity Certification Scheme for Cloud Services. A European certification scheme being finalised, structured in three assurance levels. Dedicated page →

Extraterritoriality

The ability of a law to produce effects beyond the borders of the State that adopted it. The CLOUD Act and FISA 702 are emblematic examples in US law.

F

Federated cloud

An architecture that federates several clouds (often sovereign ones) under common orchestration, with interoperability standards. GAIA-X promotes this approach.

FinOps

The practice of economic governance of the cloud: cost visibility, allocation by team, continuous optimisation, dialogue between finance, tech and business.

FISA Section 702

A section of the US Foreign Intelligence Surveillance Act that authorises targeted surveillance of non-US persons outside the USA through providers subject to US law. Dedicated page →

G

GAIA-X

A European initiative (launched in 2019) aiming to federate a European cloud infrastructure around common standards of sovereignty, portability and transparency. Dedicated page →

GCP (Google Cloud Platform)

Google's public cloud. Third in global market share (around 11 per cent), strong on data and AI workloads (BigQuery, Vertex AI, Kubernetes). Dedicated page →

Governance

The set of rules, procedures and bodies that guide an organisation's cloud choices: procurement, security, compliance, architecture, data.

H

HDS (Health Data Hosting)

A mandatory French certification for hosting personal health data (Hébergeur de Données de Santé). Issued after an audit by an accredited body.

HSM (Hardware Security Module)

A tamper-proof hardware module used to generate, store and use cryptographic keys. Essential for any serious BYOK or HYOK.

Hybrid

An architecture combining public cloud, private cloud and on-premise infrastructure, with consistent orchestration and data plane across the segments.

Hyperscaler

A cloud provider operating a global infrastructure at very large scale: AWS, Azure, GCP. Three players account for around two thirds of the global market. Dedicated page →

I

IaaS (Infrastructure as a Service)

A cloud model delivering virtualised compute, storage and networking on demand. The customer manages the OS, middleware and applications.

Legal immunity

The documented ability of a service to refuse, or not to be legally compelled, to hand over data to a foreign authority. A central criterion of SecNumCloud.

ISO 27001

International standard for information security management. The basis of most sector certifications, but it does not cover sovereignty requirements.

J

Jurisdiction

The law applicable to an entity, determining which authorities can issue orders concerning its operations and data. Read together with the chain of ownership.

K

KMS (Key Management Service)

A cryptographic key management service offered by CSPs. BYOK and HYOK variants depending on how much control the customer retains.

Kubernetes

Open-source container orchestrator (CNCF). The de facto standard for deploying microservices, supported by all hyperscalers and most European clouds.

L

Data location

The actual physical location of primary data, replicas, logs and metadata. To be distinguished from the advertised region, which may hide secondary flows.

M

Multi-cloud

A strategy spreading workloads across several CSPs to reduce dependency, optimise costs and draw on the strengths of each player.

N

NIS2

European directive of 2022 (Network and Information Security 2). Strengthens cybersecurity obligations for essential and important entities. National transposition under way. Dedicated page →

NSA

The US National Security Agency. An intelligence agency that relies in particular on FISA Section 702 (PRISM and Upstream programmes) for its operations on foreign communications.

O

OpenStack

Open-source cloud infrastructure platform. The technical basis of several European clouds (OVHcloud, Scaleway, Cloud Temple). An alternative to proprietary stacks.

Outscale (3DS Outscale)

A subsidiary of Dassault Systèmes. The first French provider qualified SecNumCloud for the IaaS scope.

OVHcloud

The leading European provider by IaaS market share. Listed in Paris, French governance, dedicated offer qualified SecNumCloud.

P

PaaS (Platform as a Service)

A cloud model delivering managed runtime environments (databases, runtimes, message queues). The customer focuses on application code.

BCP (Business Continuity Plan)

Procedures and infrastructure ensuring the continuity of critical operations in the event of a major incident (PCA in French). To be distinguished from the DRP, which covers disaster recovery.

Pseudonymisation

GDPR processing that replaces direct identifiers with reversible pseudonyms, managed separately. It does not remove the personal nature of the data.

Q

SecNumCloud qualification

Certification issued by ANSSI. Three historical levels (Essentiel, Avancé, Élevé), now unified in the 3.2 framework with a requirement for extraterritorial immunity and European capital control. Dedicated page →

R

Cloud region

A geographical area grouping several availability zones operated by a CSP. Choosing an EU region is a necessary but not sufficient condition for sovereignty.

Reversibility

The ability to leave a provider without prohibitive cost: open standards, documented export formats, no proprietary lock-in. A criterion in the NextHop scoring. Dedicated page →

GDPR

General Data Protection Regulation (EU, 2016). The unified European framework for processing personal data. Fines can reach 4 per cent of global turnover.

S

SaaS (Software as a Service)

An application delivered as a service; the customer manages neither the infrastructure nor the application. Microsoft 365, Salesforce and Google Workspace are the emblematic examples.

Scaleway

A subsidiary of the Iliad group. A European cloud based in Paris with its own data centres in France and the Netherlands. IaaS-PaaS offer on an open-source stack.

Schrems II

CJEU judgment of July 2020 that invalidated the Privacy Shield. It explicitly cites FISA 702 as incompatible with European data protection standards. Dedicated page →

S3NS

Thales-Google joint venture selling an offer based on Google Cloud technology, seeking SecNumCloud. As with Bleu, the French structure and technical qualification do not neutralise US law as long as the Google software stack, which cannot be audited, is embedded.

SecNumCloud

ANSSI's TECHNICAL and organisational framework and qualification (security, EU operations, PASSI audit). Version 3.2 (2022); it requires contractual immunity clauses and European capital control, but a qualification does not neutralise US law (FISA 702 / CLOUD Act) if the software stack is American. Dedicated page →

Digital sovereignty

The ability of an actor (State, organisation, individual) to control its digital infrastructure, its data and its dependencies. Six dimensions in the NextHop scoring. Dedicated page →

T

Tier IV

The highest Uptime Institute classification level for a data centre. Fault-tolerant architecture (2N+1), target availability of 99.995 per cent.

Trusted Cloud

A French (then European, via Cloud de Confiance) concept designating a cloud service whose security and operations are attested by a recognised qualification (SecNumCloud, EUCS High). Note: these qualifications cover the technical side, not a guaranteed legal immunity against US law.

V

Virtualisation

A technique for running several isolated operating systems on the same hardware via a hypervisor (KVM, VMware ESXi, Hyper-V).

VPC (Virtual Private Cloud)

An isolated virtual network within a cloud region. Lets you define your own subnets, routing rules and firewalls, as in a private data centre.

Z

Availability zone

A subset of a cloud region (one or more nearby data centres). Multi-AZ redundancy is the foundation of a high-availability architecture.

Missing a term?