Digital sovereignty and cloud certifications: what SecNumCloud, SEAL and CADA actually mean

Storing your data in the European Union is the first level of every European framework. It is necessary, but not sufficient. Sovereignty rests on three dimensions, all of which must hold.

• Legal. Which law applies to your provider, and above all which law can compel it? A data center in Paris operated by a company subject to US law remains exposed to extraterritorial access requests.
• Operational. Who operates, supports, updates and can cut off the service? Where are the teams, the on-call rotations, the encryption keys? Does the service survive the withdrawal of a non-European third party?
• Technological. What is the stack made of (hardware, hypervisor, software, identity, DNS)? Is it open, auditable and substitutable, or does it depend on proprietary components controlled elsewhere?

The European Commission's Cloud Sovereignty Framework and the draft CADA regulation both use exactly this breakdown. An offer that ticks localisation alone, while leaving legal compulsion and operational control outside Europe, is not sovereign.

The heart of the matter is not where the data sits, but who can demand it or cut off the service.

• CLOUD Act (2018). It lets US authorities compel a provider subject to US law to hand over data it controls, wherever that data is stored, including a European region.
• FISA 702 and surveillance. The US surveillance framework is behind the Court of Justice of the EU's Schrems I and II rulings. The 2023 Data Privacy Framework re-frames transfers again, but remains legally contested and politically revocable.
• Risk of shutdown. A sanction, an embargo or a political decision can force a non-European provider to suspend a service.
• Invisible dependencies. Even on a European cloud, identity, DNS, CDN, transactional e-mail, container registries and AI models are often American by default.

The European answer is to move past the binary yes-or-no and measure assurance levels. That is what the SEAL levels and the SecNumCloud qualification are for. For the defensive side of this exposure, see our digital resilience page and the sovereign alternative to the CLOUD Act comparison.

Several frameworks coexist, with very different scopes. Some certify security, others measure sovereignty, others are regulations already in force.

The big picture: France has a demanding but national framework, SecNumCloud, whose official list of qualified providers is authoritative on cyber.gouv.fr. Europe, for its part, failed on EUCS between 2020 and 2026, then changed method with a scoring grid (the Cloud Sovereignty Framework) and a regulation (CADA) rather than a single certification.

The SEAL levels (Sovereignty Effectiveness Assurance Levels) come from the Cloud Sovereignty Framework. They replace the yes-or-no with a scale, from fully non-European control to complete sovereignty.

Where the market stands in 2026: hyperscalers present in a European region typically sit at SEAL-1 or SEAL-2; players with European capital reach SEAL-3; no one reaches SEAL-4 today, since the hardware supply chain remains largely non-European. In April 2026 the European institutions' Cloud III contract ranked its winners on this very scale, with an eligibility threshold set at SEAL-2.

The Cloud and AI Development Act, proposed on 3 June 2026, extends this logic as a regulation, with four assurance levels.

CADA first targets the public sector and EU bodies, with possible extension to essential entities under NIS2. Trilogues and then application are not expected before 2028. Nothing is yet binding on the private sector, but public tenders, banks under DORA and essential operators are already starting to ask for a SEAL level or a SecNumCloud qualification.

The most common confusion pits a hyperscaler present in a European region against a cloud with European capital. Both comply with the GDPR on localisation; they diverge on legal compulsion and control.

This table does not say a hyperscaler is bad: its managed-services catalogue is still broader, and for non-sensitive data localisation can be enough. It says where to set the cursor when legal compulsion matters: sensitive data, public sector, health, essential operators. The right questions to ask any provider, cloud or software, stay the same: who owns the capital, where are the operations, who holds the keys, what hidden dependencies exist, what tested reversibility, and what declared level with what proof.

For the sake of honesty, here is what Bunker and France Nuage actually hold, and what remains an objective. We would rather communicate verifiable facts than display a certification logo we do not have.

• What is acquired and verifiable. Infrastructure hosted in France, GDPR-compliant by default, reversible because built on open source and open standards (Kubernetes, S3, PostgreSQL). Gaia-X alignment. No subprocessor under US jurisdiction on the critical path, hence no exposure to the CLOUD Act.
• What is aligned but not certified. Our information-security management system is aligned with ISO 27001, self-assessed and not third-party certified to date. The detail (security model, statement of applicability for the 93 controls) is published in our trust center.
• What remains an objective. ISO 27001 certification is a medium-term goal, and SecNumCloud qualification a long-term one. We do not claim any ISO 27001, SecNumCloud or HDS certification today.

By design, our platform brings together several properties associated with SEAL-3: European capital and control, an open-source stack end to end, no non-European third party able to cut off the service. We do not, however, claim an audited SEAL level, which is a matter for third-party assessment. That is the distinction this guide defends throughout: ask for the audit reports, not the logos. Our compliance roadmap is detailed on the security and compliance page.