Aller au contenu

Infrastructure & security

SecNumCloud-qualified cloud and GPUs: AI sovereignty becomes a product line

Orange Business earns a second SecNumCloud qualification, with GPU servers. What that signals—and how to choose your sovereignty level.

  • 11 OCTOBER 2026
  • 2 MIN READ
  • CITED SOURCES

The essentials

  • On 7 October 2026, Orange Business announced a second ANSSI SecNumCloud qualification: dedicated resources, two data centres in France, optional active-active mode, and GPU servers for AI.
  • The SecNumCloud 3.2 reference framework, which adds protection against non-European laws, was approved by decree on 12 August 2026, reports Le Monde Informatique.
  • SecNumCloud is only one sovereignty tier among others: it fits the most sensitive data, not every need.

The announcement

On 7 October 2026, Orange Business announced a new SecNumCloud qualification from ANSSI for an offering called Cloud Avenue SecNum Dynamic. It adds to a first qualification obtained in July 2025. According to Le Monde Informatique, resources are dedicated to each customer and physically separated from other environments, spread across two data centres in Val-de-Reuil and Chartres, with the option of active-active operation between the two sites.

Another distinctive point: GPU servers dedicated to AI, for training and inference. The operator sees the convergence of two strong trends: demand for AI compute, and the wish to keep data and processing in highly controlled environments.

What SecNumCloud guarantees, and what it does not say

SecNumCloud is a qualification issued by ANSSI to cloud providers. Since version 3.2, it includes criteria to protect against non-EU law: providers headquartered outside the Union, or capital-dependent on non-European actors, are no longer eligible. Being SecNumCloud 3.2 qualified effectively aligns with the French state’s “trusted cloud” doctrine.

What the qualification does not say is whether it is the right level for you. It targets the most sensitive data first, including state and critical-operator data. It is not mandatory for every organisation.

Three sovereignty levels, three answers

  1. 01Qualified cloud (SecNumCloud): for the most sensitive data, when immunity to non-European laws must be attested by ANSSI.
  2. 02Private or on-premises hosting: dedicated servers at a trusted host or on your premises. Control is maximal; operations are your responsibility.
  3. 03Reasoned hybrid: on-premises for sensitive data and AI, public cloud for the rest, with written reversibility.

Sources

This note was drafted with AI tools from the cited sources, then reviewed and published under the responsibility of Jordan FOUASSIER, publication director. We summarise the facts and add our reading; source text and images are not reproduced. An error? Write to contact@aigyrosgroup.com.

Infrastructure & security

REACTIV: ANSSI’s tally of state data breaches—and what it means for your apps

ANSSI's first REACTIV update: 99 reported data breaches since August, with Metabase flaws and weak MFA in the lead. What SMBs should take from it.

Read the note · 3 min

Infrastructure & security

Ransomware: SMBs are the primary target, and so are your backups

ANSSI reports 48% of 2025 ransomware victims are SMBs. Why backups are often the first thing an attacker tries to destroy.

Read the note · 2 min

Infrastructure & security

Nextcloud: CERT-FR flags five flaws — which versions to patch

CERT-FR advisory (9 Oct): five Nextcloud bulletins (8 Oct)—privilege escalation, remote DoS, data exposure. Patch Server, Team Folders, and Collectives.

Read the note · 3 min

Prendre contact

Does this affect your environment?

Describe your context. We reply with an analysis of what it means for you, not a catalogue.

Talk to an expertAll journal notes