Sovereign Cloud: How to Choose a Provider Without Getting Locked In

What does sovereign cloud cover?

The term has become common but it does not refer to a single label. For a business, sovereignty plays out on three levels: where data is stored, who operates it and which law applies if a foreign authority requests access.

Hosting in France or elsewhere in Europe does not, on its own, protect you from extraterritorial laws. A sovereign cloud is judged on its jurisdiction as much as on the location of its servers.

That is the purpose of SecNumCloud, the framework run by ANSSI, the French National Cybersecurity Agency. It qualifies cloud offerings against security requirements but also legal criteria: a registered office in the European Union, operational autonomy and data located on EU territory.

SecNumCloud: for which data?

Not all your data needs the same level of protection. Putting all of it in a qualified cloud would be costly; leaving all of it with a non-European hyperscaler can be risky.

The first step is therefore to classify your data by sensitivity. Health data, strategic information, data linked to defence or the public sector… these categories often justify qualified hosting. Other, less sensitive workloads can stay on more standard services.

According to ANSSI’s SecNumCloud FAQ, the qualification is valid for 3 years with annual surveillance audits. It covers IaaS, PaaS, CaaS and SaaS models: infrastructure, platform, containers or software delivered “as a service”.

This classification has another benefit: it forces you to know where your data actually lives. That is often the longest part of the work and the one that brings the most clarity.

The right level of sovereignty depends on the data, not on a single choice for your whole information system.

How can you avoid vendor lock-in?

The real risk is not always the provider you chose but being unable to change it. Proprietary formats, managed services that are hard to reproduce elsewhere, data egress fees: dependency often sets in without anyone deciding it.

Reversibility starts with the contract. It sets out how you get your data back, in which format and within what timeframe. It also defines the support the provider must give during the transition.

The European framework is moving in the same direction. The EU Data Act requires providers to make switching between cloud services easier and abolishes switching charges from 12 January 2027.

A cloud contract should also be negotiated for the day you want to leave.

Reversibility is not just a contract clause. It needs testing. A dry-run migration of a non-critical application shows whether data comes out in a usable format and whether your teams can rebuild the environment elsewhere. Better to find out during an exercise than in the middle of a crisis.

Do you have to choose between sovereign and hyperscaler?

Not necessarily. Many businesses combine several clouds: a qualified environment for sensitive data and broader services for the rest. This multi-cloud approach needs an architecture designed upfront.

It has value beyond sovereignty: spreading workloads across several environments limits the impact of an outage or a change in a provider’s commercial terms. It also strengthens your negotiating position, provided you can move part of your workloads.

In practice, this means portable technical building blocks (containers, for example) and shared identity management. It also requires monitoring that covers every environment. Without these, multi-cloud adds complexity instead of freedom.

What matters is not the number of providers but your ability to stay in control: knowing where your data is, who accesses it and how to move it.

Where should you start?

Three questions are enough to get started. Which data is truly sensitive? Which services would be hard to migrate tomorrow? What do your current contracts say about reversibility?

Answering them means bringing several perspectives together: IT, the business teams who know the value of their data and the procurement or legal teams who manage the contracts.

This first assessment guides what comes next: keeping some workloads where they are, moving others or renegotiating a contract. It also ties in with other obligations, such as the NIS2 directive, which requires the organisations concerned to manage the risks linked to their suppliers.

If you read our article on digital sovereignty and business continuity, this is the next step: moving from principle to a concrete choice of provider. For the regulatory side, see also our article on NIS2.

Lùkla supports you…

With our Cloud & Cyber offering, we help you classify your data, choose the right environments and prepare for reversibility. We co-build with you an architecture that leaves you free to choose.

Once the target is set, our Managed Services teams take over to operate and monitor your environments, from scoping to run. Your project starts with your challenges: the provider comes next.