Contents (7 sections)
“Our data is in Europe, so everything is fine.” We hear this sentence at every audit, and every time it needs qualifying. The geographical location of a server is only part of the equation. What really matters is who can legally access your data, under which jurisdiction, and with what guarantees. Here, without needless jargon, is what we explain to our clients when we talk about sovereign hosting.
Why data location matters #
Your business data (customer files, HR records, health data, trade secrets) is not just bytes. It is subject to the law of the country where it is stored, but also to the law of the country the hosting company answers to. This double dependency is behind most misunderstandings.
For a French SME or local authority, there are three things at stake: regulatory compliance, the trust of your own customers, and business continuity if the relationship with a foreign provider turns sour overnight. Choosing where your data lives means choosing who keeps control of it.
The Cloud Act: why “hosted in Europe” is not enough #
The Cloud Act (Clarifying Lawful Overseas Use of Data Act), passed in the United States in 2018, allows US authorities to require a company subject to US law to hand over the data it holds, whatever the country where that data is physically stored.
In practice: if you host with a large American provider (AWS, Azure, Google Cloud), the fact that the data centre is in Paris or Frankfurt does not put you out of reach. The parent company remains a US company, and can therefore be compelled to hand over data without you even being told. “Hosted in Europe” answers a geographical question; the Cloud Act raises a question of jurisdiction. They are not the same thing.
What about the giants’ “sovereign clouds”? #
So-called “trusted” offerings exist, operated by European partners under licence from an American player. They reduce the risk, but the picture depends on the contractual and technical details: who holds the encryption keys, who runs support, who can push an update. The real question remains simple: who can, in law, be compelled to hand over my data, and to whom?
“Hosted in Europe” answers a geographical question. Sovereignty answers a question of jurisdiction. As long as the parent company falls under US law, so does your data.
GDPR and the DPA: the contractual foundation #
The GDPR governs how personal data is processed in the European Union. For a hosting provider, this takes the form of a DPA (Data Processing Agreement): a contract that sets out the purposes of processing, the list of sub-processors, the security measures, retention periods and how incidents are notified.
A clear DPA is not paperwork: it is proof that your hosting provider has thought through the whole chain. If a provider cannot give you the list of its sub-processors and the countries involved, that is a warning sign.
How we host at Sanfytech #
Our answer is deliberately simple: everything we build runs on infrastructure hosted in France, operated by providers under French (and therefore European) law, outside the reach of the Cloud Act. This is European sovereignty taken at its word: not a European data centre under an American parent company, but European jurisdiction from end to end.
- Data centres in France, with multi-site replication for resilience.
- Daily encrypted backups, regularly tested with real restores: a backup that has never been restored is only a hypothesis.
- Monitoring day and night with alerting: we spot the incident before you call us.
- Measured and published availability (dated measurements on the managed services page) and on-call support for critical incidents, with written commitments on response times.
- GDPR built in: DPA provided, sub-processors declared, encryption at rest and in transit.
Good practice we apply (and that you can demand) #
- Ask for the written list of sub-processors and hosting countries.
- Check who holds the encryption keys: ideally, not the provider alone.
- Test that backups can be restored, not just that they exist.
- Document the disaster recovery plan and the target time to restore service.
- Prefer a single point of contact accountable from end to end, rather than a chain where everyone passes the buck.
In short #
Data sovereignty is not a marketing argument: it is the answer to a very concrete legal question. Keeping your data in France, with a hosting provider under French law, a clear DPA and written reliability commitments, means keeping control of what matters most to your business.
To place the subject in its regulatory context (the circular of 5 February 2026, the SecNumCloud decree and each ministry’s plan to reduce dependencies), we have written a full article on the French State’s technological sovereignty plan. If you want to look at your own case, see our sovereign hosting in France or let us talk directly: first conversation free, reply within 24 working hours.
