Service 04 · Hosting in France
Sovereign hosting: servers in France, operated from Strasbourg.
Your production data lives in France, on servers we administer ourselves. Its backups, encrypted before they leave, stay in the European Union, with a copy in France.
First conversation free.
Sovereignty is not a marketing argument, it is a jurisdiction.
Many providers talk about “European hosting” when the servers, the parent company or the administration are somewhere else: Europe in name only. That is rarely enough for a judge, and never for a data protection officer.
With us, it can be checked. Your applications run on OVHcloud servers located in France, with a French company subject to French law. We administer them ourselves: there is no intermediary in the chain.
You receive a data processing agreement (DPA), the list of our sub-processors and the location of every copy of your data. Not a promise: a document your lawyer can read.
Included in hosting
- OVHcloud servers in France, administered by us
- A backup every night, encrypted before it leaves
- One copy in the European Union, one copy in France
- Encrypted connections, a segmented network, patches kept up to date
- Monitoring day and night and a person on call for incidents
- A data processing agreement provided, sub-processors declared
Your production data: Strasbourg, Roubaix, Gravelines.
Our hypervisors are three OVHcloud servers located in three separate French data centres: Strasbourg, Roubaix and Gravelines. Three separate sites, so that a local incident cannot take everything down.
Backups are encrypted on the original machine, before they are sent: the server that receives them sees only encrypted blocks. The primary copy is kept in an OVHcloud data centre in Germany, so within the European Union, and copied every night to a mirror located in France, outside the hosting provider.
Measured on 5 September 2026 · see the method
- Your applicationruns on our servers, which we administer ourselves
- Entry pointtraffic is encrypted, everything else is blocked
- Segmented networkno machine can be reached directly from outside
- Servers in Francethree separate data centres, in Strasbourg, Roubaix and Gravelines
- Encrypted backupa copy every night, checked, on a second site
- Monitoring day and nightwe see the outage before you do, and we get woken up
When location is an obligation, not a detail
- 01
Sensitive data. Personal, financial or strategic data: you must be able to say where it is, who administers it and under which law. We answer all three, in writing.
- 02
Regulated sectors. Finance, the public sector: traceability and location are part of your obligations. They are documented from the contract onwards.
- 03
Calls for tender. Your management, your clients or a public contract require European, or even national, hosting. You leave with the documents to attach to the file.
Our measurements, in detail
Each figure comes with its instrument, its measurement window and its method of calculation. Enough to repeat the measurement, or to prove us wrong. The infrastructure behind these measurements is described in our case study.
| Measurement | Value | Instrument | Method | Date |
|---|---|---|---|---|
| Average availability of the websites we host | 99.89% | Internal Uptime Kuma monitoring (HTTP probes, one measurement per minute) | Average of the 9 HTTP probes on public websites hosted on dedicated machines, over the rolling 30 days ending on 4 September 2026 at 23:45 UTC. Calculation: time in the “up” state divided by the time observed, per probe, then an unweighted average. | 5 Sep 2026 |
| Availability of our own website, www.sanfytech.com | 99.91% | Internal Uptime Kuma monitoring (HTTP probe, one measurement per minute) | Public HTTP probe on www.sanfytech.com, rolling 30 days ending on 4 September 2026 at 23:45 UTC: 43,143 “up” readings against 37 “down” readings. | 5 Sep 2026 |
| Average availability over 90 days of the websites monitored for at least 90 days | 99.74% | Internal Uptime Kuma monitoring (HTTP probes, one measurement per minute) | Average of the 5 website probes whose history genuinely covers 90 days, rolling window ending on 4 September 2026 at 23:45 UTC. Websites put into service more recently are excluded: we do not fill out a short window with an extrapolation. | 5 Sep 2026 |
| Active monitoring probes across our machines | 58 | Internal Uptime Kuma monitoring | Inventory of monitors on 5 September 2026: 62 active monitors, 4 of which are simply display groupings, giving 58 real probes (HTTP, ping, TCP port and backup heartbeats). | 5 Sep 2026 |
| Machines whose logs are sent to the SIEM in real time | 40 | Wazuh SIEM (internal administration console) | Count of agents registered with the Wazuh manager on 5 September 2026: 40 agents, all in the “active” state, that is 39 administered machines plus the SIEM server itself. | 5 Sep 2026 |
| Machines tracked for the application of security patches | 39 | PatchMon patch manager (internal console) | Inventory of registered hosts on 5 September 2026: 39 hosts, all in the “active” state and all having sent a report within the previous 24 hours. | 5 Sep 2026 |
| Backup frequency for hosted machines | 1 per day | Backup scheduler of the virtualisation cluster | Daily job at 20:00 UTC (10 pm Paris time) covering all guests of the cluster, in snapshot mode. Three machines with a particular profile have a dedicated weekly job. Reading of the configuration in force on 5 September 2026. | 5 Sep 2026 |
| Backups completed successfully over the last seven days | 322 out of 322 | Dedicated backup server (Proxmox Backup Server) | Task log of the backup server between 28 August 2026 at 23:48 UTC and 4 September 2026 at 23:48 UTC: 322 backup tasks, 322 completed without error, none failed. | 5 Sep 2026 |
| Backup integrity checks over the last seven days | 7 out of 7 | Dedicated backup server (Proxmox Backup Server) | A backup that is never read back is not a backup. Daily verification job at 04:00 UTC on snapshots that have never been checked, supplemented by a full monthly re-read beyond 30 days. Over the window from 28 August 2026 to 4 September 2026: 7 verifications, all without error. | 5 Sep 2026 |
| Restore depth kept for hosted machines | 7 daily, 2 weekly, 1 monthly | Dedicated backup server (Proxmox Backup Server) | Pruning rules in force on 5 September 2026 on the storage area for hosted machines: 7 daily, 2 weekly and 1 monthly backups kept. Infrastructure machines outside the cluster go up to 30 daily, 12 weekly and 12 monthly backups. | 5 Sep 2026 |
| Separate sites holding a copy of the backups | 2 sites | Dedicated backup server and its mirror outside the hosting provider | Primary copy on a dedicated backup server located in a fourth data centre, in Germany; second copy made every night (05:30 and 06:00 UTC) to a mirror located outside the hosting provider, in France. The mirror pulls the data: the primary server has no access to it. Status checked on 5 September 2026, 1.4 TB replicated. | 5 Sep 2026 |
| Backup encryption | Encrypted at source | Storage configuration of the virtualisation cluster | Data is encrypted on the original machine before being sent: the backup server only receives encrypted blocks. Presence of an encryption key declared on the storage area for hosted machines, checked on 5 September 2026 (fingerprint recorded, key never exposed). | 5 Sep 2026 |
| OVHcloud data centres housing our hypervisors | 3 in France | OVHcloud public API (dedicated server records) | “datacenter” field of the three dedicated servers read on 5 September 2026: sbg3 (Strasbourg), rbx8 (Roubaix), gra2 (Gravelines). Three separate sites, all in France. | 5 Sep 2026 |
| Data centre housing the backup server | 1 in Germany | OVHcloud public API (dedicated backup server record) | “datacenter” field of the backup server read on 5 September 2026: lim3 (Limburg, Germany). A site separate from the hypervisors, with the data kept within the European Union. | 5 Sep 2026 |
| Virtual machines and containers hosted on the cluster | 37 | Virtualisation cluster (guest inventory) | Count on 5 September 2026: 37 active guests, 29 containers and 8 virtual machines, spread across the three hypervisors. | 5 Sep 2026 |
Average availability of the websites we host99.89%
- Instrument
- Internal Uptime Kuma monitoring (HTTP probes, one measurement per minute)
- Method
- Average of the 9 HTTP probes on public websites hosted on dedicated machines, over the rolling 30 days ending on 4 September 2026 at 23:45 UTC. Calculation: time in the “up” state divided by the time observed, per probe, then an unweighted average.
- Date
- 5 September 2026
Availability of our own website, www.sanfytech.com99.91%
- Instrument
- Internal Uptime Kuma monitoring (HTTP probe, one measurement per minute)
- Method
- Public HTTP probe on www.sanfytech.com, rolling 30 days ending on 4 September 2026 at 23:45 UTC: 43,143 “up” readings against 37 “down” readings.
- Date
- 5 September 2026
Average availability over 90 days of the websites monitored for at least 90 days99.74%
- Instrument
- Internal Uptime Kuma monitoring (HTTP probes, one measurement per minute)
- Method
- Average of the 5 website probes whose history genuinely covers 90 days, rolling window ending on 4 September 2026 at 23:45 UTC. Websites put into service more recently are excluded: we do not fill out a short window with an extrapolation.
- Date
- 5 September 2026
Active monitoring probes across our machines58
- Instrument
- Internal Uptime Kuma monitoring
- Method
- Inventory of monitors on 5 September 2026: 62 active monitors, 4 of which are simply display groupings, giving 58 real probes (HTTP, ping, TCP port and backup heartbeats).
- Date
- 5 September 2026
Machines whose logs are sent to the SIEM in real time40
- Instrument
- Wazuh SIEM (internal administration console)
- Method
- Count of agents registered with the Wazuh manager on 5 September 2026: 40 agents, all in the “active” state, that is 39 administered machines plus the SIEM server itself.
- Date
- 5 September 2026
Machines tracked for the application of security patches39
- Instrument
- PatchMon patch manager (internal console)
- Method
- Inventory of registered hosts on 5 September 2026: 39 hosts, all in the “active” state and all having sent a report within the previous 24 hours.
- Date
- 5 September 2026
Backup frequency for hosted machines1 per day
- Instrument
- Backup scheduler of the virtualisation cluster
- Method
- Daily job at 20:00 UTC (10 pm Paris time) covering all guests of the cluster, in snapshot mode. Three machines with a particular profile have a dedicated weekly job. Reading of the configuration in force on 5 September 2026.
- Date
- 5 September 2026
Backups completed successfully over the last seven days322 out of 322
- Instrument
- Dedicated backup server (Proxmox Backup Server)
- Method
- Task log of the backup server between 28 August 2026 at 23:48 UTC and 4 September 2026 at 23:48 UTC: 322 backup tasks, 322 completed without error, none failed.
- Date
- 5 September 2026
Backup integrity checks over the last seven days7 out of 7
- Instrument
- Dedicated backup server (Proxmox Backup Server)
- Method
- A backup that is never read back is not a backup. Daily verification job at 04:00 UTC on snapshots that have never been checked, supplemented by a full monthly re-read beyond 30 days. Over the window from 28 August 2026 to 4 September 2026: 7 verifications, all without error.
- Date
- 5 September 2026
Restore depth kept for hosted machines7 daily, 2 weekly, 1 monthly
- Instrument
- Dedicated backup server (Proxmox Backup Server)
- Method
- Pruning rules in force on 5 September 2026 on the storage area for hosted machines: 7 daily, 2 weekly and 1 monthly backups kept. Infrastructure machines outside the cluster go up to 30 daily, 12 weekly and 12 monthly backups.
- Date
- 5 September 2026
Separate sites holding a copy of the backups2 sites
- Instrument
- Dedicated backup server and its mirror outside the hosting provider
- Method
- Primary copy on a dedicated backup server located in a fourth data centre, in Germany; second copy made every night (05:30 and 06:00 UTC) to a mirror located outside the hosting provider, in France. The mirror pulls the data: the primary server has no access to it. Status checked on 5 September 2026, 1.4 TB replicated.
- Date
- 5 September 2026
Backup encryptionEncrypted at source
- Instrument
- Storage configuration of the virtualisation cluster
- Method
- Data is encrypted on the original machine before being sent: the backup server only receives encrypted blocks. Presence of an encryption key declared on the storage area for hosted machines, checked on 5 September 2026 (fingerprint recorded, key never exposed).
- Date
- 5 September 2026
OVHcloud data centres housing our hypervisors3 in France
- Instrument
- OVHcloud public API (dedicated server records)
- Method
- “datacenter” field of the three dedicated servers read on 5 September 2026: sbg3 (Strasbourg), rbx8 (Roubaix), gra2 (Gravelines). Three separate sites, all in France.
- Date
- 5 September 2026
Data centre housing the backup server1 in Germany
- Instrument
- OVHcloud public API (dedicated backup server record)
- Method
- “datacenter” field of the backup server read on 5 September 2026: lim3 (Limburg, Germany). A site separate from the hypervisors, with the data kept within the European Union.
- Date
- 5 September 2026
Virtual machines and containers hosted on the cluster37
- Instrument
- Virtualisation cluster (guest inventory)
- Method
- Count on 5 September 2026: 37 active guests, 29 containers and 8 virtual machines, spread across the three hypervisors.
- Date
- 5 September 2026
Measurements taken on 5 September 2026.
Questions from an IT manager, or from their lawyer
For further reading, two blog articles: hosting your data in France and the Cloud Act explained for SMEs.
Where exactly is my data?
Your production data is hosted in France; its backups, encrypted at source, stay in the European Union, with a copy in France. The three cities and the two backup sites are in the table above, with the date of the measurement.
Who can access my data?
The two of us, who administer the servers, and the sub-processors named in the contract (the provider hosting the machines, the e-mail sending service). The data processing agreement states who has access to what, and for what purpose.
Can I leave?
Yes, on simple request, during the contract as well as at its end. You leave with an export of your data in open formats, access to the services administered for you, and a switchover prepared with the next provider.
Hosting alone, or with support?
Hosting includes the machine, its nightly backup and its monitoring. Managed services add patches, on-call support for incidents and a monthly report: they have their own page.
Timelines, quotes, code ownership, end of contract: the answers are in the FAQ.
Quoted per project. Price ranges are published on the pricing page, along with what makes a budget vary.
Your data, today
Where exactly is it hosted?
Tell us what you host and with whom. We will tell you what can be migrated, how, and what it costs.
Reply within 24 working hours, from one of the two founders.