CYBERSECURITY MONTH 2026
Understanding European hosting sovereignty
BlueSecure platform data stays in the European Union. It is hosted in France by European hosting providers certified ISO 27001, which are not subject to extraterritorial laws such as the US CLOUD Act. Production, recovery and backups all remain within the EU.
- Hosted in the European Union
- ISO 27001 certified European providers
- SecNumCloud option
Where the servers are, and which law governs their operator
The CLOUD Act is a US law passed in 2018. It allows US authorities to require a provider under their jurisdiction to hand over the data it holds, including when that data is stored outside the United States.
To assess the sovereignty of a hosting setup, two questions therefore matter: where the servers are, and which law the provider operating them is subject to.
- Where are the servers?
- Which law is the provider subject to?
Provider subject to US law
The CLOUD Act can apply, wherever the servers are located.
European provider
Subject to EU law and the GDPR, not to extraterritorial laws such as the CLOUD Act.
European hosting providers for platform data
BlueSecure chose European hosting providers, based in France, for its platform data. Your employees' information and the results of simulations and training are stored within the European Union, under the GDPR.
- European providers
- EU law
- GDPR
Three concrete guarantees
Hosting in the European Union
Production, recovery and backups of platform data are located in the EU, in France. No transfer outside the European Union.
ISO 27001 certified providers
The platform's hosting is certified ISO 27001 at minimum. Certificates are available on request.
Options for stronger requirements
Hosting on an offer qualified SecNumCloud by ANSSI, the French cybersecurity agency, a dedicated server in a European datacenter, or installation on your own infrastructure.
Location written into the contract
The place of processing and the platform's hosting providers are set out in our data processing agreement (DPA). If your context requires it, we can also commit contractually not to change hosting provider without your agreement: you stay in control, from day one to the end of the contract.
Your questions about hosting sovereignty
- Where is platform data stored?
- In the European Union. The production, recovery and backup sites for platform data are all located in France, with no transfer outside the EU.
- Are your hosting providers subject to the CLOUD Act?
- Platform data is hosted by European hosting providers, based in France, which are not subject to extraterritorial laws such as the US CLOUD Act.
- How can we check this?
- The place of processing for platform data is set out in our data processing agreement, shared with our customers. The ISO 27001 certificates for the hosting are available on request.
- What if we have stronger requirements?
- A SecNumCloud qualified hosting option is available, as well as deployments on a dedicated server in a European datacenter or on your own infrastructure.
Let's talk about your sovereignty requirements
BlueSecure is a European company based in France, founded in 2017. Talk with our team about your hosting and data protection requirements.