SecNumCloud-Qualified Hosting for Public Sector Websites in France 2026: Cost and Trade-offs

The verdict in three sentences

For a French operator of vital importance (OIV) or public body, hosting the public website and above all the forms that collect data on a SecNumCloud-qualified cloud costs 2 to 4 times a standard hosting plan, i.e. EUR 800 to 3,500 excl. VAT per month depending on the architecture. Migration costs EUR 10,000 to 30,000 excl. VAT and takes 6 to 12 weeks, because the CDN, anti-DDoS and deployment pipeline usually need rework. In return you get immunity from extraterritorial laws (Cloud Act, FISA) and an ANSSI compliance file you can defend before your supervisory authority.

What SecNumCloud actually changes for a website

ANSSI's SecNumCloud 3.2 framework sets technical requirements (encryption, isolation, logging, privileged access management) and legal ones: the provider must be shielded from any non-European law, which in practice rules out direct use of US hyperscalers. For a brochure site with no sensitive data, the benefit is limited. For an OIV, the question arises as soon as the site hosts a customer area, incident reporting forms, job applications with CVs or an API connected to the information system.

The classic trap: qualifying the hosting but leaving the CDN, the analytics tool or the email service with a non-qualified vendor. Every component that sees data must be mapped. In our 2026 audits, 7 operator websites out of 10 still send form data to an out-of-scope third-party service.

The full budget: migration, run and hidden costs

The monthly infrastructure price is only part of the bill. An OIV website rarely runs on one machine: you need at least two zones, a web application firewall (WAF), off-site backup and monitoring. The premium also comes from skills: qualified IaaS offers need more administration than a hyperscaler's managed services.

Three levers cut the bill without leaving the scope: separate the editorial site (static, no personal data, can stay on standard hosting) from the forms and customer area (qualified); generate the site statically to reduce server count; pool managed services with other applications already hosted by the same provider. This split often lowers run costs by 30 to 40%, provided your security policy allows it in writing.

Clauses to demand in the hosting contract

Qualification covers a precise scope. Demand the current qualification certificate and the list of covered services, a clause locating data and backups in France or the EU, a commitment to notify incidents within 24 hours, a costed reversibility plan (export of data and images in under 30 days), and audit rights. Also check that the agency building the site can deploy without shared privileged accounts: access traceability is an ANSSI control point.

Mini case study

Nathalie, CISO of a water distribution operator in Auvergne-Rhône-Alpes, must migrate the public website (40 pages) and three forms (leak report, connection request, job application). Option 1: host everything on qualified cloud, EUR 2,900 per month and EUR 24,000 migration, i.e. EUR 128,400 over 3 years. Option 2: static editorial site on a standard host at EUR 250 per month, forms and back office on qualified cloud at EUR 1,650 per month, migration EUR 17,000, i.e. EUR 85,400 over 3 years. Savings reach EUR 43,000 excl. VAT (33%), approved by the security committee because no personal data passes through the static part.

FAQ

Is an OIV legally required to use SecNumCloud for its website?

Not always: the obligation stems from the government's "cloud at the centre" doctrine and from sector or contractual requirements for OIVs. As soon as the site processes sensitive data or belongs to a vital information system, the requirement becomes very likely. Budget 1 to 2 consulting days (EUR 1,500 to 3,000) to assess your situation.

How long does a migration to a qualified cloud take?

6 to 12 weeks for a site with forms, including 2 to 3 weeks of audit and data flow mapping. The cutover itself happens overnight with a 48-hour content freeze.

Can we keep WordPress on a SecNumCloud cloud?

Yes, qualified hosting does not constrain the CMS. However, plugins calling external services (analytics, captcha, fonts) must be replaced, which represents EUR 2,000 to 6,000 of work.

Is the premium permanent?

The gap is shrinking as new qualified offers arrive, but it remains around x 2 in 2026. A static architecture and split data flows can bring run costs below EUR 1,500 per month for a mid-sized site.

What if the provider loses its qualification?

The contract must provide immediate notification and a penalty-free termination right. With a tested reversibility plan, moving to another qualified provider takes 4 to 8 weeks.

Let's scope your project. We map your data flows, cost both scenarios (fully qualified or split) and plan the migration over 6 to 12 weeks, with an indicative budget of EUR 10,000 to 30,000. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.