The verdict in three sentences
For a critical infrastructure operator, a public body or any organisation in France handling sensitive data, hosting on a SecNumCloud-qualified cloud is no longer optional: the "cloud au centre" doctrine and the 2024 SREN law require it for a growing share of systems. The premium ranges from 20 to 60% over a hyperscaler, low for plain IaaS, high if your app relies on proprietary managed services (serverless databases, message queues, AI). Migration costs EUR 10,000 to 40,000; the real savings lever is to design the app on standard containers from day one.
Who must host on SecNumCloud in 2026
Indicative table, to be validated with your CISO and legal team: the exact scope depends on your data classification.
| Organisation or data type | Legal basis | Hosting requirement |
|---|---|---|
| French central government, sensitive data | "Cloud au centre" circular (2021, updated 2023) | SecNumCloud-qualified offer required |
| Operators and entities under the SREN law, sensitive data | SREN law of 21 May 2024, article 31 | Protection from extraterritorial laws, SecNumCloud or equivalent |
| Operators of vital importance (OIV), critical information systems | Military programming law, sector decrees | Strengthened ANSSI requirements, SecNumCloud strongly recommended |
| Health data | HDS certification (2024 framework) | HDS mandatory, SecNumCloud depending on sensitivity |
| Local authorities and public bodies | ANSSI and DINUM recommendations | SecNumCloud recommended for sensitive data |
| NIS2 essential and important entities | NIS2 directive being transposed | Supplier risk control, sovereignty valued |
| Private SME without sensitive data | No specific obligation | Hyperscaler in an EU region is enough |
The real premium by line item
2026 order of magnitude for a mid-sized business app: 3 environments (dev, staging, production), 6 to 10 VMs or a 3 to 5 node Kubernetes cluster, a managed PostgreSQL database, 2 TB of object storage, backups.
| Monthly item | Standard hyperscaler (France region) | SecNumCloud cloud (OVHcloud, Outscale, Cloud Temple, S3NS) | Gap |
|---|---|---|---|
| Compute (VM or Kubernetes) | EUR 1,400 to 2,200 | EUR 1,700 to 3,000 | +20 to 35% |
| Managed database | EUR 400 to 700 | EUR 550 to 1,100 | +35 to 55% |
| Object storage and backups | EUR 150 to 300 | EUR 200 to 450 | +30 to 50% |
| Network, firewall, load balancer | EUR 200 to 400 | EUR 300 to 650 | +40 to 60% |
| Monitoring and logging | EUR 150 to 300 | EUR 200 to 450 | +30 to 50% |
| Estimated monthly total | EUR 2,300 to 3,900 | EUR 2,950 to 5,650 | +28 to 45% |
| Estimated annual total | EUR 27,600 to 46,800 | EUR 35,400 to 67,800 | +EUR 7,800 to 21,000 |
Offers change fast: S3NS (Thales and Google) delivers Google Cloud services in a Thales-operated setup, while OVHcloud and Outscale have qualified IaaS and Kubernetes catalogues. Check the ANSSI list of qualified offers at the date of your tender, because an offer "under qualification" does not meet a contractual qualification requirement.
Migration cost and pitfalls to avoid
| Starting point | Work | Timeline | Budget (ex. VAT) |
|---|---|---|---|
| App already containerised, PostgreSQL | Redeployment, network, backups, tests | 3 to 5 weeks | EUR 10,000 to 18,000 |
| App on VMs, standard dependencies | Containerisation, infrastructure as code, cutover | 6 to 8 weeks | EUR 18,000 to 28,000 |
| App tied to proprietary services (serverless functions, managed queue, proprietary NoSQL) | Partial rewrite, service replacement | 8 to 12 weeks | EUR 28,000 to 40,000 and more |
| Security file (EBIOS RM risk analysis, accreditation) | CISO support | 3 to 6 weeks in parallel | EUR 6,000 to 15,000 |
The main pitfall is lock-in to a hyperscaler's managed services. An app built on open components (Kubernetes, PostgreSQL, S3-compatible storage, Keycloak) migrates in a few weeks; an app built on proprietary services requires a rewrite.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Philippe, CIO of a regional public agency in France, must move his grants management app, hosted with a US hyperscaler for EUR 3,100 per month, to a SecNumCloud offer. The app already runs on Kubernetes with PostgreSQL. Qualified hosting quote: EUR 4,200 per month, a premium of EUR 1,100 monthly, EUR 13,200 per year (+35%). Migration: EUR 15,000, plus EUR 9,000 for risk analysis and the accreditation file. First-year cost: EUR 24,000 of project work plus EUR 13,200 of premium, i.e. EUR 37,200. In return, the agency clears the finding raised by its compliance audit and meets SREN requirements without a waiver.
FAQ
Is SecNumCloud mandatory for every company?
No, it mainly concerns the French state, some operators and sensitive data covered by the SREN law. A private SME without sensitive data can stay on a hyperscaler in an EU region, with no premium.
Why a 20 to 60% premium?
Qualified offers require operations by EU-based staff, immunity from extraterritorial laws and regular ANSSI audits. The smaller scale of sovereign providers also weighs on unit prices.
Can we use AI services on a SecNumCloud cloud?
Yes, but the catalogue is narrower: GPUs at some providers, self-hosted open source models. Expect 1.5 to 3 times the price of a public AI API for equivalent usage.
How long does a migration take?
From 3 to 12 weeks depending on the starting architecture, plus security accreditation time. Plan a 4 to 8 hour cutover window with a tested rollback.
Are HDS and SecNumCloud the same thing?
No, HDS is a mandatory certification for hosting health data in France, SecNumCloud is an ANSSI security qualification. Several providers hold both, which simplifies public health projects.
Let's scope your project. Send us your app's current architecture and data classification: we price the SecNumCloud migration between EUR 10,000 and 40,000 and compare annual hosting costs. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
