The verdict in three sentences
SecNumCloud-qualified hosting, the French sovereign cloud label, costs between EUR 400 and 2,000 per month in 2026 for a corporate website, 5 to 15 times standard hosting. It is justified for an operator of vital importance or an essential entity under NIS 2, because it removes US Cloud Act extraterritoriality and imposes continuity guarantees audited by ANSSI, the French cybersecurity agency. For a pure showcase site with no sensitive data, a non-qualified European host with a solid backup plan is often enough.
What SecNumCloud qualification actually changes
ANSSI's SecNumCloud framework (version 3.2) requires, among other things, that the provider and its data be protected from extraterritorial laws. A French subsidiary of a US group remains subject to the Cloud Act, which lets US authorities request data wherever it is stored. The qualification also mandates strict access controls, data and support located in the European Union, and regular audits.
| Criterion | Standard shared hosting or VPS | Hyperscaler public cloud (EU region) | SecNumCloud-qualified offer |
|---|---|---|---|
| Monthly cost, corporate site | EUR 30 to 150 | EUR 150 to 800 | EUR 400 to 2,000 |
| Cloud Act exposure | Depends on host ownership | Yes | No (framework requirement) |
| Data location | Usually EU | Chosen EU region | France or EU, contractually guaranteed |
| Independent security audit | Rare | ISO 27001 certifications | Audited ANSSI qualification |
| Support | Ticket, sometimes outside EU | Varies by contract | EU-based, cleared staff |
| Availability commitment | 99.5 to 99.9% | 99.9 to 99.99% | 99.9 to 99.95% |
| Setup time | 1 day | 1 to 5 days | 2 to 6 weeks |
Providers available in 2026 include OVHcloud (qualified Hosted Private Cloud), 3DS Outscale and S3NS, the Thales and Google joint venture whose trusted offer is operated by a French entity. Qualified scopes differ by service: always check that the exact service you buy is on ANSSI's list, not just the provider.
NIS 2 and continuity: the real cost line
The NIS 2 directive, transposed into French law, requires essential and important entities to manage risk, report incidents within 24 hours and maintain a continuity plan. The corporate website is not always in the critical scope, but it often is once it carries customer areas, personal data forms or crisis communication. The budget therefore goes beyond hosting.
| Annual cost line | Well-configured standard hosting | SecNumCloud offer | Comment |
|---|---|---|---|
| Hosting | EUR 360 to 1,800 | EUR 4,800 to 24,000 | Depends on redundancy and volume |
| Off-site backups | EUR 300 to 900 | EUR 1,200 to 3,600 | Copy in a second qualified zone |
| Tested continuity plan | EUR 1,500 to 3,000 | EUR 3,000 to 6,000 | At least one failover test a year |
| 24/7 monitoring | EUR 1,200 to 4,000 | EUR 4,000 to 10,000 | Alert within 15 minutes |
| Audit or penetration test | EUR 4,000 to 8,000 | EUR 6,000 to 12,000 | Yearly, de facto required by NIS 2 |
| Initial migration | EUR 1,000 to 3,000 | EUR 5,000 to 15,000 | One-off |
| Total recurring per year | EUR 7,360 to 17,700 | EUR 19,000 to 55,600 | Excluding migration |
The recurring premium is therefore between EUR 12,000 and 38,000 a year. It should be weighed against NIS 2 fines, which can reach EUR 10 million or 2% of worldwide turnover for an essential entity, and against the cost of the site going down during a crisis.
How to decide in three questions
First question: is your organisation an operator of vital importance, an operator of essential services or an essential entity under NIS 2? If so, qualification is the simplest way to demonstrate compliance. Second question: does the site process sensitive data (customer accounts, regulated documents, health data)? If so, SecNumCloud or an architecture separating the public site from a qualified back office is required. Third question: does a public buyer or key account require it in tenders? This is increasingly common in 2026, notably since the French state's "cloud first" doctrine.
A hybrid architecture is often the best compromise: the static public site on a low-cost European CDN, and forms, private areas and databases on qualified infrastructure.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Julien, CISO of a regional water utility classified as an operator of vital importance in Lyon, must host an 80-page corporate website with a subscriber area. Current hosting: EUR 120 per month with a hyperscaler in an EU region.
Chosen option: hybrid architecture. Public pages on a European CDN (EUR 90 per month), subscriber area and database on a SecNumCloud-qualified offer (EUR 850 per month). Annual hosting cost: EUR 11,280, versus EUR 1,440 before, a EUR 9,840 premium. Fully qualified hosting would have cost about EUR 21,000 a year. Julien saves nearly EUR 9,700 a year while placing the personal data of 140,000 subscribers outside the reach of the Cloud Act.
FAQ
How much does SecNumCloud hosting cost for a corporate website?
Between EUR 400 and 2,000 per month depending on redundancy, traffic and service level, versus EUR 30 to 150 for standard hosting. Add EUR 5,000 to 15,000 for the initial migration.
Is a French host enough to be protected from the Cloud Act?
Not necessarily. What matters is the absence of control by an entity subject to US law. A French subsidiary of a US group remains exposed. SecNumCloud qualification checks exactly this criterion.
Does NIS 2 require SecNumCloud?
No, the directive does not mandate a specific qualification. It requires proportionate security measures, incident reporting within 24 hours and a continuity plan. SecNumCloud is, however, a recognised way to demonstrate it, and some public buyers require it.
Can a showcase site stay on standard hosting?
Yes, if the site processes no sensitive data and the organisation has no specific obligations. A European host at EUR 50 to 150 per month, with off-site backups and monitoring, is enough in most cases.
How long does migration to a qualified offer take?
Allow 2 to 6 weeks: contract setup, network configuration, data migration, failover tests and sign-off. Plan a cutover window of a few hours, outside peak traffic.
Let's scope your project. We design the hosting architecture of your corporate website, hybrid or fully qualified, with a continuity plan and assisted migration, for an indicative first-year budget of EUR 8,000 to 25,000. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
