OVHcloud – European cloud with a worldwide presence

Selected answer: 4. Entirely within the EU Value 125 SEAL 4

Notes: OVHcloud has a branch in Canada, but decision-making authority is in France.

No evidence provided for this answer.

Selected answer: 4. Unlikely takeover by or transfer to a non-EU sovereign entity Value 93 SEAL 4

Notes: Not 'Very unlikely' because stock is publicly traded. A minority strategic investment is more likely than outright change of control

No evidence provided for this answer.

Selected answer: 3. Governance bodies exist with EU actors participation Value 83 SEAL 3

Notes: OVHcloud is EU-owned and embedded in CISPE, GAIA-X, ENISA; EU actors participate in governance bodies influencing its roadmap and strategic direction.

Evidence

• DEEP, OVHcloud & Clever Cloud Consortium Selected for Sovereign Cloud for European Institutions other 20. August 2026
  Press release on EC selecting OVHcloud-led consortium for €180M sovereign cloud contract for EU institutions.
  Relevance: Demonstrates structured EU governance influence: the European Commission directly shapes OVHcloud's strategic direction through institutional contracts aligned with EU sovereignty priorities.
• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Shows OVHcloud's EU ownership, no non-EU dependencies, and active participation in EU governance bodies (CISPE, GAIA-X, ENISA), enabling EU stakeholder influence on roadmap and strategy.
• Silba Deep Dives – OVHcloud, Europe's Cloud Sovereignty Play other 20. August 2026
  Independent analysis of OVHcloud's ownership structure: Klaba family 81% ownership, SecNumCloud certification, EU regulatory moat.
  Relevance: Confirms EU ownership structure and strategic sovereignty alignment; shows governance is EU-anchored but family-controlled, consistent with governance body influence rather than full EU control.

Selected answer: 4. Majority of funding is EU-based Value 93 SEAL 4

Notes: Klaba family (French) owns ~79-81% post-2024 buyback; KKR/TowerBrook largely exited; ~18% free float on Euronext Paris may include non-EU investors.

Evidence

• OVHcloud FY2024 Annual Results & Share Buyback Announcement other 20. August 2026
  Official OVHcloud press release announcing €350M share buyback at €9/share, increasing Klaba family ownership to ~81%; FY2024 revenue €993M.
  Relevance: Confirms the deliberate strategic move to increase EU family ownership and reduce external/free-float capital via buyback, strengthening financial independence from non-EU sources.
• OVHcloud Official Investor Relations – Shareholders & Governance other 20. August 2026
  OVHcloud's official IR page showing post-buyback structure: Klaba family 79.0%, free float 18.4%, employees 1.8%, treasury 0.8%.
  Relevance: Directly confirms overwhelming EU family ownership (~79%) with remaining ~18% public float, establishing the degree of EU-based vs non-EU capital reliance.
• Silba Deep Dives – OVHcloud, Europe's Cloud Sovereignty Play other 20. August 2026
  Independent analysis of OVHcloud's ownership structure: Klaba family 81% ownership, SecNumCloud certification, EU regulatory moat.
  Relevance: Documents the active reduction of non-EU PE capital (KKR/TowerBrook) and consolidation of EU family ownership, directly addressing financial independence from non-EU capital.

Selected answer: 5. Fully in the EU Value 125 SEAL 4

Notes: EU-headquartered, Euronext-listed, ~94% revenue from Europe, ~2,900 EU employees, €200M EIB loan, €700M+ EU capex. Overwhelmingly EU/EEA economic contribution.

Evidence

• EIB Supports OVHcloud Growth with a €200 Million Loan for European Investments other 20. August 2026
  EIB press release on €200M loan — its first for a pure cloud player — for European expansion including 10+ new EU data centres and R&D investment.
  Relevance: Demonstrates EU institutional financial backing for OVHcloud's European investment, jobs creation, and value generation within EU/EEA.
• OVHcloud FY2024 Annual Results & Share Buyback Announcement other 20. August 2026
  Official OVHcloud press release announcing €350M share buyback at €9/share, increasing Klaba family ownership to ~81%; FY2024 revenue €993M.
  Relevance: Directly shows EU investment levels, employment footprint, and geographic value concentration — ~94% of revenue generated within Europe.
• OVHcloud Presents Strategic Plan "Shaping the Future" and FY2026 Targets other 20. August 2026
  Strategic plan detailing €700M cumulative capex (2021-2023), European data center expansion, 2,900 employees across 15 countries, and EU sovereignty positioning.
  Relevance: Shows sustained EU-focused investment strategy, employment growth, and capital deployment plan confirming majority EU/EEA value creation.

Selected answer: 2. Active participant in strategic projects Value 62 SEAL 4

Notes: OVHcloud is a founding member of Gaia-X and actively advocated for launching IPCEI-CIS via the Rome Consensus, demonstrating strong strategic project engagement.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Confirms OVHcloud as a founding member of Gaia-X, one of the listed EU strategic initiatives in the assessment question.
• T-Systems and OVHcloud Cooperate for Gaia-X other 20. August 2026
  OVHcloud press release announcing Gaia-X founding partnership with T-Systems to build a sovereign European public cloud offering.
  Relevance: Demonstrates active participation in Gaia-X, building a market-ready sovereign cloud platform following Gaia-X principles.
• The Rome Consensus: Assert European Digital Sovereignty other 20. August 2026
  OVHcloud-led policy document from 2022 French EU Council Presidency advocating for IPCEI-CIS launch and European digital sovereignty.
  Relevance: Shows OVHcloud's active role in advocating for IPCEI-CIS as a strategic EU initiative, even if not confirmed as a direct consortium member.

Selected answer: Bold ambition and dedicated means Value 125 SEAL 4

Notes: Bold ambition via Rome Consensus and Gaia-X founding role, backed by €200M EIB loan and €700M capex for EU sovereignty goals.

Evidence

• EIB Supports OVHcloud Growth with a €200 Million Loan for European Investments other 20. August 2026
  EIB press release on €200M loan — its first for a pure cloud player — for European expansion including 10+ new EU data centres and R&D investment.
  Relevance: EIB's first cloud-sector loan directly ties OVHcloud expansion to EU strategic autonomy in digital tech and green sovereignty objectives, with measurable green targets.
• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Shows concrete alignment with EU digital and industrial sovereignty objectives through founding roles in CISPE and GAIA-X, plus full EU-based supply chain control.
• The Rome Consensus: Assert European Digital Sovereignty other 20. August 2026
  OVHcloud-led policy document from 2022 French EU Council Presidency advocating for IPCEI-CIS launch and European digital sovereignty.
  Relevance: Directly demonstrates bold ambition for EU industrial strategy alignment with dedicated governance: proposes IPCEI-CIS, Buy European Tech Act, and concrete policy roadmap.

Selected answer: 5. Full autonomy and continuity Value 125 SEAL 4

Notes: OVHcloud has internalised most key functions: own server design/manufacturing, own data centers, open-source OpenStack stack, own network. Can source alternatives for remaining commodity dependencies.

Evidence

• OVHcloud – Open Source: Shaping the Public Cloud other 20. August 2026
  Details OVHcloud's 100% open-source OpenStack-based public cloud with reversibility, no vendor lock-in, open APIs, and zero egress fees.
  Relevance: Shows OVHcloud avoids proprietary dependencies by using open standards—no single vendor can disrupt its software stack, ensuring continuity even if third-party support is withdrawn.
• OVHcloud and S2GRUPO Strategic Partnership for European Digital Sovereignty other 20. August 2026
  Press release highlighting OVHcloud's full control over its value chain—from server design to data centre management—ensuring sovereignty by design and cyber resilience.
  Relevance: Confirms OVHcloud's vertical integration across the entire stack, reducing external vendor dependencies and demonstrating ability to internalise key functions for operational continuity.
• OVHcloud On-Prem Cloud Platform (OPCP) other 20. August 2026
  OVHcloud's on-prem cloud solution runs fully disconnected with open-source tech (OpenStack, Keycloak, Netbox), no external vendor dependency required for operations.
  Relevance: Demonstrates OVHcloud can sustain operations independently using self-managed open-source stack, even fully disconnected—key evidence of internalized key functions and cut-off resilience.

Selected answer: 3. Exclusively EU law Value 167 SEAL 4

Notes: OVH Groupe SAS is incorporated in France, governed by French/EU law exclusively. European entities under exclusive EU jurisdiction; CLOUD Act free; no dependency on non-EU entities.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Directly establishes OVHcloud's primary legal identity as French/EU, its data hosted exclusively in EU, and its insulation from non-EU authority for the provider's core operations.
• OVHcloud Legal and Privacy Security other 20. August 2026
  OVHcloud's official legal page listing applicable legal texts per jurisdiction, GDPR compliance, and EU data hosting with protection against extraterritorial laws.
  Relevance: Details the legal framework governing OVHcloud's EU operations (EU GDPR, e-Privacy Directive, Cybersecurity Regulation), confirming French/EU law as primary governing jurisdiction for EU customers.
• The CLOUD Act and European Data Sovereignty – OVHcloud Blog other 20. August 2026
  OVHcloud blog post explaining its legal jurisdiction stance: European entities under 'exclusive jurisdiction of EU member states,' no dependency links to non-EU entities, and 'CLOUD Act free' status.
  Relevance: Provides explicit corporate statement that OVH Groupe is governed by French law with no dependency on non-EU jurisdiction entities — directly answers the primary legal jurisdiction question.

Selected answer: Legal structures shielding from foreign law Value 125 SEAL 2

Notes: French corporate structure, blocking statute & SecNumCloud shield from foreign law. Not immunity (King v. OVH shows limits), but beyond mere mitigation clauses.

Evidence

• The CLOUD Act and European Data Sovereignty – OVHcloud Blog other 20. August 2026
  OVHcloud blog post explaining its legal jurisdiction stance: European entities under 'exclusive jurisdiction of EU member states,' no dependency links to non-EU entities, and 'CLOUD Act free' status.
  Relevance: Directly states OVHcloud's legal position on extraterritorial law exposure, French exclusive jurisdiction, and structural independence from non-EU entities.
• What Canada's King vs. OVH Case Reveals About Cross-Border Data Access other 20. August 2026
  Analysis of King v. OVH case where Ontario court compelled OVHcloud's French parent to produce data despite blocking statute, revealing limits of legal shields.
  Relevance: Documents a real case where a foreign court pierced OVHcloud's legal structures, showing they provide shielding but not verified immunity from non-EU law.
• White Paper: US CLOUD Act vs European/UK Data Sovereignty – CMS Law other 20. August 2026
  Legal white paper by international law firm CMS analyzing CLOUD Act jurisdiction, blocking statutes, and practical enforcement against EU providers.
  Relevance: Independent legal analysis of CLOUD Act vs European sovereignty, addressing blocking statute effectiveness and whether legal structures genuinely shield EU providers.

Selected answer: 4. Non-EU authorities requests to access data or systems are disputed by the provider and eventually in some cases are accepted with customers being notified Value 125 SEAL 1

Notes: OVHcloud disputes non-EU authority requests citing GDPR Art. 48 & MLAT, but King v. OVH shows some requests succeed via foreign subsidiary jurisdiction. Customer notification is policy.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Confirms OVHcloud's sovereignty policy and technical/organizational measures insulating EU data from non-EU access, establishing the dispute baseline.
• The CLOUD Act and European Data Sovereignty – OVHcloud Blog other 20. August 2026
  OVHcloud blog post explaining its legal jurisdiction stance: European entities under 'exclusive jurisdiction of EU member states,' no dependency links to non-EU entities, and 'CLOUD Act free' status.
  Relevance: Shows OVHcloud's stated policy of disputing all non-EU authority data access requests, which is the first element of option 4.
• What Canada's King vs. OVH Case Reveals About Cross-Border Data Access other 20. August 2026
  Analysis of King v. OVH case where Ontario court compelled OVHcloud's French parent to produce data despite blocking statute, revealing limits of legal shields.
  Relevance: Proves some non-EU requests are eventually accepted despite OVHcloud's dispute: Canadian court upheld production order and cited prior German data compliance via subsidiary jurisdiction.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: OVHcloud's core infrastructure is French/EU-based and not subject to US ITAR/EAR. Third-party products may carry export restrictions.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Demonstrates OVHcloud's core infrastructure is under French/EU law with no US jurisdictional nexus, meaning ITAR/EAR do not apply to core EU offer.
• OVHcloud US Terms of Service — Export Compliance Clause other 20. August 2026
  US Terms of Service Section 19(14) places EAR/ITAR compliance solely on US customers; OVHcloud disclaims responsibility.
  Relevance: Shows export controls (ITAR/EAR) apply only to OVHcloud US subsidiary, not the core European offer, confirming partial protection for EU MSs.
• What is Sovereign Cloud? (OVHcloud) other 20. August 2026
  OVHcloud's article defining sovereign cloud and how it avoids extraterritorial jurisdictional exposure for hosted data.
  Relevance: Explains how sovereign cloud excludes US extraterritorial laws, ensuring part of the offer remains free from ITAR/EAR for EU MSs and intl orgs.

Selected answer: 4. Mostly within the EU Value 125 SEAL 4

Notes: OVHcloud's IP (130+ patent families, server designs, cooling tech) is created, registered, and developed primarily in France/EU, with minor activity in Canada (server factory) and US (subsidiary).

Evidence

• EIB Supports OVHcloud Growth with a €200 Million Loan for European Investments other 20. August 2026
  EIB press release on €200M loan — its first for a pure cloud player — for European expansion including 10+ new EU data centres and R&D investment.
  Relevance: European institutional financing supporting OVHcloud's R&D and patent development in Europe, confirming IP creation occurs primarily within the EU.
• How OVHcloud Harmonizes Open Innovation and Patents other 20. August 2026
  OVHcloud article detailing 130+ patent families developed by its R&D engineers in France, covering software, cooling, mechanics, and electronics innovations.
  Relevance: Directly evidences where OVHcloud's IP is created and developed — primarily in France, with a defensive patent strategy and European IP department.
• Silba Deep Dives – OVHcloud, Europe's Cloud Sovereignty Play other 20. August 2026
  Independent analysis of OVHcloud's ownership structure: Klaba family 81% ownership, SecNumCloud certification, EU regulatory moat.
  Relevance: Documents the location of core IP creation — proprietary server designs and cooling technology developed in France, with a secondary factory in Canada.

Selected answer: EU law with exceptions Value 125 SEAL 4

Notes: Core IP (trademarks, patents) owned by OVH SAS/OVH Groupe SA under French/EU law; US subsidiary OVH US LLC operates IP contracts under US law, creating exceptions.

Evidence

• How OVHcloud Harmonizes Open Innovation and Patents other 20. August 2026
  OVHcloud article detailing 130+ patent families developed by its R&D engineers in France, covering software, cooling, mechanics, and electronics innovations.
  Relevance: Confirms patents are owned by OVHcloud (French entity) and filed in both EP and US jurisdictions, showing primarily EU ownership with US filings as exceptions.
• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Confirms OVH Groupe SAS is under French/EU law and that European entities oppose non-EU authority requests, establishing EU as primary IP holder jurisdiction.
• OVHcloud US Terms of Service — Export Compliance Clause other 20. August 2026
  US Terms of Service Section 19(14) places EAR/ITAR compliance solely on US customers; OVHcloud disclaims responsibility.
  Relevance: Reveals the US exception: OVH US LLC IP contracts governed by US state law, while trademark ownership remains with French parent OVH SAS.

Selected answer: 4. Customer primary control but provider can read the data or some of the data Value 150 SEAL 3

Notes: OVHcloud offers CMK/BYOK where customers control key lifecycle, but keys reside in OVHcloud's KMS/HSM. The provider retains technical capability to perform decryption operations using stored keys.

Evidence

• OVHcloud Key Management Service (Labs) other 20. August 2026
  OVHcloud's official KMS page describing OMK (provider-managed) and CMK (customer-managed) key models, BYOK support, and FIPS 140-2 certification.
  Relevance: Directly describes OVHcloud's encryption key management offering: CMK lets customers control key lifecycle, but keys are imported into and stored within OVHcloud's KMS infrastructure — not held exclusively by the customer.
• Using OVHcloud Key Management Service (KMS) — Official Documentation other 20. August 2026
  Technical guide on OVHcloud KMS usage via REST API, covering key creation, encryption/decryption workflows, key sensitivity flags, and regional API endpoints.
  Relevance: Shows KMS performs encrypt/decrypt operations server-side using keys stored in its HSM, confirming the provider's technical capability to decrypt data using customer-managed keys.

Selected answer: 5. Real-time customer oversight and independent auditability Value 200 SEAL 4

Notes: Real-time log streaming via LDP Live-tail, customer IAM-controlled audit trails, and ISO/SOC independent audits support data and AI access visibility.

Evidence

• AI Act Explained: EU AI Regulation — OVHcloud Blog other 20. August 2026
  OVHcloud and Ethiqais joint article on EU AI Act compliance, covering traceability, transparency, and logging of AI systems with automated conformity assessment.
  Relevance: Addresses AI model usage auditability requirement — OVHcloud's partnership with Ethiqais and AI Pact signatory status supports independent AI compliance auditing and traceability.
• Generating OVHcloud Account Logs with Logs Data Platform other 20. August 2026
  Official documentation detailing three audit log types: audit logs (IP, geolocation, MFA, user agent), activity logs (API calls, user identity), and access policy logs (IAM evaluations).
  Relevance: Shows comprehensive audit trail with user identity, timestamps, access type, and IP — directly addressing the visibility requirement for data access logs.
• OVHcloud Service Logs — Product Page other 20. August 2026
  OVHcloud's managed log service providing real-time log collection, live-tail streaming, IAM-controlled access, and customizable retention (1–10 years).
  Relevance: Demonstrates real-time customer oversight of access logs with IAM-based fine-grained access control, supporting auditability of who, when, and where data is accessed.

Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3

Notes: OVHcloud enforces automatic irreversible deletion and offers KMS-based cryptographic erasure, with logging and audit policies. However, no independent proof of erasure per deletion event is provided to customers.

Evidence

• OVHcloud Data Processing Agreement (DPA) other 20. August 2026
  GDPR-aligned DPA governing data deletion/retrieval post-termination (15-day window), audit rights to third-party examination reports, and Standard Contractual Clauses.
  Relevance: Establishes data deletion procedures and audit rights, showing deletion is policy-driven with some third-party oversight, but no per-event proof of erasure.
• OVHcloud Data Security & Compliance other 20. August 2026
  Details OVHcloud's ISMS, monitoring/logging policies for storage servers and infrastructure, and annual third-party audits (ISO 27001/27017/27018, SOC 2).
  Relevance: Shows logging and auditing mechanisms that technically verify access and operations, supporting the assessment that deletion is verified via access logs rather than independent proof.
• OVHcloud Service-Specific Terms for Products and Services other 20. August 2026
  Official legal terms detailing automatic and irreversible deletion of content data on service termination, KMS-based cryptographic key deletion, and shared responsibility for data backup.
  Relevance: Documents OVHcloud's contractual commitment to irreversible deletion and key-based erasure mechanisms, directly addressing the assessment question on secure deletion.

Selected answer: 4. Data in the EU by default, tightly controlled exceptions Value 150 SEAL 1

Notes: OVHcloud defaults to EU-only storage and processing for European customers, but DPA includes SCCs and third-country sub-processors; cross-border legal challenges exist.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Confirms OVHcloud's default EU-only data hosting stance and its contractual and technical measures to keep European customer data within EU jurisdiction.
• OVHcloud GDPR FAQ – Your Questions Answered other 20. August 2026
  OVHcloud's GDPR FAQ page stating that data stays within the EU, is never processed in the US, and that these guarantees are contractually enforced via the DPA.
  Relevance: Explicitly confirms EU-only data location guarantee for European customers, supporting the 'EU by default' assessment. Also acknowledges customer responsibility for broader GDPR compliance.
• The Sovereignty Mirage: Why European Clouds Won't Save Your Data other 20. August 2026
  Critical analysis contrasting BYOK vs HYOK, noting BYOK keys stored in provider HSMs allow compelled decryption — relevant to OVHcloud's CMK/BYOK model.
  Relevance: Highlights that 'no third-country fallback' is not fully achievable — legal mechanisms can compel cross-border data access, justifying a score below 5.

Selected answer: Mixed Control with alternatives: Auditable or open source AI, foreign chips Value 100 SEAL 2

Notes: OVHcloud uses open-source AI models on EU sovereign infrastructure, but relies entirely on NVIDIA (US) GPU chips — a mixed control profile.

Evidence

• OVHcloud AI Training & GPU Services other 20. August 2026
  OVHcloud offers GPU-accelerated AI training with NVIDIA H100, A100, L40S, and L4 chips in European data centers.
  Relevance: Confirms OVHcloud relies entirely on NVIDIA (US) chips for AI accelerators — no EU-origin chip alternatives available in its stack.
• OVHcloud Data Sovereignty Commitment other 20. August 2026
  OVHcloud's data sovereignty page outlines its European cloud positioning, CLOUD Act protection, and full value chain control.
  Relevance: Establishes that OVHcloud hosting and data processing are EU-sovereign, providing the infrastructure sovereignty layer for AI services.
• OVHcloud Launches AI Endpoints with 40+ Open-Source Models other 20. August 2026
  OVHcloud AI Endpoints offers 40+ open-source/open-weight AI models hosted on sovereign European cloud, ensuring model transparency and data sovereignty.
  Relevance: Shows OVHcloud uses auditable open-source AI models (Llama, Mixtral, DeepSeek, Qwen) on EU infrastructure, but models originate from both EU and non-EU sources.

Selected answer: 4. Formal migration services are available to assist with moving data and workloads Value 125 SEAL 4

Notes: OVHcloud offers OMAP migration program with tools, certified partners, and financial incentives, plus OpenStack-based reversibility and documented data export policies.

Evidence

• OVHcloud – Open Source: Shaping the Public Cloud other 20. August 2026
  Details OVHcloud's 100% open-source OpenStack-based public cloud with reversibility, no vendor lock-in, open APIs, and zero egress fees.
  Relevance: Shows OpenStack-based interoperability, open APIs, and no egress fees — key enablers of workload portability and avoidance of vendor lock-in.
• OVHcloud Migration Acceleration Program (OMAP) other 20. August 2026
  Structured migration program offering tools, professional services, 100+ certified partners, training, and financial incentives for workload migration with full reversibility.
  Relevance: Demonstrates formal migration services with professional support, certified partners, and tools for moving data and workloads, directly addressing portability and interoperability.
• Reversibility Policy for the Unified Data Platform other 20. August 2026
  Official documentation defining reversibility policy with standard data export formats (CSV, JSON, Parquet, Avro), open-source tech, and SWIPO IaaS compliance.
  Relevance: Provides documented, standard methods for data export and migration with specific formats and APIs, supporting interoperability and portability claims.

Selected answer: 5. The entire technology stack is managed and supported by a fully EU-based team Value 167 SEAL 4

Notes: OVHcloud is EU-headquartered, vertically integrated, and explicitly restricts all EU customer interventions to EU-based entities only.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Explicitly states only EU entities can operate on EU customer infrastructures and technology is operated end-to-end by OVHcloud without non-EU vendor involvement.
• OVHcloud Enterprise Support — EU-Based Support Teams other 21. August 2026
  OVHcloud Enterprise Support page offering a trusted version ensuring all interventions are carried out solely by EU-based teams.
  Relevance: Demonstrates that EU customers can receive full support exclusively from EU-based teams, confirming operational independence from non-EU personnel.
• Silba Deep Dives – OVHcloud, Europe's Cloud Sovereignty Play other 20. August 2026
  Independent analysis of OVHcloud's ownership structure: Klaba family 81% ownership, SecNumCloud certification, EU regulatory moat.
  Relevance: Details OVHcloud's full-stack vertical integration (servers, data centers, network) eliminating dependency on non-EU vendors for operations and support.

Selected answer: All EU staff Value 125 SEAL 3

Notes: SecNumCloud mandates exclusively EU personnel for sovereign ops. ~67% workforce in Western Europe. Clearance limited to defence workloads.

Evidence

• OVHcloud Enterprise Support — EU-Based Support Teams other 21. August 2026
  OVHcloud Enterprise Support page offering a trusted version ensuring all interventions are carried out solely by EU-based teams.
  Relevance: Existing evidence already linked; confirms EU-only support staffing for sovereign service operations.
• OVHcloud Expands Solutions for Defence Players in Europe other 21. August 2026
  Press release on deploying dedicated EU defence teams, hiring cleared military/defence profiles, and upskilling for national security requirements.
  Relevance: Shows EU-based talent pool with cleared personnel for classified workloads, reinforcing operational sovereignty for defence-grade services.
• OVHcloud SecNumCloud Compliance other 21. August 2026
  Official page detailing ANSSI SecNumCloud certification; states services are operated, maintained and monitored exclusively by EU-based personnel.
  Relevance: Directly confirms that SecNumCloud-qualified services ensure all operations are EU-staffed, satisfying skill availability within the EU.

Selected answer: 4. All support staff are located within the EU Value 125 SEAL 3

Notes: OVHcloud provides EU-only support for sovereign/SecNumCloud services; default Enterprise optionally includes Canadian affiliate at extra cost.

Evidence

• OVHcloud Enterprise Support — EU-Based Support Teams other 21. August 2026
  OVHcloud Enterprise Support page offering a trusted version ensuring all interventions are carried out solely by EU-based teams.
  Relevance: Confirms OVHcloud can guarantee all support interventions by EU-based teams for EU services, directly addressing support channel sovereignty assurance.

Selected answer: 5. EU-only end-to-end - Content, metadata, and backups/replicas are stored in the EU and privileged administration/support access is restricted to EU-based staff under EU jurisdiction Value 167 SEAL 4

Notes: SecNumCloud certifies EU-only storage, backups, and EU-only staff for privileged admin access. Open-source OpenStack architecture provides reversibility, though proprietary source code access remains limited.

Evidence

• OVHcloud Data Sovereignty Commitment other 20. August 2026
  OVHcloud's data sovereignty page outlines its European cloud positioning, CLOUD Act protection, and full value chain control.
  Relevance: Confirms EU-only data storage, operations, and documentation with no non-EU subcontractors, supporting end-to-end EU control of documentation and knowledge repositories.
• OVHcloud SecNumCloud Compliance other 21. August 2026
  Official page detailing ANSSI SecNumCloud certification; states services are operated, maintained and monitored exclusively by EU-based personnel.
  Relevance: SecNumCloud certification guarantees privileged admin/support access restricted to EU-based staff under EU jurisdiction, meeting the Option 5 criteria.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 125 SEAL 3

Notes: OVHcloud's vertical integration (in-house server manufacturing, datacenter construction, own dark fibre network) limits supplier dependencies; proven resilience during 2020 crisis.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Confirms subcontractors limited to EU/adequate jurisdictions, integrated model avoids stock disruptions—evidencing ability to source alternatives and internalise key functions.
• OVHcloud Supply Chain (Official Sustainability Page) other 21. August 2026
  OVHcloud's official supply chain page showing vertical integration, in-house server manufacturing in France and Canada, circular economy practices, and a Supplier Code of Conduct with responsible mineral sourcing policies.
  Relevance: Demonstrates OVHcloud internalises critical functions (server production, datacenter construction) reducing dependency on foreign subcontractors, directly addressing supplier jurisdiction concerns.
• Security and Digital Sovereignty – Press Kit other 21. August 2026
  Corporate press kit outlining three sovereignty pillars (data, technological, operational) with emphasis on integrated value chain control and Gaia-X Level 3 and SecNumCloud qualifications.
  Relevance: Explicitly addresses operational sovereignty pillar; SecNumCloud certifies EU-only personnel operations, confirming continuity against foreign supplier interruptions.

Selected answer: Transparent with exceptions Value 71 SEAL 3

Notes: OVHcloud manufactures servers in-house (France/Canada) with published supply chain policies and a Supplier Code of Conduct (conflict minerals, UN Global Compact). However, specific named component suppliers and detailed country-of-origin info for individual parts (CPU, GPU, motherboards) are not publicly disclosed.

Evidence

• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Highlights OVHcloud's server design and manufacturing approach, supporting assessment of component origin controls. Sufficient for understanding endpoints but obviously not all sub-components.
• OVHcloud Supply Chain (Official Sustainability Page) other 21. August 2026
  OVHcloud's official supply chain page showing vertical integration, in-house server manufacturing in France and Canada, circular economy practices, and a Supplier Code of Conduct with responsible mineral sourcing policies.
  Relevance: Directly relevant: documents supply chain management with component selection, reuse, recycling, and supplier standards. Shows important controls but lacks granular disclosure of component geographic origins or named suppliers.
• Silba Deep Dives – OVHcloud, Europe's Cloud Sovereignty Play other 20. August 2026
  Independent analysis of OVHcloud's ownership structure: Klaba family 81% ownership, SecNumCloud certification, EU regulatory moat.
  Relevance: Provides third-party confirmation that while OVHcloud builds its own servers, key components still come from external (non-EU) suppliers. Reinforces the exceptions to full transparency on component provenance.

Selected answer: Mixed sourcing, EU audit rights Value 71 SEAL 3

Notes: Servers assembled in-house in France by EU teams, but key components (AMD/Intel CPUs, Supermicro boards) are foreign-sourced. Supplier Code of Conduct grants EU audit rights.

Evidence

• OVHcloud Servers: From Production to Delivery other 21. August 2026
  Official page detailing OVHcloud's 10-step server production process: component supply, assembly (8 components in 15 min), quality testing, all done in-house.
  Relevance: Shows servers are assembled by EU teams in France, but components are externally sourced, confirming mixed sourcing model.
• OVHcloud Supplier Code of Conduct (Global, Aug 2024) other 21. August 2026
  Group-level Supplier Code requiring responsible mineral sourcing, REACH/RoHS compliance, supply chain mapping to origin, and OVHcloud audit/self-assessment rights.
  Relevance: Establishes EU audit rights over suppliers including origin tracing of components and minerals, directly supporting the 'EU audit rights' assessment.
• OVHcloud Supply Chain (Official Sustainability Page) other 21. August 2026
  OVHcloud's official supply chain page showing vertical integration, in-house server manufacturing in France and Canada, circular economy practices, and a Supplier Code of Conduct with responsible mineral sourcing policies.
  Relevance: Confirms in-house EU assembly but acknowledges external component suppliers, supporting mixed sourcing with EU-level supply chain oversight.

Selected answer: Transparent with exceptions Value 71 SEAL 4

Notes: In-house manufacturing and open microcode practices are well documented, but full component supplier lists and firmware (Intel/AMD) provenance are not fully disclosed or EU-certified.

Evidence

• OVHcloud Supply Chain (Official Sustainability Page) other 21. August 2026
  OVHcloud's official supply chain page showing vertical integration, in-house server manufacturing in France and Canada, circular economy practices, and a Supplier Code of Conduct with responsible mineral sourcing policies.
  Relevance: Shows OVHcloud controls its server manufacturing and component selection, but does not publish individual supplier identities or countries of origin for all components — a transparency exception.

Selected answer: 4. A large majority of the software is designed and maintained by EU teams Value 107 SEAL 3

Notes: OVHcloud develops majority of software in-house by EU teams (1,396 engineers, 70% in France). Core uses open-source OpenStack, not exclusively EU.

Evidence

• OVHcloud – Open Source: Shaping the Public Cloud other 20. August 2026
  Details OVHcloud's 100% open-source OpenStack-based public cloud with reversibility, no vendor lock-in, open APIs, and zero egress fees.
  Relevance: Shows core platform built on globally-developed OpenStack, preventing assessment from reaching exclusively EU rating.
• OVHcloud 2023 Non-Financial Performance Statement other 21. August 2026
  Official corporate document detailing 1,396 engineers (69.8% in France), in-house cloud management, AI platform, and OpenStack R&D.
  Relevance: Authoritative source showing majority of engineers in France and extensive in-house software R&D, confirming EU-origin of core software components.
• Silba Deep Dives – OVHcloud, Europe's Cloud Sovereignty Play other 20. August 2026
  Independent analysis of OVHcloud's ownership structure: Klaba family 81% ownership, SecNumCloud certification, EU regulatory moat.
  Relevance: Details OVHcloud's in-house software development by EU engineering teams with over 60% tech profiles, supporting majority EU-origin assessment.

Selected answer: 5. EU control and EU policy gates - As (4), plus EU-based compliance/security gates enforced in the pipeline (e.g., signing under your control, vulnerability checks, segregation of duties, auditable approvals) Value 143 SEAL 4

Notes: OVHcloud runs EU-based software build/deploy pipelines with enforced compliance gates: signing, vulnerability scanning, admission policies—all under EU jurisdiction.

Evidence

• OVHcloud Presents Strategic Plan "Shaping the Future" and FY2026 Targets other 20. August 2026
  Strategic plan detailing €700M cumulative capex (2021-2023), European data center expansion, 2,900 employees across 15 countries, and EU sovereignty positioning.
  Relevance: Shows in-house software engineering is predominantly EU-based, meaning build/release/deployment execution is under EU control and EU jurisdiction
• OVHcloud SecNumCloud Compliance other 21. August 2026
  Official page detailing ANSSI SecNumCloud certification; states services are operated, maintained and monitored exclusively by EU-based personnel.
  Relevance: Confirms software operations are exclusively governed by EU jurisdiction with EU-based personnel and auditable processes—SecNumCloud 3.2 requires exclusive application of European law

Selected answer: Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented Value 71 SEAL 2

Notes: OVHcloud vertically integrates server assembly in EU but depends on non-EU vendors (Intel, AMD, NVIDIA, Samsung) for critical components; these are transparently documented via supplier code, sustainability reports.

Evidence

• OVHcloud — An Open Ecosystem, With Several Ways to Contribute other 21. August 2026
  OVHcloud's ecosystem page naming key hardware partners including Intel, AMD, NVIDIA, Samsung, Cisco — predominantly non-EU vendors for critical components.
  Relevance: Explicitly identifies the non-EU vendors (Intel, AMD, NVIDIA, Samsung) that supply critical components (CPUs, GPUs, memory) to OVHcloud's infrastructure, forming key single points of dependency.
• OVHcloud 2025 Sustainability Statement (Universal Registration Document) other 21. August 2026
  Comprehensive sustainability report confirming upstream value chain includes suppliers in Asia and Africa; 17% IT component reuse rate; 64% emission factors tracked from suppliers.
  Relevance: Transparently documents non-EU supply chain dependencies including raw material/comcomponent sourcing from Asia and Africa, and quantifies component reuse vs. new procurement from external vendors.
• OVHcloud Supply Chain (Official Sustainability Page) other 21. August 2026
  OVHcloud's official supply chain page showing vertical integration, in-house server manufacturing in France and Canada, circular economy practices, and a Supplier Code of Conduct with responsible mineral sourcing policies.
  Relevance: Shows OVHcloud's vertical integration and supplier governance but confirms it still sources critical electronic components from external (non-EU) suppliers for server production.

Selected answer: Most suppliers and subcontractors can be audited Value 107 SEAL 3

Notes: OVHcloud grants on-site audit rights via third-party auditors for direct suppliers and requires exhaustive subcontractor listings. Vertical integration reduces external dependencies. Full deep sub-supplier auditability is limited for component vendors.

Evidence

• OVHcloud Supplier Code of Conduct (Global, Aug 2024) other 21. August 2026
  Group-level Supplier Code requiring responsible mineral sourcing, REACH/RoHS compliance, supply chain mapping to origin, and OVHcloud audit/self-assessment rights.
  Relevance: Establishes contractual audit/verification rights and supply chain transparency obligations for suppliers, but audit is primarily evidence-based, not full on-site for all tiers.
• OVHcloud Supplier Purchasing Terms other 21. August 2026
  Formal purchase order T&Cs with audit rights (on-premises via third-party), subcontractor consent, and exhaustive subcontractor listing requirements.
  Relevance: Directly addresses audit rights for suppliers and subcontractor visibility — includes on-premises compliance assessments and requirement for exhaustive subcontractor listings and subcontract copies.
• OVHcloud Supply Chain (Official Sustainability Page) other 21. August 2026
  OVHcloud's official supply chain page showing vertical integration, in-house server manufacturing in France and Canada, circular economy practices, and a Supplier Code of Conduct with responsible mineral sourcing policies.
  Relevance: Vertical integration reduces number of external suppliers requiring audit; demonstrates production-chain control. Does not cover deep sub-supplier chains of component vendors.

Selected answer: 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation Value 150 SEAL 3

Notes: Public Cloud core uses OpenStack APIs (non-proprietary, interoperable), but some services use OVHcloud-specific REST APIs, preventing a full open-by-default rating.

Evidence

• Open Source: Shaping the Public Cloud — OVHcloud other 21. August 2026
  OVHcloud article detailing its OpenStack-powered Public Cloud, commitment to open APIs, reversibility, and interoperability since 2012.
  Relevance: Confirms OVHcloud uses open-standard OpenStack APIs for compute/storage/network, ensuring hybrid/multi-cloud compatibility and no vendor lock-in.
• OpenStack — OVHcloud other 21. August 2026
  OVHcloud's OpenStack page detailing membership since 2014, use of core OpenStack components (Nova, Neutron, Cinder, etc.), and API compatibility.
  Relevance: Shows OVHcloud Public Cloud infrastructure is fully accessible via documented, non-proprietary OpenStack APIs compatible with standard tools (Terraform, Ansible).
• OpenStack Cloud Architecture — Leafcloud other 21. August 2026
  Independent technical resource comparing OpenStack providers (including OVH) against hyperscalers on vendor lock-in and API standardization.
  Relevance: Independent analysis confirms OVHcloud's OpenStack APIs are low vendor-lock-in, standard REST APIs compatible across providers, contrasting with proprietary hyperscaler APIs.

Selected answer: 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions Value 150 SEAL 3

Notes: OVHcloud documents open standards across Public Cloud (100% OpenStack), reversibility (SWIPO), and ISSP, but some services remain proprietary (e.g., vRack, control panel).

Evidence

• Open Cloud Security Standards - OVHcloud other 21. August 2026
  OVHcloud's security posture page: full supply chain control from hardware to datacenter, in-house server manufacturing, security certifications (ISO 27001, SOC, PCI DSS).
  Relevance: Shows documented corporate policy on open standards adoption across cloud services, including ISO and security certifications built on open standards.
• OVHcloud – Open Source: Shaping the Public Cloud other 20. August 2026
  Details OVHcloud's 100% open-source OpenStack-based public cloud with reversibility, no vendor lock-in, open APIs, and zero egress fees.
  Relevance: Demonstrates formal adoption of open standards (OpenStack) as core architecture with open APIs for interop and reversibility, evidence of policy-level commitment.
• OVHcloud Information System Security Policy (ISSP) other 21. August 2026
  Formal documented security policy stating products are built using open-source technologies and established technology standards to facilitate adoption and reversibility.
  Relevance: Formal policy document mandating open-source and established standards for product development, applicable across OVHcloud group — evidence of governance-level open standards policy.

Selected answer: 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover Value 100 SEAL 3

Notes: OVHcloud uses and contributes to OpenStack (independently governed) but its own 178 GitHub repos are centrally governed by the company, and proprietary management layer limits full autonomy.

No evidence provided for this answer.

Selected answer: Large corpus of public insight exists (all) Value 150 SEAL 3

Notes: OVHcloud publishes extensive architecture docs via OpenStack (open-source), full technical docs portal, public ISSP, and compliance attestations covering all service architecture aspects.

Evidence

• OpenStack — OVHcloud other 21. August 2026
  OVHcloud's OpenStack page detailing membership since 2014, use of core OpenStack components (Nova, Neutron, Cinder, etc.), and API compatibility.
  Relevance: Publicly documents all architectural components, dependencies, and data flow patterns of OVHcloud's Public Cloud built on open-source OpenStack.
• OVHcloud – Open Source: Shaping the Public Cloud other 20. August 2026
  Details OVHcloud's 100% open-source OpenStack-based public cloud with reversibility, no vendor lock-in, open APIs, and zero egress fees.
  Relevance: Demonstrates full transparency of service architecture via 100% open-source OpenStack with documented APIs, data flows, and dependencies — no proprietary lock-in.
• OVHcloud Information System Security Policy (ISSP) other 21. August 2026
  Formal documented security policy stating products are built using open-source technologies and established technology standards to facilitate adoption and reversibility.
  Relevance: Publicly discloses internal security architecture, monitoring data flows (SIEM/CERT), and audit posture — key aspects of service architecture transparency.

Selected answer: Co-designed or integrated in EU Value 100 SEAL 3

Notes: OVHcloud designs/assembles HPC servers in EU but uses AMD/Intel processors and NVIDIA accelerators—no European processor IP in its HPC stack.

Evidence

• OVHcloud Delivers Next-Generation Bare Metal Services with AMD other 21. August 2026
  AMD case study confirming OVHcloud deploys 4th Gen AMD EPYC processors in HPC servers; also describes OVHcloud's in-house server design, manufacturing, and liquid cooling.
  Relevance: Third-party source confirming both foreign processor dependency (AMD) and EU-based server design/assembly, supporting the co-designed/integrated assessment.
• OVHcloud High Performance Computing on Bare Metal other 21. August 2026
  OVHcloud's official HPC page detailing AMD EPYC, Intel Xeon Gold, and NVIDIA V100S-based server ranges for HPC workloads.
  Relevance: Shows OVHcloud's HPC offerings use exclusively non-EU processors (AMD, Intel) and accelerators (NVIDIA); no European silicon in its computing stack.
• OVHcloud Servers: From Production to Delivery other 21. August 2026
  Official page detailing OVHcloud's 10-step server production process: component supply, assembly (8 components in 15 min), quality testing, all done in-house.
  Relevance: Demonstrates EU-based server design, assembly, and manufacturing, which is a distinct form of EU co-design and integration beyond mere hosting of a foreign stack.

Selected answer: EAL4-5 Value 143 SEAL 4

Notes: OVHcloud holds comprehensive EU and international certifications: ISO 27001/27017/27018/27701, SOC 1/2/3, PCI DSS L1, CSA STAR, HDS, and ANSSI SecNumCloud v3.2.

Evidence

• OVHcloud — Security and Certifications (Corporate) other 21. August 2026
  Corporate overview listing ISO 27001/27017/27018, ISO 27701, SOC 1/2/3, CSA STAR, PCI DSS, and SecNumCloud 3.2 qualification from ANSSI.
  Relevance: Comprehensive list of internationally recognized certifications demonstrating attainment across multiple security domains for all assessment scope.
• OVHcloud SecNumCloud Compliance other 21. August 2026
  Official page detailing ANSSI SecNumCloud certification; states services are operated, maintained and monitored exclusively by EU-based personnel.
  Relevance: Directly evidences EU-recognized security certification (SecNumCloud is France's highest cloud security standard, protecting against non-EU extraterritorial laws).

Selected answer: 5. Fully compliant to all well-know EU regulations (verified compliance, independently audited) Value 143 SEAL 4

Notes: GDPR fully compliant & independently audited; ISO/SOC/SecNumCloud certifications strong. NIS2 and DORA not explicitly demonstrated, creating minor gaps.

Evidence

• GDPR-NIS2-DORA Compliant Cloud Architecture: 2026 Integration Guide other 20. August 2026
  Third-party guide recommending OVHcloud as an EU-native provider for GDPR/NIS2/DORA compliance; compares SecNumCloud vs BSI C5 for regulated workloads.
  Relevance: Names OVHcloud among EU-native providers suited for multi-regulation compliance, but highlights that DORA-specific compliance is not yet explicitly demonstrated by OVHcloud.
• OVHcloud — Security and Certifications (Corporate) other 21. August 2026
  Corporate overview listing ISO 27001/27017/27018, ISO 27701, SOC 1/2/3, CSA STAR, PCI DSS, and SecNumCloud 3.2 qualification from ANSSI.
  Relevance: ndependently audited certifications (ISO, SOC, SecNumCloud) demonstrate systematic compliance with EU-equivalent security frameworks supporting GDPR and NIS requirements.
• OVHcloud Legal and Privacy Security other 20. August 2026
  OVHcloud's official legal page listing applicable legal texts per jurisdiction, GDPR compliance, and EU data hosting with protection against extraterritorial laws.
  Relevance: Directly demonstrates GDPR adherence and references to NIS Directive (predecessor to NIS2); confirms EU jurisdiction and DPA enforcement.

Selected answer: 5. The full incident lifecycle is handled by EU-based teams with active participation in ENISA's information sharing frameworks. Threat intelligence and incident data are gathered worldwide Value 143 SEAL 4

Notes: Full incident lifecycle handled by EU-based CSIRT-OVH (France). NIS2 compliance and CSIRT info-sharing align with ENISA frameworks. Threat intelligence gathered worldwide.

Evidence

• CSIRT-OVH RFC 2350 Charter other 21. August 2026
  OVHcloud's official CSIRT charter defining mission, constituency (EMEA/Canada/APAC, excluding OVH US LLC), incident response lifecycle, and information sharing protocols (TLP v2.0).
  Relevance: Confirms EU-based CSIRT handling full incident lifecycle (prevention–recovery). Excludes US entity. Active info-sharing with CSIRTs/CERTs following NIS2/ENISA-aligned TLP protocols. Worldwide threat intelligence exchange.
• Open Cloud Security Standards - OVHcloud other 21. August 2026
  OVHcloud's security posture page: full supply chain control from hardware to datacenter, in-house server manufacturing, security certifications (ISO 27001, SOC, PCI DSS).
  Relevance: Describes SOC and CSIRT teams for threat detection and incident response within a European provider context, supporting EU-exclusive security operations.
• OVHcloud and Data Sovereignty other 20. August 2026
  Official OVHcloud page on data sovereignty, governance structure, CISPE/GAIA-X founding membership, and EU legal jurisdiction.
  Relevance: Confirms no non-EU entity has access to EU customer infrastructure, meaning incident handling for EU customers is exclusively under EU jurisdiction by EU-based teams.

Selected answer: 5. Customers have full access to immutable tamper-proof logs stored exclusively within the EU Value 143 SEAL 4

Notes: OVHcloud Logs Data Platform offers immutable log streams in EU datacenters, with full customer access via Graylog/OpenSearch. SecNumCloud-certified and EU-headquartered.

Evidence

• Generating OVHcloud Account Logs with Logs Data Platform other 20. August 2026
  Official documentation detailing three audit log types: audit logs (IP, geolocation, MFA, user agent), activity logs (API calls, user identity), and access policy logs (IAM evaluations).
  Relevance: Confirms direct customer access to security logs and explicitly states 'data stored in a logs stream is immutable,' aligning with option 5's immutability and EU storage requirements.
• Logs Data Platform – Product Page other 21. August 2026
  OVHcloud's managed log management platform built on OpenSearch ecosystem, supporting Graylog/Grafana, ISO 27001/27017/27701 certified, hosted in EU datacenters.
  Relevance: Demonstrates full customer access to logs via dashboards/API, secure EU-hosted platform, and certifications supporting sovereignty and security monitoring requirements.

Selected answer: 4. Partial compliance - there is a monitored reporting flow with internal SLAs equal or below regulatory maximums; contractually prepared to support EU-directed investigations; data sharing with EU CSIRTs available but not in real-time Value 107 SEAL 3

Notes: Formal CSIRT, GDPR/NIS2-aligned reporting, audit-backed incident management, and CSIRT cooperation — but no evidence of real-time EU CSIRT data sharing.

Evidence

• CSIRT-OVH RFC 2350 Charter other 21. August 2026
  OVHcloud's official CSIRT charter defining mission, constituency (EMEA/Canada/APAC, excluding OVH US LLC), incident response lifecycle, and information sharing protocols (TLP v2.0).
  Relevance: Demonstrates formal CSIRT with structured incident reporting and cooperation with EU CSIRTs, but does not specify real-time data sharing arrangements.
• Open Cloud Security Standards - OVHcloud other 21. August 2026
  OVHcloud's security posture page: full supply chain control from hardware to datacenter, in-house server manufacturing, security certifications (ISO 27001, SOC, PCI DSS).
  Relevance: Shows monitored reporting flow, SOC/CSIRT integration, and audit-backed security processes supporting EU-directed investigation readiness.
• OVHcloud Data Security & Compliance other 20. August 2026
  Details OVHcloud's ISMS, monitoring/logging policies for storage servers and infrastructure, and annual third-party audits (ISO 27001/27017/27018, SOC 2).
  Relevance: Documents formal incident classification, response plans, customer communication procedures, and vulnerability monitoring aligned with GDPR/NIS2 obligations.

Selected answer: 4. High Autonomy - security patches can be deployed independently by the customer, without customers' checks Value 107 SEAL 4

Notes: OVHcloud builds own servers & uses open-source OpenStack, enabling independent EU-based patch development and deployment without non-EU vendor dependency.

Evidence

• OpenStack — OVHcloud other 21. August 2026
  OVHcloud's OpenStack page detailing membership since 2014, use of core OpenStack components (Nova, Neutron, Cinder, etc.), and API compatibility.
  Relevance: Open-source OpenStack platform means OVHcloud can independently develop, test, and apply patches to its cloud infrastructure without dependence on non-EU vendors.
• OVHcloud Service-Specific Terms for Products and Services other 20. August 2026
  Official legal terms detailing automatic and irreversible deletion of content data on service termination, KMS-based cryptographic key deletion, and shared responsibility for data backup.
  Relevance: Shows OVHcloud applies infrastructure patches independently as an EU provider, while customers independently manage their own workload patching without vendor dependency.
• VMware on OVHcloud Maintenance Operations other 21. August 2026
  Documentation detailing maintenance operation types (Emergency, Standard, Normal) and customer patching responsibilities for ESXi hosts.
  Relevance: Shows three-tier maintenance with advance notice. Customers can reschedule maintenance and directly administer ESXi patches independently, demonstrating high patching autonomy.

Selected answer: 4. High control by independent entities to request data from the vendor Value 107 SEAL 1

Notes: OVHcloud offers extensive independent EU-based audits (ANSSI labs, ISO, SOC) but gatekeeps on-site audits via sales; reports under conditions, not unrestricted.

Evidence

• OVHcloud — Security and Certifications (Corporate) other 21. August 2026
  Corporate overview listing ISO 27001/27017/27018, ISO 27701, SOC 1/2/3, CSA STAR, PCI DSS, and SecNumCloud 3.2 qualification from ANSSI.
  Relevance: Demonstrates broad independent third-party audit coverage enabling EU entities to request compliance data across multiple frameworks.
• OVHcloud Data Sovereignty other 21. August 2026
  OVHcloud's data sovereignty commitments: GDPR Art. 48 resistance to non-EU requests, EU-only personnel, CISPE/GAIA-X founding membership.
  Relevance: Establishes EU jurisdictional control over audit and compliance data, ensuring independent EU entities can access data free from non-EU interference.
• OVHcloud SecNumCloud Compliance other 21. August 2026
  Official page detailing ANSSI SecNumCloud certification; states services are operated, maintained and monitored exclusively by EU-based personnel.
  Relevance: Shows independent EU auditors (ANSSI-approved labs) perform security evaluations, but customer-initiated audits are gated through sales, limiting full unrestricted access.

Selected answer: PUE < 1.3 Value 187 SEAL 4

Notes: Fleet-wide PUE 1.24-1.26, audited over 12 months (88% coverage), ISO 50001 certified, with NetZero 2030 roadmap and quantified GHG reduction targets.

Evidence

• OVHcloud Environment & Sustainability other 22. August 2026
  Corporate sustainability page covering ISO 50001 certification, European Code of Conduct participation, audited PUE over 12 months, and GHG reduction targets to FY2030.
  Relevance: Establishes measurable improvement targets (73.4% Scope 1&2 reduction by FY2030), ISO 50001 certification, and audited PUE methodology.
• OVHcloud Sustainability Press Kit other 22. August 2026
  Press kit summarizing OVHcloud's environmental performance: fleet-wide PUE of 1.24, 100% renewable energy, and AI-driven cooling innovations.
  Relevance: Confirms fleet-average PUE of 1.24, which is below the 1.3 threshold, with audited measurement methodology and improvement targets.
• OVHcloud White Paper: Building a Sustainable and Responsible Digital Future (2024) other 22. August 2026
  White paper detailing OVHcloud's PUE range of 1.1-1.3 across all sites, water-cooling tech since 2003, NetZero 2030 commitment, ISO/IEC 30134-2 PUE standard adherence.
  Relevance: Shows PUE range 1.1-1.3 across all data centers with detailed energy efficiency roadmap and measurable NetZero 2030 commitment.

Selected answer: Circular economy EU-aligned Value 187 SEAL 4

Notes: OVHcloud applies full circular economy principles end-to-end: design for disassembly, reverse supply chain with 6 stages, component reuse across server generations, and certified recycling partners—aligned with EU goals.

Evidence

• OVHcloud — Our Commitment to Green Technology other 22. August 2026
  OVHcloud's green tech page covering circular economy principles applied since founding, servers designed for full disassembly and component reuse, and in-house manufacturing in France and Canada.
  Relevance: Demonstrates long-standing, documented circular economy practices for hardware: servers designed for reuse, recycling, and repair, with second and third lives for components.
• OVHcloud Supply Chain Sustainability other 22. August 2026
  OVHcloud's corporate page detailing a six-stage reverse supply chain model: Creating, Maintaining, Redistributing, Testing, Reusing, and Recycling, with certified recycling partners for end-of-life.
  Relevance: Directly documents the full circular economy lifecycle for hardware—from design to certified recycling—showing EU-aligned reuse and responsible end-of-life treatment.
• OVHcloud White Paper: Building a Sustainable and Responsible Digital Future (2024) other 22. August 2026
  White paper detailing OVHcloud's PUE range of 1.1-1.3 across all sites, water-cooling tech since 2003, NetZero 2030 commitment, ISO/IEC 30134-2 PUE standard adherence.
  Relevance: Provides quantified evidence (45% reused components, ECO range, zero-waste goal) of a formally documented circular economy program aligned with EU sustainability objectives.

Selected answer: EU-audited reporting Value 250 SEAL 4

Notes: CSRD-compliant, third-party audited reporting (KPMG/IJO) covering Scope 1-3 emissions, PUE/WUE, EU Taxonomy, per EU frameworks.

Evidence

• OVHcloud 2025 Sustainability Statement (Universal Registration Document) other 21. August 2026
  Comprehensive sustainability report confirming upstream value chain includes suppliers in Asia and Africa; 17% IT component reuse rate; 64% emission factors tracked from suppliers.
  Relevance: Confirms compliance with EU's mandatory sustainability reporting framework (CSRD), which requires standardized disclosure and third-party assurance of environmental indicators including carbon and water.
• OVHcloud Environmental Impact Tracker Methodology (PDF) other 22. August 2026
  25-page methodology document detailing per-server GHG calculations using GHG Protocol and Bilan Carbone®, audited by IJO and Cost House with Limited Assurance Statement.
  Relevance: Shows detailed, third-party-audited methodology for measuring carbon emissions at server level, with site-specific PUE/WUE values and plans to expand to water, abiotic resources, and land use.
• OVHcloud Non-Financial Performance Statement FY2024 (DPEF) other 22. August 2026
  Comprehensive ESG disclosure for FY2024 audited by KPMG (COFRAC-accredited), covering Scope 1-3 emissions, PUE/WUE/CUE/REF, EU Taxonomy alignment (66% revenue).
  Relevance: Demonstrates EU-regulated, independently audited environmental reporting including carbon emissions, water usage (WUE), and EU Taxonomy alignment — directly relevant to transparent sustainability disclosure.

Selected answer: Mix of EU and non-EU supplies Value 125 SEAL 4

Notes: OVHcloud operates data centers in EU and non-EU countries; 92% renewable energy via EU PPAs but non-EU sites use local grids and nuclear included in low-carbon mix.

Evidence

• OVHcloud — Our Datacenter Locations other 22. August 2026
  OVHcloud's official data center locations page listing 46 data centers across 9 countries on 4 continents, including EU and non-EU sites.
  Relevance: Shows OVHcloud operates data centers in both EU (France, Germany, Italy, Poland) and non-EU countries (USA, Canada, Australia, Singapore, India, UK), confirming mixed energy supply origins.
• OVHcloud Environment & Sustainability other 22. August 2026
  Corporate sustainability page covering ISO 50001 certification, European Code of Conduct participation, audited PUE over 12 months, and GHG reduction targets to FY2030.
  Relevance: Details OVHcloud's energy sourcing commitments including renewable energy ratio and transition to 100% low-carbon (not 100% green) energy by 2025.
• OVHcloud signs 10-year PPA with Sunnic Lighthouse to power German data center other 22. August 2026
  Article reporting OVHcloud's 10-year solar PPA with Sunnic Lighthouse for its German data center, increasing renewable share to 92%.
  Relevance: Confirms EU-specific renewable PPA and 100% low-carbon (not exclusively green) target by 2025, while non-EU sites rely on local grid energy.