Scaleway – Europe’s empowering cloud provider

Scaleway Wallpaper

Scaleway is a French cloud computing and web hosting company, founded in 1999 and a majority owned subsidiary of the Iliad group. As many players, the company started as a traditional server hosting company. Since 2015, they are building their cloud computing business. Since then, Scaleway is fully focusing on creating a compelling, fully integrated cloud product. For the operation of data centres, Scaleway is partnering with local partners.

In July 2026, Scaleway was selected by Airbus as their sovereign cloud provider.

Airbus Selects Scaleway as Its Sovereign Cloud Provider to Drive Digital Sovereignty

Just in April 2026, Scaleway was selected as one of four cloud providers by the European Commission in a €180M tender. As part of the tender process, Scaleway was officially recognized as SEAL-3 according to the EU’s Cloud Sovereignty Framework.

European Commission Advances Digital Sovereignty with New Cloud Contracts

Features & Services

Scaleway has a wide set of services that are well integrated. Worth highlighting are the serverless services for Functions, Containers and Jobs and the serverless SQL database. A unique speciality in the Scaleway service portfolio are the managed Mac machines. Scaleway offers several managed LLMs that are very easy to use behind a OpenAI-compatible API.

Scaleway view themselves as a software company primarily. This shines through in a very polished product that is well-designed through and through – from the console over the API and the SDK, to the Terraform provider.

Developer Experience

Scaleway is following an API-first approach with their product development. The console, the SDK, Terraform provider and all other ways to interact with the Scaleway cloud are following the API. New products are typically released through the API at beta launch. Once stabilized, Terraform and the other tooling follows and the product is surfaced in the console.

API

The Scaleway API follows API design best practices and is straightforward to use.

With Terraform, CLI and SDKs on top of the API, the situations where it is necessary to fall back to it may be fairly rare. One case would be when using Beta products, where the other developer tooling has not yet caught up.

Terraform Provider

The Terraform provider follows the API and is therefore straightforward and easy to use. The official documentation can be found on the Terraform registry page about the Scaleway Provider.

An end to end example for using the Scaleway Terraform provider is here: N8N on a Scaleway Instance.

CLI

The Command Line Interface (Scaleway CLI) as well follows the API in its structure and with naming and parameters.

SDKs

Scaleway is officially maintaining SDKs for Go, Javascript and Python. Because they are all following the API structure and naming, they are very easy to use and to transition between.

Console

The Scaleway console is very clean, very well designed and intuitive to get around.

The Scaleway Console is very polished and well designed

The price for cleanness of the console is that not all resource data is surfaced. E.g. if you must collect all resource IDs for terraform import, you may have to fall back to using the API or the CLI for some of them.

Other Tools and Integrations

There are a number of additional tools and integrations, such as the

Scaleway Developers Tools contains a full overview over all available tools and integrations. A noteworthy highlight is the integration with the Serverless Framework: Scaleway Plugin for Serverless Framework.

Sovereignty Assessment

For the sovereignty assessment, we are following the EU's Cloud Sovereignty Framework. It defines 8 sovereignty objectives and makes sovereignty measurable and quantifiable.

Disclaimer: this assessment is conducted as an outside-in analysis, based on public information and, for some questions, educated guessing. The results may be factually wrong and in no way replace your own due diligence.

Overall Score

81.8 %

SEAL Level

SEAL 2

Sovereignty Assessment

Sovereignty Assessment Details
Provider
Scaleway
Framework
Initial framework from the Sovereignty assessment calculator annex (v1.0)
Assessment date
21. August 2026
Overall score
81.8 %
SEAL level
SEAL 2

SOV-1 — Strategic Sovereignty

Strategic sovereignty captures the degree to which a cloud provider (or technology actor) is anchored within the European Union/EEA legal, financial, and industrial ecosystem. It assesses ownership stability, governance influence, and alignment with EU strategic priorities.

Weight 20%

Q1. EU/EEA legal entity control - ensuring that ultimate decision-making authority resides within EU jurisdiction.

Selected answer: 4. Entirely within the EU Value 125 SEAL 4

Notes: Scaleway SAS is a French entity wholly owned by Iliad Group (Euronext Paris), controlled by Xavier Niel via iliad Holding. Entire ownership chain resides in the EU.

Evidence

  • About Scaleway — Official Website other 29. August 2026
    Scaleway is a subsidiary of the iliad Group, operating cloud regions across France, Poland, Italy, and Netherlands with 100% European teams and operations.
    Relevance: Confirms Scaleway is a subsidiary of Iliad Group (French/EU entity) with all operations and teams based in Europe, reinforcing EU jurisdictional control.
  • Scaleway — Wikipedia other 29. August 2026
    Scaleway is a French cloud computing company, a majority-owned subsidiary of Iliad SA group, founded by Xavier Niel, headquartered in Paris.
    Relevance: Confirms Scaleway is a French legal entity subsidiary of Iliad SA, a French group. Entire ownership and governance chain is within the EU/EEA.
  • Scaleway Selected by the European Commission to Deliver a Sovereign Public Cloud & AI Platform to EU Institutions other 29. August 2026
    Scaleway selected under EU Commission Cloud III DPS. Described as 100% European-owned, operating solely under European jurisdiction, immune to non-EU interference.
    Relevance: Officially confirms Scaleway as 100% EU-owned with all decision-making under European jurisdiction, directly addressing the assessment question.
All possible answer options (4)
  • 1. Entirely outside the EU (value 0.00, SEAL 1)
  • 2. Mostly outside the EU (value 41.00, SEAL 1)
  • 3. Mostly within the EU (value 83.00, SEAL 3)
  • 4. Entirely within the EU (value 125.00, SEAL 4) ✓
Q2. Change of Control Risk - evaluating the likelihood of takeover or transfer to non-sovereign owners

Selected answer: 5. Very unlikely Value 125 SEAL 4

Notes: Iliad (Scaleway's parent) was taken private in 2021 by founder Xavier Niel (~71% control). Private European ownership makes takeover by non-EU entity very unlikely.

Evidence

  • Iliad Soars 62% After Buyout Offer From Billionaire Niel — DataCenterKnowledge (Bloomberg) other 29. August 2026
    Covers Xavier Niel's 2021 take-private buyout of Iliad SA (~€10.85B), consolidating ~71% ownership and delisting Iliad from public markets.
    Relevance: Taking Iliad private eliminated hostile takeover risk via public markets; Niel's controlling stake makes change of control by non-EU parties virtually impossible.
  • Scaleway — Wikipedia other 29. August 2026
    Scaleway is a French cloud computing company, a majority-owned subsidiary of Iliad SA group, founded by Xavier Niel, headquartered in Paris.
    Relevance: Confirms Scaleway is a majority-owned subsidiary of Iliad SA, a French/European group controlled by French founder Xavier Niel — no non-EU ownership exposure.
  • The French Billionaire Who Quietly Amassed a Telecom Empire — TeleGeography other 29. August 2026
    Analyzes Xavier Niel's telecom empire via holding companies (NJJ Capital, Atlas Investissement, Iliad), with ~71% control of Iliad and Scaleway.
    Relevance: Maps Niel's controlling ownership chain over Iliad/Scaleway through European holding structures, confirming no foreign ownership pathway or change-of-control exposure.
All possible answer options (5)
  • 1. Very likely (value 0.00, SEAL 4)
  • 2. Likely takeover by or transfer to a non-EU sovereign entity (value 31.00, SEAL 4)
  • 3. Somewhat likely takeover by or transfer to a non-EU sovereign entity (value 62.00, SEAL 4)
  • 4. Unlikely takeover by or transfer to a non-EU sovereign entity (value 93.00, SEAL 4)
  • 5. Very unlikely (value 125.00, SEAL 4) ✓
Q3. Control Over Roadmap - measuring the capacity of EU stakeholders to shape the provider’s technological and service evolution.

Selected answer: 4. Full influence of EU actors Value 125 SEAL 4

Notes: Scaleway is 100% EU-owned (Iliad/Xavier Niel). All governance, ownership, and decision-makers are EU-based. EU institutions, regulators, and public-private partnerships fully shape its roadmap with no non-EU influence.

Evidence

  • Scaleway Accelerates Its European Expansion with Three Major Milestones other 29. August 2026
    Announces German availability zone, City of Copenhagen selection, and ECB digital euro project role. Presented at French-German Forum on Digital Sovereignty.
    Relevance: Demonstrates EU institutional partnerships (ECB, Copenhagen, German forum) directly shaping Scaleway's expansion roadmap and infrastructure investment decisions.
  • Scaleway Selected by the European Commission to Deliver a Sovereign Public Cloud & AI Platform to EU Institutions other 29. August 2026
    Scaleway selected under EU Commission Cloud III DPS. Described as 100% European-owned, operating solely under European jurisdiction, immune to non-EU interference.
    Relevance: Shows EU institutional framework directly shaping Scaleway's roadmap and compliance path. EC sovereignty framework sets product requirements that Scaleway must meet.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Shows Scaleway's entire strategic direction is shaped by EU actors — EU Parliament resolutions, EC tenders, and EU legislation. No non-EU influence on roadmap exists.
All possible answer options (4)
  • 1. No influence possible (value 0.00, SEAL 2)
  • 2. Through "voice of the customer" public channels (e.g. feedback portals, online communities) (value 41.00, SEAL 2)
  • 3. Governance bodies exist with EU actors participation (value 83.00, SEAL 3)
  • 4. Full influence of EU actors (value 125.00, SEAL 4) ✓
Q4. Financial independence from non-EU capital - degree to which the provider relies on EU-based financing rather than external capital.

Selected answer: 5. Entirely EU-based funding Value 125 SEAL 4

Notes: Iliad Group (Scaleway's parent) is ~97% controlled by French Niel family; delisted 2021. No non-EU capital involvement. All financing EU-based.

Evidence

All possible answer options (5)
  • 1. Almost entirely relying on non-EU funding (value 0.00, SEAL 4)
  • 2. Mostly relying on non-EU funding (value 31.00, SEAL 4)
  • 3. Balanced mix of EU and non-EU funding (value 62.00, SEAL 4)
  • 4. Majority of funding is EU-based (value 93.00, SEAL 4)
  • 5. Entirely EU-based funding (value 125.00, SEAL 4) ✓
Q5. EU economic contribution - extent of investment, jobs, and value creation within EU/EEA.

Selected answer: 5. Fully in the EU Value 125 SEAL 4

Notes: 100% European-owned, all employees in EU, €3B parent investment, 68c/€ reinvested in EU economy, operations exclusively in EU member states.

Evidence

  • Scaleway — Wikipedia other 29. August 2026
    Scaleway is a French cloud computing company, a majority-owned subsidiary of Iliad SA group, founded by Xavier Niel, headquartered in Paris.
    Relevance: Confirms Scaleway is 100% European-owned with all operations, jobs, and data centers located in EU member states.
  • Scaleway Launches New Cloud Region in Italy — Official Press Release other 29. August 2026
    Announces Milan cloud region as part of €3B Iliad Group investment; 90% European infrastructure vendors; 5,000+ GPUs.
    Relevance: Shows scale of EU investment (€3B program), European supplier base (90%), and expanding EU footprint with jobs and infrastructure.
  • Scaleway Selected by the European Commission to Deliver a Sovereign Public Cloud & AI Platform to EU Institutions other 29. August 2026
    Scaleway selected under EU Commission Cloud III DPS. Described as 100% European-owned, operating solely under European jurisdiction, immune to non-EU interference.
    Relevance: Direct evidence of EU economic contribution: 68c/€ reinvested in EU, all R&D and teams in Europe, no external non-EU funding.
All possible answer options (5)
  • 1. Minimal (value 0.00, SEAL 4)
  • 2. Some (value 31.00, SEAL 4)
  • 3. Balanced EU/non-EU (value 62.00, SEAL 4)
  • 4. Majority in the EU (value 93.00, SEAL 4)
  • 5. Fully in the EU (value 125.00, SEAL 4) ✓
Q6. Participation in EU strategic programs - involvement in initiatives such as IPCEI-CIS, Horizon Europe, or Gaia-X.

Selected answer: 2. Active participant in strategic projects Value 62 SEAL 4

Notes: Co-founded Gaia-X but left in 2022; not in IPCEI-CIS. Selected for EC's €180M sovereign cloud tender (SEAL-3), showing active strategic engagement.

Evidence

All possible answer options (3)
  • 1. No clear participation (value 0.00, SEAL 4)
  • 2. Active participant in strategic projects (value 62.00, SEAL 4) ✓
  • 3. Strategic projects depend on contractor's involvement (value 125.00, SEAL 4)
Q7. Alignment with EU industrial strategies - consistency with digital, green, and industrial sovereignty objectives defined at EU level.

Selected answer: Already measured achievement and existing dedicated governance Value 83 SEAL 4

Notes: Scaleway has measured achievements (EC Cloud III, IPCEI, SBTi targets, EcoVadis Gold) and dedicated governance (sovereignty manifesto, annual impact reports).

Evidence

  • 5 Key Elements for Europe to Achieve Sovereign AI — Scaleway Blog other 29. August 2026
    Scaleway-authored article outlining alignment with EU AI strategy, EC €2B innovation plan, AI Action Summit InvestAI, European Chips Act, and sovereign AI infrastructure.
    Relevance: Directly ties Scaleway's industrial positioning to EU digital and industrial sovereignty strategies (Chips Act, AI Action Summit), showing strategic alignment beyond cloud services.
  • Scaleway Environmental Leadership other 29. August 2026
    Scaleway's environmental page: net-zero by 2050, SBTi-validated targets, PUE 1.37, 100% renewable energy, circular economy programs, EcoVadis Gold Medal, annual impact reports.
    Relevance: Shows measured green achievements with concrete KPIs (PUE, WUE, SBTi) and dedicated governance (annual reports), directly aligned with EU Green Deal and twin transition objectives.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Demonstrates dedicated governance structure aligning Scaleway's strategy with EU digital sovereignty objectives. Shows formal institutional commitment, not just aspirational statements.
All possible answer options (3)
  • Existing Action plan (how to measure ambition? Through means linked to the goals? Relative to the size of the company?) (value 41.00, SEAL 4)
  • Already measured achievement and existing dedicated governance (value 83.00, SEAL 4) ✓
  • Bold ambition and dedicated means (value 125.00, SEAL 4)
Q8. Resilience to Cut-off - ability to sustain secure operations even if vendor support is withdrawn or disrupted.

Selected answer: 5. Full autonomy and continuity Value 125 SEAL 4

Notes: Scaleway's in-house stack, open-source foundations, and EU ownership enable sourcing alternatives and internalising functions if dependencies are disrupted.

Evidence

  • LinkedIn Post by Damien Lucas (CEO Scaleway) — "The Fight for a European Cloud Is NOT a Lost Cause" other 29. August 2026
    Scaleway CEO's speech at France's National Assembly highlighting 100% European sovereignty, in-house stack development, and avoidance of third-party 'kill switch' dependencies.
    Relevance: CEO explicitly states Scaleway develops its stack in-house and leverages open source to avoid dependencies that could give a third party a kill switch over customer operations.
  • Scaleway — "Open Black Box" Campaign other 29. August 2026
    Scaleway's official page detailing its open-source-first stack built on Linux, Kubernetes, PostgreSQL, RISC-V, and OpenBMC, with zero egress fees and no vendor lock-in.
    Relevance: Demonstrates Scaleway's ability to internalise key functions via in-house and open-source technology, reducing dependency on any single external supplier or ecosystem.
  • What is a Sovereign Cloud? — Scaleway Blog other 29. August 2026
    Scaleway's explainer on sovereign cloud principles including jurisdictional control, operational governance, and technical autonomy, with EU infrastructure and staff.
    Relevance: Explains how Scaleway's EU-based infrastructure, 100% European staff, and open-standards approach provide operational resilience against external disruption.
All possible answer options (4)
  • 2. Service would likely stop but with a delay to provide time for customer reaction (value 31.00, SEAL 0)
  • 3. Can continue temporarily based on contractual agreement with EC (value 62.00, SEAL 2)
  • 4. Ability to source alternative suppliers or internalise key functions (value 93.00, SEAL 2)
  • 5. Full autonomy and continuity (value 125.00, SEAL 4) ✓

SOV-2 — Legal & Jurisdictional Sovereignty

Legal & Jurisdictional sovereignty evaluates the legal environment, exposure to foreign authority, and enforceability of rights that govern a technology provider and its services. It determines the extent to which a provider is anchored in European jurisdiction and insulated from external legal claims.

Weight 10%

Q1. Primary Legal Jurisdiction - the national legal system governing the provider’s operations and contracts.

Selected answer: 3. Exclusively EU law Value 167 SEAL 4

Notes: Scaleway SAS is a French company under French law, owned 100% by Iliad SA (France). Contracts governed by French law, disputes at Paris Commercial Court. No US entity in ownership chain; not subject to CLOUD Act.

Evidence

  • About Scaleway — Official Website other 29. August 2026
    Scaleway is a subsidiary of the iliad Group, operating cloud regions across France, Poland, Italy, and Netherlands with 100% European teams and operations.
    Relevance: Confirms Scaleway operates exclusively under EU jurisdiction with no non-EU legal exposure, directly supporting the assessment of primary legal jurisdiction.
  • Scaleway EU Cloud 2026: Complete Sovereignty Analysis other 29. August 2026
    Third-party legal analysis of Scaleway's CLOUD Act exposure finding it is not a 'US person', has no US entity in ownership chain, and French blocking statute protects against foreign demands.
    Relevance: Independent legal analysis confirms Scaleway operates exclusively under EU/French law with no US jurisdiction exposure, scoring 1/25 on CLOUD Act vulnerability vs 21-23 for US providers.
  • Scaleway Legal Notice — Official Website other 29. August 2026
    Official legal notice confirming Scaleway SAS is a French SAS entity registered at RCS Paris, with all legal frameworks and dispute resolution anchored in French law and French courts.
    Relevance: Directly establishes that Scaleway's primary legal jurisdiction is French/EU law: French legal entity, French court jurisdiction, no foreign legal authority referenced.
All possible answer options (3)
  • 1. Non-EU only (value 0.00, SEAL 1)
  • 2. Mixed EU/non-EU (value 84.00, SEAL 1)
  • 3. Exclusively EU law (value 167.00, SEAL 4) ✓
Q2. Extraterritorial Laws - degree of exposure to non-EU laws with cross-border reach (all).

Selected answer: Verified legal immunity, non-EU laws unenforceable Value 167 SEAL 4

Notes: 100% European ownership (Iliad Group, FR) structurally shields Scaleway from CLOUD Act/FISA; validated by Airbus & EC selections.

Evidence

All possible answer options (4)
  • Mitigation clauses, exposure remains (value 41.00, SEAL 1)
  • EU subsidiary with contractual protections (value 83.00, SEAL 1)
  • Legal structures shielding from foreign law (value 125.00, SEAL 2)
  • Verified legal immunity, non-EU laws unenforceable (value 167.00, SEAL 4) ✓
Q3. Data Access Pathways - existence of legal, contractual, or technical channels through which non-EU authorities could compel access to data or systems.

Selected answer: 5. Non-EU authorities requests to access data or systems are always rejected by the provider Value 167 SEAL 4

Notes: Scaleway is 100% EU-owned (Iliad/FR) with no US nexus — no CLOUD Act/FISA exposure. Non-EU access requests lack legal basis and are rejected; foreign govts must use MLAT via FR courts.

Evidence

  • Airbus Makes Protection from Extraterritorial Law a Scored Criterion in its Cloud Tender other 29. August 2026
    Airbus selected Scaleway as sovereign cloud partner after formally scoring protection against non-European extraterritorial legislation.
    Relevance: Confirms enterprise validation that Scaleway, as a French/EU-provider, is immune to CLOUD Act extraterritorial reach — no non-EU access pathway exists.
  • European Sovereignty's True Test: Ownership other 29. August 2026
    Analysis of why data sovereignty follows provider ownership, not geography; highlights Scaleway as genuinely sovereign with no CLOUD Act exposure.
    Relevance: Explains the legal mechanism: no US parent company means no CLOUD Act jurisdiction, so non-EU authorities have no legal channel to compel Scaleway's data.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Directly states Scaleway's 100% European ownership means no CLOUD Act exposure — no legal pathway for non-EU authorities to compel data access.
All possible answer options (4)
  • 2. Non-EU authorities can compel access to data or systems without customers being notified, in specific cases (value 41.00, SEAL 1)
  • 3. Non-EU authorities can compel access to data or systems with customers being notified in all cases (value 83.00, SEAL 1)
  • 4. Non-EU authorities requests to access data or systems are disputed by the provider and eventually in some cases are accepted with customers being notified (value 125.00, SEAL 1)
  • 5. Non-EU authorities requests to access data or systems are always rejected by the provider (value 167.00, SEAL 4) ✓
Q4. Export Control Restrictions - applicability of international regimes such as ITAR or EAR, which may restrict usage or transfer.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: Scaleway is fully EU-owned (Iliad/FR) with no US corporate chain, insulating most of its offer from ITAR/EAR for EU MSs and intl orgs like the EC.

Evidence

  • Airbus Makes Protection from Extraterritorial Law a Scored Criterion in its Cloud Tender other 29. August 2026
    Airbus selected Scaleway as sovereign cloud partner after formally scoring protection against non-European extraterritorial legislation.
    Relevance: Demonstrates that a major European enterprise independently validated Scaleway's immunity from US export controls (ITAR/EAR) for both EU-based and internationally-facing workloads, supporting the assessment answer.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Confirms Scaleway operates solely under EU law with no US corporate chain, meaning ITAR/EAR export controls cannot be extraterritorially applied to its core cloud services for EU MSs or international organizations.
  • What is a Sovereign Cloud? — Scaleway Blog other 29. August 2026
    Scaleway's explainer on sovereign cloud principles including jurisdictional control, operational governance, and technical autonomy, with EU infrastructure and staff.
    Relevance: Directly addresses how the EU Cloud Sovereignty Framework draws on export control practices and Scaleway's positioning as a provider whose infrastructure is hosted and operated 100% in Europe under EU law.
All possible answer options (4)
  • Restrictions exists towards EU citizens or international organisations (value 41.00, SEAL 1)
  • Share of revenues >50% in the EU (value 83.00, SEAL 2)
  • Part of the offer cannot be exposed to restrictions towards EU MSs (value 125.00, SEAL 3)
  • Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations (value 167.00, SEAL 4) ✓
Q5. Origin of IP - location of intellectual property creation, registration, and development (all).

Selected answer: 5. Fully within the EU Value 167 SEAL 4

Notes: Scaleway's IP creation, registration (Scaleway SAS, French entity), and development (Paris/Lille) are all within the EU. Partnerships with European research institutions and French startups confirm EU-based IP.

Evidence

  • Airbus Picks Iliad's Scaleway for AI, Defence Work in Sovereignty Push — Reuters other 29. August 2026
    Reuters reports Airbus selected Scaleway to handle IP, R&D, and sensitive data, explicitly requiring European partners for intellectual property management.
    Relevance: Airbus assessed IP protection as a key criterion, confirming Scaleway develops and holds IP entirely within Europe.
  • European Cloud & AI Strategic Autonomy — Scaleway News other 29. August 2026
    Scaleway announces IP development partnerships with French startups (VSORA, Quobly) and research institutions (GENCI, CNRS), all European-based.
    Relevance: Demonstrates IP creation and R&D partnerships are exclusively with French/European entities, confirming EU-anchored IP development.
  • Scaleway Legal Notice — Official Website other 29. August 2026
    Official legal notice confirming Scaleway SAS is a French SAS entity registered at RCS Paris, with all legal frameworks and dispute resolution anchored in French law and French courts.
    Relevance: Confirms IP registration and ownership is anchored in France under French law, with no foreign jurisdiction involvement.
All possible answer options (4)
  • 2. Mostly outside the EU (value 41.00, SEAL 4)
  • 3. Mixed within/outside the EU (value 83.00, SEAL 4)
  • 4. Mostly within the EU (value 125.00, SEAL 4)
  • 5. Fully within the EU (value 167.00, SEAL 4) ✓
Q6. IP Holder Jurisdiction - legal jurisdiction where IP rights are owned and enforced.

Selected answer: fully under EU law Value 167 SEAL 4

Notes: Scaleway SAS (France) owns IP; Iliad SA parent is EU; R&D 100% European; no US entity; French blocking statute shields foreign claims

Evidence

  • Complete Sovereignty Analysis (CLOUD Act) other 29. August 2026
    Third-party analysis proving Scaleway is not a US person; no US entity in ownership chain; French blocking statute protects IP/data from foreign demands.
    Relevance: Confirms the entire ownership chain and IP holder jurisdiction is European with no non-EU legal exposure.
  • Iliad Group Universal Registration Document 2024 other 29. August 2026
    Official corporate filing: 96.27% Niel family ownership via French holding companies; discloses Group IP strategy and lists Scaleway as subsidiary.
    Relevance: Confirms parent Iliad SA is French, all IP strategy is anchored in EU jurisdiction, with no non-EU parent or controller.
  • Scaleway Legal Notice other 29. August 2026
    Confirms Scaleway SAS is a French SAS entity registered at RCS Paris; all legal frameworks anchored in French/EU law, including IP.
    Relevance: Shows the legal entity owning IP is a French SAS, meaning IP is held and enforced under French/EU jurisdiction.
All possible answer options (4)
  • non-EU law, mixed non-EU countries (value 41.00, SEAL 3)
  • Mixed law, some EU (value 83.00, SEAL 3)
  • EU law with exceptions (value 125.00, SEAL 4)
  • fully under EU law (value 167.00, SEAL 4) ✓

SOV-3 — Data & AI Sovereignty

Data & AI sovereignty focuses on the protection, control, and independence of data assets and AI services within the EU/EEA. It addresses how data is secured, where it is processed, and the degree of autonomy customers retain over AI capabilities.

Weight 10%

Q1. Customer control over encryption keys

Selected answer: 5. Customer exclusive control - provider can not read the data Value 200 SEAL 4

Notes: Scaleway KMS keys are non-exportable & non-viewable by any employee; SSE-C and client-side encryption give zero provider access to data.

Evidence

  • Choosing the Best Strategy for Object Storage Encryption — Scaleway Blog other 29. August 2026
    Blog comparing four encryption strategies. Client-Side Encryption offers absolute zero-trust; SSE-C keys discarded after use; SSE-KMS deletion makes data unreadable even to Scaleway staff.
    Relevance: Demonstrates multiple encryption modes where the provider cannot read data, including CSE (absolute zero-trust) and SSE-C (keys never stored). Supports customer-exclusive control.
  • Scaleway Key Manager (KMS) Product Page other 29. August 2026
    Official KMS product page. Keys never leave service, cannot be exported or viewed in plaintext — not even by Scaleway employees. Protected by Root Encryption Key per region.
    Relevance: Directly confirms customer-exclusive control: provider cannot access key material. Customers control full key lifecycle including irreversible deletion making data unrecoverable.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Establishes sovereignty-by-design commitment and encryption key control as a foundational design principle of Scaleway's cloud offering.
All possible answer options (4)
  • 2. Primarily the provider but not exclusively (value 50.00, SEAL 1)
  • 3. Shared - provider has override keys (value 100.00, SEAL 2)
  • 4. Customer primary control but provider can read the data or some of the data (value 150.00, SEAL 3)
  • 5. Customer exclusive control - provider can not read the data (value 200.00, SEAL 4) ✓
Q2. Transparent data flows & access logs - visibility into when, where, and by whom data is accessed, including auditability of AI model usage.

Selected answer: 5. Real-time customer oversight and independent auditability Value 200 SEAL 4

Notes: Scaleway Audit Trail logs all access (user, IP, timestamp, method) with real-time alerts, AI model API tracking, and third-party export (Splunk/Datadog) for independent audit.

Evidence

  • Audit Trail | Scaleway other 29. August 2026
    Official Scaleway Audit Trail product page. Logs every API call with principal, IP, timestamp, method, and status. Features real-time alerts, export to Object Storage with Object Lock, and regional EU storage.
    Relevance: Directly evidences customer-controlled visibility of who/what/when/where data is accessed, with real-time alerting and tamper-proof export for independent auditability.
  • Monitor Scaleway with Datadog other 29. August 2026
    Datadog blog (June 2026) on integrating Scaleway Cockpit and Audit Trail logs into Datadog for centralized, real-time monitoring, alerting, and compliance correlation.
    Relevance: Demonstrates independent third-party auditability: Audit Trail events forwarded to Datadog for real-time analysis, role-based alerts, and out-of-the-box dashboards for compliance reviews.
  • Understanding Cockpit and Audit Trail — Scaleway Blog other 29. August 2026
    Scaleway blog post explaining how Cockpit (real-time observability) and Audit Trail (governance/compliance) complement each other for security and regulatory compliance.
    Relevance: Confirms real-time customer oversight via Cockpit and tamper-proof audit logging via Audit Trail, supporting the assessment of both real-time visibility and independent auditability.
All possible answer options (4)
  • 2. Basic logs incomplete (missing date; missing user; missing type of access; missing means of access etc.) (value 50.00, SEAL 1)
  • 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) (value 100.00, SEAL 2)
  • 4. Full customer controlled visibility of log access but not in real time (value 150.00, SEAL 3)
  • 5. Real-time customer oversight and independent auditability (value 200.00, SEAL 4) ✓
Q3. Secure deletion & proof of erasure od data - mechanisms guaranteeing irreversible removal of data, with verifiable evidence.

Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3

Notes: Scaleway Audit Trail logs all deletion API calls with full metadata; data erasure is irreversible. No evidence of independent verification of deletion.

Evidence

  • Scaleway Audit Trail Documentation other 29. August 2026
    Scaleway's Audit Trail product logs all API calls including DELETE operations with principal identity, timestamp, source IP, and request status across the organization.
    Relevance: Shows deletion events are technically verified via access logs with who/when/how metadata, matching option 4 — deletion technically verified with access logs.
  • Scaleway GDPR — Manage Your Personal Data other 29. August 2026
    Scaleway's official GDPR documentation describing the account and data erasure process — irreversible, takes up to 72 hours, requires payment clearance and no running resources.
    Relevance: Confirms Scaleway offers technically enforced irreversible data erasure with defined process, but no mention of independent verification of each deletion act.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Confirms certifications underpinning data security practices but no evidence of independent third-party verification of individual data deletion events as required for option 5.
All possible answer options (4)
  • 2. Manual confirmation only (value 50.00, SEAL 1)
  • 3. Internal validation based on policies - no proof of validation left (value 100.00, SEAL 1)
  • 4. Deletion is technically verified with access logs (value 150.00, SEAL 3) ✓
  • 5. Yes, irreversible deletion is systematically enforced and independently verified (value 200.00, SEAL 4)
Q4. Data location strictly in EU/EEA – strict confinement of storage and processing to European jurisdictions, with no fallback to third countries.

Selected answer: 5. All data exclusively in the EU with no third-country fallback Value 200 SEAL 4

Notes: All 10+ data centers are in EU/EEA (FR, NL, PL, IT). 100% EU-owned, no US entity, no third-country data centers. Customer cloud data is exclusively in EU/EEA.

Evidence

  • GDPR-Compliant AI for Clinics: Why Your Patient Data Stays in Europe other 29. August 2026
    Third-party customer case study from Voicare.ai documenting their migration to Scaleway, citing 'No third-country transfers' and 'Data centres exclusively in the EU.'
    Relevance: Independent customer confirms all Scaleway data processing occurs within EU/EEA with no third-country transfers, eliminating the need for SCCs or Transfer Impact Assessments.
  • Public Sector Solutions | Scaleway other 29. August 2026
    Scaleway's public sector page listing all 10 data centers across 4 European regions (Paris, Amsterdam, Warsaw, Milan) with no presence outside the EU/EEA.
    Relevance: Confirms all data centers are located exclusively in Europe across 4 EU regions, with no data center presence in any third country.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Directly states Scaleway is 100% European-owned, operates solely under EU jurisdiction, and data is subject exclusively to EU law — confirming no third-country data processing or fallback.
All possible answer options (4)
  • 2. Data partly in the EU, significant reliance on third countries and limited control (value 50.00, SEAL 0)
  • 3. Data mainly in the EU, some third-country use with standard safeguards (value 100.00, SEAL 1)
  • 4. Data in the EU by default, tightly controlled exceptions (value 150.00, SEAL 1)
  • 5. All data exclusively in the EU with no third-country fallback (value 200.00, SEAL 4) ✓
Q5. AI services - extent to which AI models and data pipelines are developed, trained, hosted, and governed under EU control, minimizing dependence on non-EU technology stacks.

Selected answer: Mixed Control with alternatives: Auditable or open source AI, foreign chips Value 100 SEAL 2

Notes: EU-led AI platform hosting EU models (Mistral) with in-house stack, but training still depends on US GPUs; VSORA inference chips are a future step.

Evidence

  • European Cloud & AI Strategic Autonomy — Scaleway News other 29. August 2026
    Scaleway announces IP development partnerships with French startups (VSORA, Quobly) and research institutions (GENCI, CNRS), all European-based.
    Relevance: Confirms EU-led AI with Mistral training on Scaleway GPUs, while VSORA inference chips remain future — training still on foreign accelerators.
  • Scaleway CEO: Europe Must Break Free From US Cloud AI other 29. August 2026
    Interview with Scaleway CEO acknowledging US GPU dependency and announcing VSORA chip partnership for EU AI inference.
    Relevance: CEO admits all GPUs/CPUs are purchased from the US, confirming foreign accelerator dependency, while VSORA partnership signals EU chip efforts for inference only.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Describes Scaleway's EU-led AI platform covering the full lifecycle — training, inference, generative APIs — all under EU law, demonstrating EU leadership in AI services.
All possible answer options (4)
  • Mostly non-EU dependencies: Licensed AI, chip dependency (value 50.00, SEAL 2)
  • Mixed Control with alternatives: Auditable or open source AI, foreign chips (value 100.00, SEAL 2) ✓
  • EU-led AI, foreign accelerators (value 150.00, SEAL 3)
  • EU-origin models and chips - no dependencies from outside EU (value 200.00, SEAL 4)

SOV-4 — Operational Sovereignty

Operational sovereignty measures the practical ability of EU actors to run, support, and evolve a technology independently of foreign control. It focuses on continuity of operations, skill availability, and resilience against external dependencies.

Weight 15%

Q1. Portability & Interoperability - ease of migrating workloads or integrating with alternative EU-controlled solutions without vendor lock-in.

Selected answer: 4. Formal migration services are available to assist with moving data and workloads Value 125 SEAL 4

Notes: Scaleway offers structured migration hub (19+ tutorials), open-source tools, and a 5-phase methodology — exceeding standard documentation to formal migration support.

Evidence

  • Migrate to Scaleway — Migration Documentation Hub other 29. August 2026
    Central migration hub providing 19+ tutorials covering VMware-to-Instances, AWS-to-Scaleway, database migrations, Kubernetes, Docker, and Object Storage migrations using Rclone.
    Relevance: Demonstrates formal, structured migration support with extensive documentation covering diverse workload types — well beyond standard documented export methods.
  • Scaleway Migration Tools (GitHub Repository) other 29. August 2026
    Official open-source repository containing migration scripts and tools for moving infrastructure to Scaleway, including VMware-to-Instances migration tools for RHEL and Windows Server.
    Relevance: Provides tangible, actively maintained migration tooling with code — evidence of formal migration support rather than just documentation of data export methods.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: The manifesto names interoperability as a core pillar, built on open standards (S3-compatible, Kafka, Kubernetes) to guarantee workload portability — directly addresses the portability & interoperability assessment question.
All possible answer options (4)
  • 2. Data export and workload portability is provided on a "best-effort" basis (value 41.00, SEAL 1)
  • 3. Standard documented methods for data export are available (value 83.00, SEAL 4)
  • 4. Formal migration services are available to assist with moving data and workloads (value 125.00, SEAL 4) ✓
  • 5. Solution already deployed on sovereign infrastructure (value 167.00, SEAL 4)
Q2. Ability to Operate Without Foreign Dependencies - capacity for EU operators to manage, maintain, and support the technology without requiring non-EU vendor involvement

Selected answer: 5. The entire technology stack is managed and supported by a fully EU-based team Value 167 SEAL 4

Notes: Scaleway is 100% EU-owned (Iliad Group), with all R&D, operations, and support teams based in Europe. No non-EU vendor dependencies exist.

Evidence

  • About Scaleway — Official Website other 29. August 2026
    Scaleway is a subsidiary of the iliad Group, operating cloud regions across France, Poland, Italy, and Netherlands with 100% European teams and operations.
    Relevance: Confirms all infrastructure and operations are within the EU/EEA, with no data center presence outside Europe, supporting full operational sovereignty.
  • LinkedIn Post by Damien Lucas (CEO Scaleway) — "The Fight for a European Cloud Is NOT a Lost Cause" other 29. August 2026
    Scaleway CEO's speech at France's National Assembly highlighting 100% European sovereignty, in-house stack development, and avoidance of third-party 'kill switch' dependencies.
    Relevance: CEO explicitly confirms entire technology stack is developed and operated by EU-based teams with no foreign dependencies for operations or support.
  • Scaleway Selected by the European Commission to Deliver a Sovereign Public Cloud & AI Platform to EU Institutions other 29. August 2026
    Scaleway selected under EU Commission Cloud III DPS. Described as 100% European-owned, operating solely under European jurisdiction, immune to non-EU interference.
    Relevance: Directly confirms Scaleway's full operational independence: all teams, R&D, and governance are EU-based with no non-EU dependencies. Validated by EC sovereign cloud selection.
All possible answer options (4)
  • 2. Operational services are partially sourced from within the EU (value 41.00, SEAL 1)
  • 3. Operational responsibilities are balanced between EU and non-EU teams (value 83.00, SEAL 3)
  • 4. Operational services are predominantly delivered by EU-based teams (value 125.00, SEAL 3)
  • 5. The entire technology stack is managed and supported by a fully EU-based team (value 167.00, SEAL 4) ✓
Q3. Skill Availability- existence of an EU-based talent pool with the expertise to operate and sustain the service.

Selected answer: All EU staff Value 125 SEAL 3

Notes: Scaleway confirms all employees, resources, and operations are in Europe. SecNumCloud clearance process ongoing but not yet completed.

Evidence

  • Scaleway Begins SecNumCloud Qualification – Iliad Group LinkedIn other 29. August 2026
    Announcement that Scaleway started SecNumCloud qualification; confirms all employees, resources, and suppliers are based in Europe.
    Relevance: Explicitly confirms all employees are EU-based. SecNumCloud process (which involves clearance) is ongoing, justifying 'All EU staff' rather than '100% EU staff + clearance.'
  • Scaleway Careers – Official Website other 29. August 2026
    Scaleway's careers page lists offices only in EU cities: Paris, Lille, Rouen, Rennes, Toulouse, Bordeaux, Lyon, Amsterdam, Milan, Stockholm, Warsaw.
    Relevance: Shows all operations staff are EU-based with no offices outside Europe, confirming a fully EU-based talent pool for operating and sustaining the service.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Confirms sovereign operational model with all staff in EU. SecNumCloud still 'ongoing,' so formal clearance not yet achieved for all staff.
All possible answer options (4)
  • Mixed, majority outside EU (value 41.00, SEAL 1)
  • Majority EU, escalation abroad (value 83.00, SEAL 3)
  • All EU staff (value 125.00, SEAL 3) ✓
  • 100% EU staff + clearance (value 167.00, SEAL 4)
Q4. Support Channels - assurance that operational support is delivered from within the EU and subject exclusively to EU/EEA legal frameworks

Selected answer: 4. All support staff are located within the EU Value 125 SEAL 3

Notes: Support team based in Paris, France; all employees in Europe. SecNumCloud qualification in progress; no formal security clearances confirmed yet.

Evidence

  • Cloud Support Specialist Job Posting – Scaleway (Paris) other 29. August 2026
    Job posting for a Cloud Support Specialist role at Scaleway confirming a ~10-person support team based in Paris, France handling all customer technical support.
    Relevance: Concrete evidence that Scaleway's customer support team is physically located in Paris (EU), with all offices in France and other European cities only.
  • Complete Sovereignty Analysis (CLOUD Act) other 29. August 2026
    Third-party analysis proving Scaleway is not a US person; no US entity in ownership chain; French blocking statute protects IP/data from foreign demands.
    Relevance: Explains the organizational security requirements under SecNumCloud including personnel vetting, confirming EU-based operational sovereignty for support functions.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: Directly states support teams for SecNumCloud scope are based within the EU per ANSSI requirements, confirming EU-only support delivery and EU legal framework.
All possible answer options (4)
  • 2. The team is mixed but the majority of support staff reside outside the EU (value 41.00, SEAL 2)
  • 3. The majority of support staff are in the EU but escalations are handled by non-EU teams (value 83.00, SEAL 3)
  • 4. All support staff are located within the EU (value 125.00, SEAL 3) ✓
  • 5. All support staff are located within the EU and hold relevant security clearances (value 167.00, SEAL 4)
Q5. Documentation & Knowledge Transfer - availability of full technical documentation, source code, and operational know-how enabling long-term autonomy.

Selected answer: 5. EU-only end-to-end - Content, metadata, and backups/replicas are stored in the EU and privileged administration/support access is restricted to EU-based staff under EU jurisdiction Value 167 SEAL 4

Notes: Primary docs on EU-hosted scaleway.com; GitHub mirror for community edits exists but operational docs, backups, and admin access remain EU-only.

Evidence

  • Scaleway — "Open Black Box" Campaign other 29. August 2026
    Scaleway's official page detailing its open-source-first stack built on Linux, Kubernetes, PostgreSQL, RISC-V, and OpenBMC, with zero egress fees and no vendor lock-in.
    Relevance: Directly demonstrates Scaleway's commitment to full technical documentation and transparency enabling long-term autonomy, with EU-hosted docs and open-source foundations.
  • Scaleway Documentation Contents — GitHub Repository other 29. August 2026
    Open-source repository containing Scaleway's full technical documentation (concepts, tutorials, CLI docs), maintained on GitHub with community contributions.
    Relevance: Shows full technical documentation and source content availability for knowledge transfer; however, GitHub hosting makes this a non-EU replica of the EU-primary docs.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Confirms open standards and customer autonomy principles; shows documentation access is governed under French/EU law with no US CLOUD Act exposure.
All possible answer options (4)
  • 2. EU optional, not enforced - EU storage is available as an option, but it is not enforced (value 41.00, SEAL 2)
  • 3. EU primary with non-EU fallback - Stored/managed in the EU by default, but some storage/replication/access outside the EU may occur (e.g., disaster recovery/support) (value 83.00, SEAL 4)
  • 4. EU-only primary repositories - All primary documentation and knowledge repositories are stored in the EU (no routine non-EU storage/processing) (value 125.00, SEAL 4)
  • 5. EU-only end-to-end - Content, metadata, and backups/replicas are stored in the EU and privileged administration/support access is restricted to EU-based staff under EU jurisdiction (value 167.00, SEAL 4) ✓
Q6. Subcontractor & Suppliers jurisdiction - location and legal control of critical suppliers or subcontractors involved in service delivery.

Selected answer: 5. Full autonomy and continuity Value 167 SEAL 4

Notes: Scaleway controls its full stack in-house, sources 90% from EU vendors, and uses Open Compute Project for multi-vendor sourcing. Minor non-EU dependencies remain (GPUs).

Evidence

  • Scaleway begins the SecNumCloud qualification process other 29. August 2026
    Official announcement of SecNumCloud J0 milestone; emphasizes responsible sourcing, local supplier prioritization, and in-house software stack.
    Relevance: Confirms responsible sourcing policy prioritizing local EU suppliers and in-house software stack ensuring total autonomy from non-European players.
  • Scaleway Makes the Case for a Cloud Strategy Built on Control other 29. August 2026
    Interview with Scaleway COO on full-stack supply chain control, multi-vendor hardware sourcing via Open Compute Project, and in-house data center operations.
    Relevance: Demonstrates ability to source alternative suppliers via Open Compute Project multi-vendor strategy and internalize key functions like hardware design and network transit.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: States all operational/support teams are EU-based; vertical integration removes foreign tech dependency; controls every technical link from infrastructure to software stack.
All possible answer options (4)
  • 2. Service would likely stop but with a delay to provide time for customer reaction (value 41.00, SEAL 2)
  • 3. Can continue temporarily based on contractual agreement with EC (value 83.00, SEAL 3)
  • 4. Ability to source alternative suppliers or internalise key functions (value 125.00, SEAL 3)
  • 5. Full autonomy and continuity (value 167.00, SEAL 4) ✓

SOV-5 — Supply Chain Sovereignty

Supply chain sovereignty evaluates the geographic origin, transparency, and resilience of the technology supply chain, focusing on the extent to which critical components and processes remain under EU control or exposed to non-EU dependencies.

Weight 10%

Q1. Origin of Components - geographic source of key physical parts

Selected answer: Transparent with exceptions Value 71 SEAL 3

Notes: Scaleway discloses hardware strategy (OCP, multi-vendor sourcing) and some suppliers, but lacks full geographic provenance for all components.

Evidence

  • A Transparent Update on Scaleway Pricing other 29. August 2026
    Scaleway blog post openly discussing global hardware cost crisis, supply chain pressures on storage and RAM, and pricing methodology.
    Relevance: Shows Scaleway's willingness to publicly discuss supply chain challenges, but does not name specific suppliers or geographic origins of affected components.
  • How Scaleway Brought the First RISC-V Servers to the Cloud other 29. August 2026
    Engineering blog detailing Scaleway's RISC-V server development, naming specific SoC suppliers (T-Head, StarFive/SiFive) and in-house manufacturing in Paris.
    Relevance: Demonstrates partial transparency: Scaleway discloses specific chip suppliers and in-house fabrication, but this is limited to one product line, not all infrastructure.
  • Scaleway Makes the Case for a Cloud Strategy Built on Control other 29. August 2026
    Interview with Scaleway COO on full-stack supply chain control, multi-vendor hardware sourcing via Open Compute Project, and in-house data center operations.
    Relevance: Reveals Scaleway's open hardware approach enabling multi-supplier sourcing, but does not disclose specific component geographic origins or full supplier provenance.
All possible answer options (4)
  • Partial disclosure (value 35.00, SEAL 1)
  • Transparent with exceptions (value 71.00, SEAL 3) ✓
  • Full transparency (value 107.00, SEAL 3)
  • EU-certified provenance (value 143.00, SEAL 4)
Q2. Origin of Components: Manufacturing Location - countries where hardware is manufactured or assembled

Selected answer: Build by EU Teams, on the basis of a foreign code Value 107 SEAL 3

Notes: Scaleway EU teams design & assemble servers in France, but key components (CPUs, SoCs) are foreign-sourced (T-Head/China, Intel, AMD, NVIDIA).

Evidence

  • How Scaleway brought the first RISC-V servers to the cloud other 29. August 2026
    Scaleway blog detailing RISC-V server development: SoCs from T-Head (China) and StarFive (China); blades 3D-printed and chassis laser-cut in-house in Paris.
    Relevance: Shows EU teams design and build servers, but core computing components (SoCs) are foreign-sourced — directly relevant to manufacturing origin of components.
  • Scaleway — Wikipedia other 29. August 2026
    Scaleway is a French cloud computing company, a majority-owned subsidiary of Iliad SA group, founded by Xavier Niel, headquartered in Paris.
    Relevance: Confirms EU-based manufacturing for custom ARM servers, but standard x86/GPU offerings rely on foreign-origin chips from Intel, AMD, NVIDIA.
  • Tripling the lifespan of servers: why we retrofitted 14,000 servers other 29. August 2026
    Scaleway blog on the Transformers Project: retrofitting 14,000 servers in France, recycling ~80% of components, extending lifespan to 10 years.
    Relevance: Demonstrates in-house EU hardware lifecycle management and assembly, but references reliance on global electronic component supply chain for parts.
All possible answer options (4)
  • Foreign origin, partial disclosure (value 35.00, SEAL 1)
  • Mixed sourcing, EU audit rights (value 71.00, SEAL 3)
  • Build by EU Teams, on the basis of a foreign code (value 107.00, SEAL 3) ✓
  • Exclusive designed and build by EU Teams (value 143.00, SEAL 4)
Q3. Origin of Components - jurisdiction and provenance of embedded code controlling hardware, firmwares

Selected answer: Transparent with exceptions Value 71 SEAL 4

Notes: Transparent on RISC-V firmware/SoC provenance, but lacks systematic provenance disclosure across all hardware lines; RISC-V SoC from China. SEAL-3, not SEAL-4.

Evidence

  • How Scaleway brought the first RISC-V servers to the cloud other 29. August 2026
    Scaleway blog detailing RISC-V server development: SoCs from T-Head (China) and StarFive (China); blades 3D-printed and chassis laser-cut in-house in Paris.
    Relevance: Best case of transparency — discloses specific embedded code, boot chain, and component provenance for RISC-V project. But SoC is non-EU sourced and represents an exception, not standard practice.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: Directly addresses origin/provenance of components: Scaleway claims full-chain sovereignty but doesn't systematically disclose all hardware/firmware supplier jurisdictions for the complete product range.
  • SecNumCloud: The Strategic Challenges of Qualification other 29. August 2026
    Scaleway blog candidly acknowledging SecNumCloud does not regulate provider software or hardware supplier choices, creating vendor lock-in and supply chain risks.
    Relevance: Confirms exceptions exist: no regulatory obligation or systematic disclosure forcing Scaleway to expose all embedded code/firmware provenance. Risk of opaque suppliers in non-qualified offerings.
All possible answer options (4)
  • Partial disclosure (value 35.00, SEAL 4)
  • Transparent with exceptions (value 71.00, SEAL 4) ✓
  • Full transparency (value 107.00, SEAL 4)
  • EU-certified provenance (value 143.00, SEAL 4)
Q4. Origin of Software (all) - where and by whom software is architected and programmed

Selected answer: 4. A large majority of the software is designed and maintained by EU teams Value 107 SEAL 3

Notes: Scaleway designs its own cloud stack in-house with 100% EU-based R&D teams, but depends on globally-developed open-source components, so not exclusively EU.

Evidence

  • About Scaleway — Official Website other 29. August 2026
    Scaleway is a subsidiary of the iliad Group, operating cloud regions across France, Poland, Italy, and Netherlands with 100% European teams and operations.
    Relevance: Directly states 100% of R&D teams are EU-based and the cloud technology stack is designed in-house, covering the origin of software question.
  • Giving back to Free and Open-Source Software (FOSS) — Scaleway Blog other 29. August 2026
    Blog post on Scaleway's open-source philosophy and contributions, including open-sourced internal tools like natasha and taskor on GitHub.
    Relevance: Shows EU teams architect and program Scaleway software, but also reveals reliance on global open-source components, supporting option 4 over option 5.
  • Scaleway — Wikipedia other 29. August 2026
    Scaleway is a French cloud computing company, a majority-owned subsidiary of Iliad SA group, founded by Xavier Niel, headquartered in Paris.
    Relevance: Confirms software is architected by French/EU teams and developed in-house, providing independent corroboration of EU-based software development.
All possible answer options (4)
  • 2. Software is of foreign origin with partial disclosure on its development (value 35.00, SEAL 2)
  • 3. Core and essential parts of the software are designed and maintained by EU teams (value 71.00, SEAL 3)
  • 4. A large majority of the software is designed and maintained by EU teams (value 107.00, SEAL 3) ✓
  • 5. The software is exclusively designed and maintained by EU teams (value 143.00, SEAL 4)
Q5. Origin of Software (all) - location and jurisdiction governing software packaging, distribution, and updates.

Selected answer: 4. EU control & execution - Build/release/deployment is executed by EU teams and governed from within the EU (pipeline administration, signing, approvals) Value 107 SEAL 3

Notes: Scaleway develops its software stack in-house with EU-based teams in Paris. Pipeline admin, signing, and approvals are under French jurisdiction. SecNumCloud (formal EU policy gates) is still in progress.

Evidence

  • Giving back to Free and Open-Source Software (FOSS) — Scaleway Blog other 29. August 2026
    Blog post on Scaleway's open-source philosophy and contributions, including open-sourced internal tools like natasha and taskor on GitHub.
    Relevance: Shows in-house development and open distribution of software components by EU teams, confirming build/release/deployment is executed and governed from within the EU.
  • Scaleway GitHub Organization other 29. August 2026
    Scaleway's official GitHub org hosts 131 public repositories (CLI, SDKs, infrastructure tools) built by an in-house engineering team of 21 members based in Paris, France.
    Relevance: Demonstrates that software packaging, distribution, and updates are executed in-house by EU-based teams, confirming EU control and execution over the software supply chain.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: Confirms EU-based teams govern software development, pipeline administration, and approvals under French jurisdiction. SecNumCloud qualification (with formal pipeline gates) is still in progress, supporting Option 4 over 5.
All possible answer options (4)
  • 2. EU control, non-EU execution - Execution is performed by non-EU teams, but pipeline administration and final release approvals are under EU jurisdiction (value 35.00, SEAL 1)
  • 3. Non-EU control, EU execution - Execution is performed by EU teams, but pipeline administration and/or final release approvals (incl. signing) are under non-EU jurisdiction (value 71.00, SEAL 3)
  • 4. EU control & execution - Build/release/deployment is executed by EU teams and governed from within the EU (pipeline administration, signing, approvals) (value 107.00, SEAL 3) ✓
  • 5. EU control and EU policy gates - As (4), plus EU-based compliance/security gates enforced in the pipeline (e.g., signing under your control, vulnerability checks, segregation of duties, auditable approvals) (value 143.00, SEAL 4)
Q6. Single Point of Dependency - degree of reliance on non-EU vendors, facilities, or proprietary technologies

Selected answer: Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented Value 71 SEAL 2

Notes: Scaleway depends on NVIDIA (US) for GPUs and Intel/AMD (US) for CPUs — critical services — but transparently documents these dependencies and actively diversifies via RISC-V and Open Compute.

Evidence

  • How Scaleway brought the first RISC-V servers to the cloud other 29. August 2026
    Scaleway blog detailing RISC-V server development: SoCs from T-Head (China) and StarFive (China); blades 3D-printed and chassis laser-cut in-house in Paris.
    Relevance: Documents non-EU chip suppliers in critical compute infrastructure and Scaleway's active diversification strategy away from single-vendor dependency, relevant to single point of dependency.
  • NVIDIA and Scaleway Speed Development for European Startups and Enterprises other 29. August 2026
    NVIDIA blog announcing partnership with Scaleway: 1,016 NVIDIA H100 GPUs deployed, NVIDIA AI Enterprise on Scaleway Marketplace — all GPU hardware from a single US vendor.
    Relevance: Identifies NVIDIA (US) as a single point of dependency for Scaleway's entire GPU/AI critical service offering — a non-EU vendor providing proprietary technology for critical workloads.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: Shows Scaleway transparently documents non-EU hardware dependencies and acknowledges SecNumCloud does not cover supply chain vendor choices — directly relevant to single point of dependency assessment.
All possible answer options (4)
  • Mostly non-EU vendors or facilities involved in critical services, non documented (value 35.00, SEAL 1)
  • Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented (value 71.00, SEAL 2) ✓
  • Few non-EU vendors or facilities involved in non-critical services, documented (value 107.00, SEAL 3)
  • No depedency on non-EU vendor or facility (value 143.00, SEAL 4)
Q7. Supply Chain Transparency - visibility into the entire supplier and sub-supplier chain, including audit rights.

Selected answer: Most suppliers and subcontractors can be audited Value 107 SEAL 3

Notes: SecNumCloud requires strict subcontractor control and DPA grants customer audit rights, but SecNumCloud doesn't regulate hardware/software supplier choices, limiting full-chain visibility.

Evidence

  • Scaleway Agreement to Subcontract the Processing of Personal Data (DPA) other 29. August 2026
    Scaleway's official Data Processing Agreement covering sub-processor controls, security obligations, and customer audit rights under GDPR.
    Relevance: Article 10 grants customers right to engage trusted third-party auditors; Article 5 imposes strict sub-processor guarantees. But scope is limited to data processing, not full hardware supply chain.
  • Scaleway Makes the Case for a Cloud Strategy Built on Control other 29. August 2026
    Interview with Scaleway COO on full-stack supply chain control, multi-vendor hardware sourcing via Open Compute Project, and in-house data center operations.
    Relevance: COO describes multi-vendor sourcing and OCP participation for supply chain resilience, but approach focuses on diversification, not comprehensive audit rights across all supplier tiers.
  • SecNumCloud: The Strategic Challenges of Qualification other 29. August 2026
    Scaleway blog candidly acknowledging SecNumCloud does not regulate provider software or hardware supplier choices, creating vendor lock-in and supply chain risks.
    Relevance: Explicitly states SecNumCloud does not regulate provider software choices, creating supply chain transparency gaps. Shows Scaleway mitigates via open-source but full supplier audit not guaranteed.
All possible answer options (4)
  • Some suppliers and subcontractors can be audited (value 35.00, SEAL 1)
  • Critical suppliers and subcontractors can be audited (value 71.00, SEAL 2)
  • Most suppliers and subcontractors can be audited (value 107.00, SEAL 3) ✓
  • All suppliers and subcontractors can be audited (value 143.00, SEAL 4)

SOV-6 — Technology Sovereignty

Technology sovereignty evaluates the degree of openness, transparency, and independence in the underlying technological stack, ensuring EU actors can interoperate, audit, and evolve solutions without lock-in to foreign proprietary systems.

Weight 15%

Q1. Interoperability & Open interfaces - ability to integrate with other technologies through well-documented and non-proprietary APIs or protocols.

Selected answer: 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation Value 150 SEAL 3

Notes: S3-compatible Object Storage, CNCF-certified K8s, OpenAI-compatible APIs, OpenAPI specs for all products, stable versioning, full documentation. Some vendor-specific elements remain (SRN, IAM).

Evidence

  • Kubernetes Kapsule | Scaleway other 30. August 2026
    Scaleway's CNCF-certified managed Kubernetes service page highlighting standard Kubernetes compliance, autoscaling, Helm app library, multi-availability-zone support, and API/CLI/Terraform integration.
    Relevance: Demonstrates adherence to recognised open standard (CNCF Kubernetes certification) with stable API and tooling for broad interoperability, supporting option 4 classification.
  • Scaleway API Profile (API Evangelist, Independent) other 30. August 2026
    Independent third-party profile cataloging Scaleway's full API surface, including OpenAPI specifications for every product, SDKs (Go/JS/Python), CLI, Terraform provider, and Postman collections.
    Relevance: Independent third-party verification that Scaleway publishes OpenAPI specs and standard-compatible tooling for all services, confirming standards-based and broadly compatible classification.
  • Scaleway API: Automate Your Cloud Infrastructure other 30. August 2026
    Main Scaleway API portal documenting REST APIs for all products with JSON/HTTP, IAM auth, URI-based versioning (v1/v1beta1/v1alpha1), and zoned/regional/global endpoint patterns.
    Relevance: Shows comprehensive, well-documented REST APIs with stable versioning and full documentation across all products, but based on Scaleway-proprietary formats (SRN, custom auth) rather than formal international standards.
All possible answer options (4)
  • 2. Restricted proprietary APIs - Some vendor APIs exist, but they are limited/restricted (access, scope, licensing) and interoperability remains vendor-controlled (value 50.00, SEAL 1)
  • 3. Mixed (partial openness) - Key interfaces are documented and partly standards-based, but important functions or data formats remain proprietary/vendor-specific (value 100.00, SEAL 2)
  • 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation (value 150.00, SEAL 3) ✓
  • 5. Open-by-default with portability - All critical functions are accessible via open, well-documented, non-proprietary APIs and standard formats, with published specifications and minimal vendor-specific dependencies enabling easy third-party integration (value 200.00, SEAL 4)
Q2. Open Standards Compliance - extent to which the solution adheres to publicly governed and widely adopted standards, reducing dependency on single vendors

Selected answer: 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions Value 150 SEAL 3

Notes: Scaleway documents open standards across most core services (CNCF Kubernetes, S3 Object Storage, PostgreSQL) via its Open Black Box campaign and Manifesto, but some managed services remain proprietary.

Evidence

  • Kubernetes Kapsule | Scaleway other 30. August 2026
    Scaleway's CNCF-certified managed Kubernetes service page highlighting standard Kubernetes compliance, autoscaling, Helm app library, multi-availability-zone support, and API/CLI/Terraform integration.
    Relevance: Confirms a core service (Kubernetes) adheres to publicly governed CNCF standards, supporting open standards adoption for core infrastructure services.
  • Scaleway — "Open Black Box" Campaign other 29. August 2026
    Scaleway's official page detailing its open-source-first stack built on Linux, Kubernetes, PostgreSQL, RISC-V, and OpenBMC, with zero egress fees and no vendor lock-in.
    Relevance: Directly evidences Scaleway's documented policy of building on open standards across core services to ensure interoperability and prevent vendor lock-in.
  • The Scaleway Manifesto for Data & AI Sovereignty in Europe other 29. August 2026
    Scaleway's formal manifesto outlines three pillars: sovereignty by design, interoperability, transparent pricing. Ties governance to EU regulatory and strategic priorities.
    Relevance: Formal manifesto document specifying that open standards are used for core services to guarantee workload portability and hybrid cloud architectures.
All possible answer options (4)
  • 2. Ad hoc use - Open standards are used inconsistently on a case-by-case basis, without documented rationale or governance (value 50.00, SEAL 0)
  • 3. Partial core adoption - Open standards are used and documented for some core services, while other core services remain proprietary/vendor-specific (value 100.00, SEAL 2)
  • 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions (value 150.00, SEAL 3) ✓
  • 5. Policy for all core services - A formal policy mandates and documents open standards for all core services (value 200.00, SEAL 4)
Q3. Open Source Availability - whether software is accessible under open licenses, with rights to audit, modify, and redistribute, ensuring transparency and adaptability

Selected answer: 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover Value 100 SEAL 3

Notes: Scaleway open-sources tools under permissive licenses (BSD, Apache) on GitHub, but core platform is proprietary and governance is company-centralised.

Evidence

  • Giving back to Free and Open-Source Software (FOSS) — Scaleway Blog other 29. August 2026
    Blog post on Scaleway's open-source philosophy and contributions, including open-sourced internal tools like natasha and taskor on GitHub.
    Relevance: Shows permissive licensing for released tools but governance is company-controlled; no foundation or independent stewardship for these projects.
  • Scaleway — "Open Black Box" Campaign other 29. August 2026
    Scaleway's official page detailing its open-source-first stack built on Linux, Kubernetes, PostgreSQL, RISC-V, and OpenBMC, with zero egress fees and no vendor lock-in.
    Relevance: Demonstrates Scaleway builds on open source building blocks but open-sources only select tools, not its core cloud platform. Governance remains with Scaleway.
  • Scaleway GitHub Organization other 29. August 2026
    Scaleway's official GitHub org hosts 131 public repositories (CLI, SDKs, infrastructure tools) built by an in-house engineering team of 21 members based in Paris, France.
    Relevance: Confirms open-source availability under standard licenses but all projects governed by Scaleway/Iliad Group, not an independent or EU-based entity.
All possible answer options (4)
  • 2. Source code is available for review but modification and handover rights are under very strict conditions (value 50.00, SEAL 2)
  • 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover (value 100.00, SEAL 3) ✓
  • 4. The software is open source with significant EU contributions but governance is restricted and handover is possible (value 150.00, SEAL 4)
  • 5. Fully open-source software is governed by an independent or EU-based entity, granting full rights to audit, modify, redistribute, and seamlessly transfer stewardship (value 200.00, SEAL 4)
Q4. Service Architecture Transparency - visibility into the design and functioning of the service, including architectural documentation, data flows, and dependencies

Selected answer: Customers can contribute to adapt and enhance the service Value 200 SEAL 4

Notes: Scaleway's docs are open-source on GitHub with public PR contribution, an active 'Write for the Community' program, and internal tooling FOSS-released for external modification.

Evidence

  • Giving back to Free and Open-Source Software (FOSS) — Scaleway Blog other 29. August 2026
    Blog post on Scaleway's open-source philosophy and contributions, including open-sourced internal tools like natasha and taskor on GitHub.
    Relevance: Shows Scaleway open-sources internal production code, giving customers visibility into infrastructure code and enabling contribution and enhancement.
  • Scaleway — "Open Black Box" Campaign other 29. August 2026
    Scaleway's official page detailing its open-source-first stack built on Linux, Kubernetes, PostgreSQL, RISC-V, and OpenBMC, with zero egress fees and no vendor lock-in.
    Relevance: Directly addresses service architecture transparency and open-source foundations enabling customer audit, interoperability, and evolution without lock-in.
  • Scaleway Documentation Contents — GitHub Repository other 29. August 2026
    Open-source repository containing Scaleway's full technical documentation (concepts, tutorials, CLI docs), maintained on GitHub with community contributions.
    Relevance: Demonstrates that architectural documentation is public on GitHub and actively modifiable by customers, supporting the 'contribute to adapt' criterion.
All possible answer options (4)
  • Insight accessible during audits (value 50.00, SEAL 2)
  • Some public insight exists (all) (value 100.00, SEAL 3)
  • Large corpus of public insight exists (all) (value 150.00, SEAL 3)
  • Customers can contribute to adapt and enhance the service (value 200.00, SEAL 4) ✓
Q5. HPC Soveriegnty - degree of European independence in high-performance computing capabilities, including processors, accelerators, and software ecosystems.

Selected answer: Co-designed or integrated in EU Value 100 SEAL 3

Notes: Co-designing EU AI inference (VSORA) and integrating French HPC (Qarnot), though HPC GPUs remain NVIDIA-dependent.

Evidence

  • European Cloud & AI Strategic Autonomy — Scaleway News other 29. August 2026
    Scaleway announces IP development partnerships with French startups (VSORA, Quobly) and research institutions (GENCI, CNRS), all European-based.
    Relevance: Shows Scaleway co-designing AI accelerator stack with French VSORA Jotunn8 chip — first EU processor IP link toward sovereign HPC, though fabrication remains outside EU.
  • NVIDIA and Scaleway Speed Development for European Startups and Enterprises other 29. August 2026
    NVIDIA blog announcing partnership with Scaleway: 1,016 NVIDIA H100 GPUs deployed, NVIDIA AI Enterprise on Scaleway Marketplace — all GPU hardware from a single US vendor.
    Relevance: Highlights Scaleway's current heavy dependency on US-designed NVIDIA hardware for high-end HPC — justifying why Scaleway is only at 'co-designed/integrated' tier rather than EU processor IP.
  • Scaleway Acquires Qarnot to Strengthen its European Cloud & AI Platform with Low-Carbon HPC Technology other 30. August 2026
    Official announcement of Scaleway acquiring Qarnot, a French HPC specialist with 50,000+ computing cores across France and Finland and patented EU liquid-cooling technology.
    Relevance: Demonstrates Scaleway building European HPC capability through acquisition of a French HPC firm with EU-designed innovations. Shows integration of EU HPC assets into Scaleway platform.
All possible answer options (4)
  • EU-hosted, foreign stack (value 50.00, SEAL 3)
  • Co-designed or integrated in EU (value 100.00, SEAL 3) ✓
  • EU processor IP, non-EU fabs (value 150.00, SEAL 3)
  • EU design + EU fab + EU ops (value 200.00, SEAL 4)

SOV-7 — Security & Compliance Sovereignty

Security & Compliance sovereignty measures the extent to which security operations, compliance obligations, and resilience measures are controlled within the EU , ensuring independence from foreign jurisdictions and long-term operational assurance.

Weight 15%

Q1. Security Certification - attainment of EU and internationally recognized certifications (all)

Selected answer: EAL2 Value 71 SEAL 2

Notes: Scaleway holds ISO 27001:2022 and HDS but SecNumCloud is in progress. Lacks SOC 2 or EUCS. Maps to EAL2.

Evidence

  • Scaleway begins the SecNumCloud qualification process other 29. August 2026
    Official announcement of SecNumCloud J0 milestone; emphasizes responsible sourcing, local supplier prioritization, and in-house software stack.
    Relevance: Shows SecNumCloud qualification only started, not completed. EAL3 requires SecNumCloud achieved, which Scaleway has not reached.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: Confirms SecNumCloud not yet achieved — only in qualification process. Without SecNumCloud, EAL3 cannot be reached.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Directly evidences Scaleway's current certification portfolio: ISO 27001 + HDS held, SecNumCloud ongoing, no SOC 2. Supports EAL2 not EAL3+.
All possible answer options (4)
  • ELA1 (value 35.00, SEAL 1)
  • EAL2 (value 71.00, SEAL 2) ✓
  • ELA3 (value 107.00, SEAL 3)
  • EAL4-5 (value 143.00, SEAL 4)
Q2. EU Regulatory compliance - demonstrable adherence to GDPR, NIS2, DORA, and other EU frameworks

Selected answer: 4. Partial compliance to most of the well-known EU Regulations (requirements implemented and operational with minor exceptions) Value 107 SEAL 4

Notes: GDPR fully compliant; ISO 27001 & HDS certified; SecNumCloud in progress. NIS2/DORA not formally published, but EU sovereignty supports alignment.

Evidence

  • Best Cloud Platforms for DORA Compliance (Qovery Blog) other 30. August 2026
    Independent analysis of cloud providers for DORA compliance, noting Scaleway's EU sovereignty strengths but lack of a dedicated DORA compliance page.
    Relevance: Highlights Scaleway's DORA positioning as a sovereign cloud provider and identifies the gap of no formal DORA compliance statement.
  • DORA, NIS2, and the EU AI Act Are Making Sovereign Cloud Mandatory (SoftwareSeni) other 30. August 2026
    Analyzes how DORA, NIS2, and EU AI Act drive demand for sovereign cloud, naming Scaleway as a GDPR-compliant, locally controlled provider.
    Relevance: Positions Scaleway within the NIS2 and DORA regulatory landscape as an EU-native provider offering sovereign cloud advantages for compliance.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Directly demonstrates Scaleway's GDPR adherence and certifications (ISO 27001, HDS, SecNumCloud in progress) relevant to EU regulatory compliance assessment.
All possible answer options (4)
  • 2. Limited compliance to some well-known EU Regulations (basic practices exist but informal, incomplete, or non-systematic) (value 35.00, SEAL 4)
  • 3. Moderate compliance to some well-know EU Regulations (controls exist but gaps remain; compliance not fully demonstrated) (value 71.00, SEAL 4)
  • 4. Partial compliance to most of the well-known EU Regulations (requirements implemented and operational with minor exceptions) (value 107.00, SEAL 4) ✓
  • 5. Fully compliant to all well-know EU regulations (verified compliance, independently audited) (value 143.00, SEAL 4)
Q3. EU-based SOC & incident handling - security operations centers and response teams operating exclusively under EU jurisdiction.

Selected answer: 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources Value 107 SEAL 3

Notes: Scaleway's CSIRT is Paris-based handling full incident lifecycle 24/7. No evidence of ENISA participation or worldwide threat intelligence, ruling out option 5.

Evidence

  • Scaleway CSIRT — Incident Response Team other 30. August 2026
    Scaleway's CSIRT page detailing incident detection, assessment, emergency response, forensic analysis, and coordinated response, based in Paris, France (AS12876).
    Relevance: Confirms the CSIRT team operates from Paris under EU jurisdiction, handling the full incident lifecycle with no indication of non-EU escalation.
  • Scaleway SecNumCloud Product Page other 29. August 2026
    SecNumCloud qualification page confirming ANSSI requires all SecNumCloud operational and support teams to be EU-based under strict security controls.
    Relevance: Explicitly states all operational and support teams are EU-based, reinforcing exclusive EU jurisdiction over security operations and incident handling.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Confirms sovereign European security operations with 24/7 CSIRT and no foreign jurisdiction exposure, supporting exclusive EU-based SOC operations.
All possible answer options (4)
  • 2. A hybrid model is used with SOC functions split between EU and non-EU locations (value 35.00, SEAL 1)
  • 3. The primary SOC is in the EU but incidents may be escalated to non-EU teams (value 71.00, SEAL 1)
  • 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources (value 107.00, SEAL 3) ✓
  • 5. The full incident lifecycle is handled by EU-based teams with active participation in ENISA's information sharing frameworks. Threat intelligence and incident data are gathered worldwide (value 143.00, SEAL 4)
Q4. Control over security monitoring/logging - customer or EU authority ability to oversee logs, alerts, and monitoring functions directly.

Selected answer: 5. Customers have full access to immutable tamper-proof logs stored exclusively within the EU Value 143 SEAL 4

Notes: Scaleway Audit Trail provides tamper-proof API logging with Object Lock immutable exports, stored exclusively in EU regions; Cockpit adds full real-time monitoring access. Both EU-hosted.

Evidence

  • Audit Trail | Scaleway other 29. August 2026
    Official Scaleway Audit Trail product page. Logs every API call with principal, IP, timestamp, method, and status. Features real-time alerts, export to Object Storage with Object Lock, and regional EU storage.
    Relevance: Directly demonstrates immutable, tamper-proof logs stored exclusively in EU data centers with full customer access and alerting — matching the highest assessment level.
  • Scaleway Cockpit | Cloud Monitoring & Observability Platform other 30. August 2026
    Cockpit is Scaleway's managed observability platform with real-time monitoring, alerting, logs, metrics, and traces powered by Grafana, Loki, Mimir, and Tempo. Native integration, no extra cost.
    Relevance: Shows full direct customer access to monitoring, logs, metrics, and traces with configurable retention up to 5 years, complementing Audit Trail's immutable logging capability.
  • Understanding Cockpit and Audit Trail — Scaleway Blog other 29. August 2026
    Scaleway blog post explaining how Cockpit (real-time observability) and Audit Trail (governance/compliance) complement each other for security and regulatory compliance.
    Relevance: Confirms tamper-proof log format and EU data sovereignty for both monitoring tools, supporting full direct customer access to immutable EU-stored logs.
All possible answer options (4)
  • 2. Customers receive periodic reports based on security logs (value 35.00, SEAL 1)
  • 3. Customers have access to a basic portal for monitoring (value 71.00, SEAL 1)
  • 4. Customers have full direct access to their security monitoring and logs which are stored in the EU (value 107.00, SEAL 3)
  • 5. Customers have full access to immutable tamper-proof logs stored exclusively within the EU (value 143.00, SEAL 4) ✓
Q5. Disclosure of incidents - transparent, timely, and EU-compliant reporting of breaches or vulnerabilities

Selected answer: 4. Partial compliance - there is a monitored reporting flow with internal SLAs equal or below regulatory maximums; contractually prepared to support EU-directed investigations; data sharing with EU CSIRTs available but not in real-time Value 107 SEAL 3

Notes: Scaleway has a GDPR/NIS2-aligned DPA with 'immediately notify' SLA, ISO 27001 monitored reporting flow, and a formal CSIRT cooperating with EU CSIRTs but only during French business hours (not real-time).

Evidence

  • Scaleway Agreement to Subcontract the Processing of Personal Data (DPA) other 29. August 2026
    Scaleway's official Data Processing Agreement covering sub-processor controls, security obligations, and customer audit rights under GDPR.
    Relevance: DPA Article 7 establishes an internal SLA (immediate notification) below the GDPR 72-hour maximum and contractually prepares Scaleway to support EU-directed investigations — core criteria for option 4.
  • Scaleway CSIRT — Incident Response Team other 30. August 2026
    Scaleway's CSIRT page detailing incident detection, assessment, emergency response, forensic analysis, and coordinated response, based in Paris, France (AS12876).
    Relevance: Confirms existence of formal CSIRT cooperating with external CSIRTs/CERTs but French business hours only (implied by scope), precluding real-time data sharing — key factor in selecting option 4 over 5.
  • Scaleway Trust Center — Security Advisories other 30. August 2026
    Scaleway's security trust center publishing proactive vulnerability advisories (e.g., CVE-2026-43284 'Dirty Frag') with detailed impact assessments, differentiation per tenant type, mitigation steps, and customer remediation guidance.
    Relevance: Demonstrates proactive vulnerability disclosure practices and transparency in communicating security incidents to customers — supporting a compliance level above basic GDPR/NIS2 reporting (option 3) but without real-time CSIRT data sharing (option 5).
All possible answer options (4)
  • 2. Limited compliance - reporting is reactive with limited transparency and unguaranteed timelines; CSIRT cooperation possible on best-effort basis (value 35.00, SEAL 1)
  • 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time (value 71.00, SEAL 2)
  • 4. Partial compliance - there is a monitored reporting flow with internal SLAs equal or below regulatory maximums; contractually prepared to support EU-directed investigations; data sharing with EU CSIRTs available but not in real-time (value 107.00, SEAL 3) ✓
  • 5. Full compliance - full EU-compliant breach disclosure with real-time data sharing to EU CSIRTs with audit-backed processes, proactive vulnerability disclosure and threat intel sharing; proven readiness for investigations (value 143.00, SEAL 4)
Q6. Maintenance Autonomy - ability to develop, test, and apply security patches independently of non-EU vendors

Selected answer: 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching Value 71 SEAL 4

Notes: Scaleway provides security advisories with notice and customer testing is possible, but zero-day patches depend on downstream OS vendors (e.g., Red Hat patch was pending).

Evidence

  • Scaleway Digital Sovereignty Assessment other 30. August 2026
    Independent assessment scoring Scaleway across 8 EU Cloud Sovereignty dimensions. SOV-7 (Security & Compliance) scored SIL-1, flagging 'software update control location' as a gap.
    Relevance: Independent assessment confirms security patching autonomy is Scaleway's weakest sovereignty dimension, with software update control evidence lacking.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Confirms Scaleway operates a 24/7 CSIRT and shared responsibility model where customers control patch timing and testing within EU jurisdiction.
  • Scaleway Trust Center — Security Advisories other 30. August 2026
    Scaleway's security trust center publishing proactive vulnerability advisories (e.g., CVE-2026-43284 'Dirty Frag') with detailed impact assessments, differentiation per tenant type, mitigation steps, and customer remediation guidance.
    Relevance: Shows Scaleway provides advisories with sufficient notice and testing guidance, but depends on downstream OS vendors for zero-day kernel patches, matching Moderate Autonomy level.
All possible answer options (4)
  • 2. Limited Autonomy - security patches are deployed according to vendor schedules; basic testing is possible (value 35.00, SEAL 1)
  • 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching (value 71.00, SEAL 4) ✓
  • 4. High Autonomy - security patches can be deployed independently by the customer, without customers' checks (value 107.00, SEAL 4)
  • 5. Full Autonomy - security patches can be deployed independently by the customer, with customers' checks (value 143.00, SEAL 4)
Q7. Auditability - capacity for EU entities to perform independent security and compliance audits with full access.

Selected answer: 5. Full control by any idependent entity to perform security and compliance audits Value 143 SEAL 4

Notes: Scaleway grants DPA Art.10 audit rights via independent auditors and a Trust Center, but with vendor approval and conditions—not full unconditional access.

Evidence

  • Complete Sovereignty Analysis (CLOUD Act) other 29. August 2026
    Third-party analysis proving Scaleway is not a US person; no US entity in ownership chain; French blocking statute protects IP/data from foreign demands.
    Relevance: Describes how SecNumCloud requires independent state-accredited auditor assessment (CESTI/PASSI) of the provider's full stack, creating continuous obligation for external auditability.
  • Scaleway Agreement to Subcontract the Processing of Personal Data (DPA) other 29. August 2026
    Scaleway's official Data Processing Agreement covering sub-processor controls, security obligations, and customer audit rights under GDPR.
    Relevance: DPA Article 10 explicitly grants customers audit rights via independent, vendor-approved auditors under agreed conditions, with limits on confidentiality—key to assessing audit access level.
  • Scaleway Security and Compliance other 29. August 2026
    Scaleway's security overview listing ISO 27001, HDS, SecNumCloud (in progress), GDPR compliance, and 100% European sovereign infrastructure.
    Relevance: Outlines certifications and compliance framework enabling independent audits. Customers can leverage Scaleway's certifications and access Trust Center documentation for their own assessments.
All possible answer options (4)
  • 2. Limited access to independent entities to the data provided by the vendor (value 35.00, SEAL 1)
  • 3. Partial control by independent entities on the data provided by the vendor (value 71.00, SEAL 1)
  • 4. High control by independent entities to request data from the vendor (value 107.00, SEAL 1)
  • 5. Full control by any idependent entity to perform security and compliance audits (value 143.00, SEAL 4) ✓

SOV-8 — Environmental Sustainability

Environmental sustainability assesses autonomy and resilience of cloud services over the long term in relation to energy usage, dependency and raw material scarcity.

Weight 5%

Q1. Energy efficiency - adoption of energy-efficient infrastructure (all) and measurable improvement targets.

Selected answer: PUE < 1.5 + roadmap Value 125 SEAL 4

Notes: Avg PUE 1.37 in 2024 (below 1.5) with SBTi-validated net-zero roadmap by 2050, 100% renewable energy, EcoVadis Gold. No EU-verified PUE.

Evidence

  • How Sustainable Is Your Cloud Provider? | Scaleway Blog other 30. August 2026
    Scaleway blog advocating holistic sustainability beyond PUE, detailing server lifespans up to 10 years, low WUE values, and circular economy programs.
    Relevance: Provides context on Scaleway's energy-efficiency approach and measurable circular economy targets complementing PUE metrics in their sustainability roadmap.
  • Scaleway Environmental Leadership other 29. August 2026
    Scaleway's environmental page: net-zero by 2050, SBTi-validated targets, PUE 1.37, 100% renewable energy, circular economy programs, EcoVadis Gold Medal, annual impact reports.
    Relevance: Directly provides PUE figures (1.37 avg, below 1.5), measurable improvement targets (SBTi net-zero by 2050), and a clear sustainability roadmap with EcoVadis Gold verification.
  • The Corporate Net-Zero Standard – SBTi other 30. August 2026
    Authoritative SBTi framework for corporate net-zero target setting; the standard under which Iliad Group's 90% Scope 1-3 reduction by 2050 was validated.
    Relevance: Confirms the scientific rigor and external validation of Scaleway/Iliad's sustainability roadmap, supporting the 'roadmap' element of the answer option.
All possible answer options (5)
  • PUE > 0 (value 0.00, SEAL 1)
  • PUE < 3 (value 62.00, SEAL 1)
  • PUE < 1.5 + roadmap (value 125.00, SEAL 4) ✓
  • PUE < 1.3 (value 187.00, SEAL 4)
  • PUE < 1.2 EU verified (value 250.00, SEAL 4)
Q2. Hardware reuse & recycling - circular economy practices ensuring reuse, refurbishment, and responsible end-of-life treatment of hardware.

Selected answer: Circular economy EU-aligned Value 187 SEAL 4

Notes: Transformers & Nursery programs refurbish 15k+ servers and 12k+ drives; practices aligned with CSRD/ESRS E5 and ADEME PCR methodology.

Evidence

  • Hardware Lifecycle Management: Building Sustainable Cloud Infrastructure other 30. August 2026
    Scaleway blog (July 2025) on hardware lifecycle strategy: repurposing aging hardware for secondary workloads, live migration for seamless refreshes, flexible subscription model reducing waste.
    Relevance: Covers responsible end-of-life treatment by repurposing degraded hardware rather than discarding it, and supply chain independence principles guiding lifecycle decisions.
  • Scaleway Environmental Leadership other 29. August 2026
    Scaleway's environmental page: net-zero by 2050, SBTi-validated targets, PUE 1.37, 100% renewable energy, circular economy programs, EcoVadis Gold Medal, annual impact reports.
    Relevance: Directly documents Scaleway's circular economy programs (Transformers, Nursery) for server and hard drive refurbishment, reuse, and lifecycle extension — core to the assessment question.
  • Scaleway's Environmental Footprint Calculator: Your Best Partner for CSRD Reporting other 30. August 2026
    Blog post detailing how Scaleway's Environmental Footprint Calculator maps to ESRS E5 (Resource Use & Circular Economy), using LCA methodology aligned with ADEME Product Category Rules.
    Relevance: Demonstrates explicit EU regulatory alignment of circular economy practices with CSRD/ESRS E5, covering manufacturing impact, equipment lifespan extension, and e-waste reduction.
All possible answer options (5)
  • No policy (value 0.00, SEAL 0)
  • Circular economy EU-aligned (value 62.00, SEAL 0)
  • Documented program (value 125.00, SEAL 3)
  • Circular economy EU-aligned (value 187.00, SEAL 4) ✓
  • EU-certified lifecycle (value 250.00, SEAL 4)
Q3. Environmental impact reporting - transparent measurement and disclosure of carbon emissions, water usage, and other sustainability indicators.

Selected answer: EU-audited reporting Value 250 SEAL 4

Notes: Iliad Group files CSRD/ESRS report with Deloitte limited assurance. Scaleway also provides ADEME-validated LCA methodology with ESRS E1/E3/E5 mapping for carbon, water, and circular economy.

Evidence

  • Environmental Footprint Calculator | Scaleway other 30. August 2026
    Scaleway's LCA-based tool measuring carbon (Scope 1-3) and water impact per product, methodology co-built with IJO and validated by ADEME PCR, mapping to ESRS E1/E3/E5.
    Relevance: Demonstrates detailed EU methodology for environmental impact measurement with ADEME validation and explicit ESRS mapping covering carbon, water, and circular economy indicators.
  • Iliad Group Universal Registration Document 2024 other 29. August 2026
    Official corporate filing: 96.27% Niel family ownership via French holding companies; discloses Group IP strategy and lists Scaleway as subsidiary.
    Relevance: Confirms EU-audited reporting: parent company files ESRS-compliant CSRD report with external auditor (Deloitte) limited assurance covering all key sustainability indicators.
  • Scaleway Environmental Leadership other 29. August 2026
    Scaleway's environmental page: net-zero by 2050, SBTi-validated targets, PUE 1.37, 100% renewable energy, circular economy programs, EcoVadis Gold Medal, annual impact reports.
    Relevance: Shows transparent annual disclosure of carbon, water, and energy metrics with third-party recognitions (SBTi, EcoVadis) and per-data-center granularity.
All possible answer options (5)
  • No reporting (value 0.00, SEAL 1)
  • Detailed EU methodology (value 62.00, SEAL 1)
  • Annual report (value 125.00, SEAL 2)
  • Detailed EU methodology (value 187.00, SEAL 3)
  • EU-audited reporting (value 250.00, SEAL 4) ✓
Q4. Energy supplies - sourcing of renewable or low-carbon energy to power infrastructure and operations

Selected answer: Only green EU energy supplies Value 250 SEAL 4

Notes: 100% renewable (wind/hydro) energy with Guarantees of Origin across all EU data centers since 2017. No non-EU or fossil energy sources used.

Evidence

  • How Sustainable Is Your Cloud Provider? | Scaleway Blog other 30. August 2026
    Scaleway blog advocating holistic sustainability beyond PUE, detailing server lifespans up to 10 years, low WUE values, and circular economy programs.
    Relevance: Provides independent framing of energy sourcing methodology and confirms Scaleway uses only renewable energy in EU-based data centers.
  • Iliad Group publishes its 2024 ESG report other 30. August 2026
    Iliad Group's 2024 ESG report announces SBTi-validated carbon pathway and three new renewable electricity PPAs across Europe.
    Relevance: Confirms parent company's commitment to expanding renewable energy sourcing via PPAs across EU operations, reinforcing long-term green energy supply.
  • Scaleway Environmental Leadership other 29. August 2026
    Scaleway's environmental page: net-zero by 2050, SBTi-validated targets, PUE 1.37, 100% renewable energy, circular economy programs, EcoVadis Gold Medal, annual impact reports.
    Relevance: Directly confirms 100% renewable EU energy sourcing with Guarantees of Origin for all data centers, addressing renewable/low-carbon energy supply question.
All possible answer options (4)
  • Only EU energy supplies (value 62.00, SEAL 4)
  • Mix of EU and non-EU supplies (value 125.00, SEAL 4)
  • Only EU energy supplies (value 187.00, SEAL 4)
  • Only green EU energy supplies (value 250.00, SEAL 4) ✓

Data Centres

Scaleway operates a total of 10 data centres:

CountryCityName
FranceVal-de-MarneScaleway DC2
FranceVal-de-MarneScaleway DC3
FranceParisScaleway DC4
FranceSaint-Ouen-l'AumôneScaleway DC5
PolandWarsawScaleway WAW1
PolandWarsawScaleway WAW2
PolandWarsawScaleway WAW3
NetherlandsAmsterdamScaleway AMS1
NetherlandsAmsterdamScaleway AMS2
NetherlandsAmsterdamScaleway AMS3
ItalyMilanScaleway MIL1

Check the map of data centres for the geography of the data centres.

Environmental Policy

Scaleway has a very distinct and holistic environmental policy, based on several pillars:

  • Energy: Scaleway’s policy regarding energy consumption is twofold: the data centers are designed use as minimal electricity as possible. Furthermore, the company strives to use low-carbon energy and seems to offset fossil energy usage, e.g. for the data centers in Poland (source).
  • Water consumption: the data centers are designed to minimize water consumption for cooling.
  • Circular economy: Scaleway claims to use hardware with an average lifetime of 10 years, vs. 5 years industry average.
  • Measurement & Transparency: the company is measuring its own environmental footprint and is being transparent about it. Furthermore, it has an elaborate Enviromental Impact Calculator for its cloud users.

Read more about Scaleway’s environmental policy.

As a Scaleway user, you can track your own environmental footprint with the Scaleway Environmental Footprint Calculator. Right now, not all services are included in the Environmental Footprint Calculator, but they are working on adding more and more services.

Certifications

Scaleway holds key certifications, such as the ISO 27001. They have also entered the qualification process for SecNumCloud in 2025. SecNumCloud is a quite demanding qualification and testifies highest trust towards a cloud provider in France.

NameDescription
HDSFrench certification required for Health Data Hosting. Requires data management features such as high availability, automatic backups and encryption.
ISO 27001World's best-known standard for information security management systems (ISMS)
ISO 27701Requirements for Privacy Information Management System
ISO 50001Standard for Energy Management System
SecNumCloudFrench certification framework for cloud service providers. Recognized as one of the most demanding qualification frameworks in Europe.

Scaleways description of security and resilience contains a detailed section on certificates and certification status.

Conclusion

Scaleway offers a highly appealing package designed to cater to projects of all sizes. It is accessible to individuals and provides a range of services that enable true scale-to-zero functionality, spanning both compute and database solutions. Additionally, Scaleway stands out by offering unique services that many other European providers have yet to introduce, such as an IoT hub.

Coupled with a strong environmental policy, a sleek and user-friendly console, and exceptional customer support, Scaleway presents a comprehensive and highly competitive offering.

Resources

Compare with another provider

Scaleway
  • Headquarters8th arrondissement of Paris, France
  • Parent companyIliad Group
  • Cloud since2015
  • Websitewww.scaleway.com
Containers
Serverless
Managed Databases
Managed Services
Security and Identity
Compute
Bare Metal
Network
AI
Storage

Further Reading

Scaleway Compute Instance
n8n on a Scaleway Instance
Scalingo Banner
Scalingo – Deploy at lightning speed
OVHcloud building
OVHcloud – European cloud with a worldwide presence
To top