OVHcloud gains SecNumCloud for public cloud: what changes for hosting resellers in Italy

OVHcloud obtained SecNumCloud qualification from ANSSI, the French cybersecurity agency, on 1 September 2026 for its SNC Cloud Platform. This is stated in the group's official announcement. It's not just a detail for French specialists: OVHcloud has announced that the platform will also arrive in the public cloud regions of Italy, Germany and Poland, with each deployment compliant with national regulatory frameworks. For anyone in Italy reselling hosting or managing infrastructure for enterprise clients, now is the time to understand what this is about before a client asks.

What SecNumCloud actually means

SecNumCloud is an in-depth audit, conducted by an independent assessor under ANSSI's authority, covering nearly 1,200 requirements across the entire value chain: infrastructure, operations, governance, organisation and security. It is not self-certification: the qualified provider must demonstrate protection against extraterritorial data access, operational autonomy, EU-based infrastructure and operations, and robust isolation and security mechanisms.

For OVHcloud, this is the third service line to gain the certification. The other two are Hosted Private Cloud powered by VMware, qualified since December 2023, and Bare Metal Pod, qualified since March 2025. SNC Cloud Platform is the first to replicate the vendor's standard "normal" Public Cloud model: billed on consumption, based on open APIs and open source standards, to facilitate interoperability with existing environments and data reversibility.

Why now

The timing is no accident. Article 31 of French law no. 2024-449 and its implementing decree of 14 April 2026 mandate the use of certified cloud services for sensitive French state data and its operators. The same regulatory pressure is extending to regulated sectors such as healthcare, finance, industry and energy, as well as software vendors working with public administrations.

Where and when it arrives in Europe

The group is expanding SNC Cloud Platform to its Public Cloud regions across Europe, with Italy, Germany and Poland as next steps, and each deployment compliant with applicable national regulatory frameworks. In France, the general availability schedule, published on the official OVHcloud blog, is staggered:

Region / service	General availability
Gravelines (GRA)	Already available
Strasbourg (SBG)	Early November 2026
Roubaix (RBX)	January 2027
Metal instances and VMs on dedicated hosts	Late November 2026
GPU instances	Late February 2027

For Italy, Germany and Poland, a general availability date has not yet been published: OVHcloud speaks generically of next steps.

EU-based is not the same as "SecNumCloud qualified"

This is the point an Italian reseller needs to grasp, with no need to sell to the public sector. An infrastructure with legal seat and servers in the European Union can still be subject to extraterritorial laws if the parent company or part of the shareholding is controlled by non-EU entities: this is the typical case raised by regulations like the US CLOUD Act or FISA. SecNumCloud, by contrast, requires the qualified provider to demonstrate protection against extraterritorial data access and operational autonomy, not to vaguely promise that data "remains in Europe".

Who needs it, and why it matters even if you don't sell to the public sector

The qualification currently serves French public entities, critical infrastructure operators and sectors such as healthcare and finance that have contractual relationships with French operators or with regulated subsidiaries in France. For an Italian reseller who does not deal with the public sector, the practical point is different: if an enterprise client has a French parent company, a regulated subsidiary or participates in tenders that require vendors with this certification, knowing that OVHcloud is bringing it to Italian regions too allows you to answer a specific request rather than discover it during a lost negotiation.