Contents
Hosting in the EU settles where the data is stored, not which law applies: a provider subject to foreign law can receive an access request from its own authorities. For everyday data, an EU region and a solid contract are enough; for sensitive data, favor a European host or a SecNumCloud-qualified offer.
“Is our data in France?” is often the first question a CIO or CEO asks. It is a fair question, but an incomplete one. Three things need to be separated: where the servers are, which law the provider is subject to, and which third-party services also receive data. Here is how I frame the choice for a business app, with the reference texts. This page is not a substitute for legal advice.
Location, jurisdiction, processors: three separate questions
- Where are the servers? A European region guarantees the data is stored in the EU. That is the baseline.
- Which law is the provider subject to? A company subject to a foreign law with extraterritorial reach can receive an access request from its own authorities, even for data stored in Europe. That is precisely the risk addressed by ANSSI’s SecNumCloud framework (see below). ANSSI is France’s national cybersecurity agency.
- Who else receives the data? Email delivery, payments, e-signature, monitoring, AI: each third-party service has its own location. The weakest link sets the real level.
A concrete example: Supabase, which I often use for the database, offers several regions inside the European Union, including Paris and Frankfurt, chosen when the project is created (list of regions, checked October 27, 2026). The location is European, but Supabase is a US company: that is when question 2 needs to be examined.
What the law says about transfers outside the EU
The GDPR does not ban transfers outside the European Union: it regulates them (Chapter V). The French data protection authority summarizes the available mechanisms on its page on the general framework for transfers (in French): adequacy decisions by the European Commission, standard contractual clauses, binding corporate rules.
For the United States, the Commission adopted an adequacy decision (Implementing Decision (EU) 2023/1795) on July 10, 2023, known as the “Data Privacy Framework,” which covers certified US companies. The EU General Court dismissed the challenge against it on September 3, 2025; an appeal was lodged with the Court of Justice on October 31, 2025. When we checked (October 27, 2026), we found no ruling from the Court on that appeal. The previous framework, the Privacy Shield, was struck down in 2020: these mechanisms are not guaranteed to last, which is a reason to limit dependence when the data is sensitive.
Hosting options
| Option | Location | Law the provider is subject to | Suitable for | Relative cost |
|---|---|---|---|---|
| EU region of a non-European provider | EU | Home-country law, in addition to EU law | Everyday data, with a contract and a transfer mechanism | Low |
| Host headquartered in France or the EU | EU | EU law | Everyday personal data and confidential business data | Low to medium |
| SecNumCloud-qualified offer | EU | EU law exclusively | Sensitive data, requirements from public-sector or enterprise customers | High |
| HDS-certified host | Depends on the offer | Depends on the offer | Health data hosted on behalf of a third party | Medium to high |
For a typical business app, hosting runs from a few tens to a few hundred euros a year, paid by the client, on an account in its own name.
SecNumCloud and health data
The SecNumCloud framework (in French), created by ANSSI in 2016, qualifies cloud offers. According to ANSSI’s FAQ, checked October 27, 2026, it requires among other things that the provider be subject exclusively to EU law, with conditions on headquarters, ownership and operational autonomy, and that the data and its administration stay in the EU. ANSSI notes that qualification does not guarantee the security of the service a client runs on top of it: your app still has to be well built. The list of qualified offers is published on ANSSI’s website.
For health data, France requires certification as a health data host (HDS) in the cases set out in its public health code. France’s digital health agency (in French) publishes the framework and the list of certified hosts.
How I choose hosting with you
During scoping, I ask four questions:
- What data? Business contacts, employee data, health data, trade secrets.
- What do your customers require? An enterprise or public-sector buyer may require European or qualified hosting in its tenders.
- Which third-party services? For each one, is there a European option?
- How reversible? Standard technologies (PostgreSQL, Node.js) let you change hosts; ownership of the code and access is transferred to you once the project is paid in full.
The outcome goes into the requirements document, along with the list of processors to add to your record of processing (see GDPR and business apps).
When “sovereign” hosting is not necessary
I will be straightforward: for an internal tool that manages schedules or inventory without sensitive data, an EU region of a major provider, with a processor agreement and a transfer mechanism in place, is a proportionate answer. Paying for a SecNumCloud-qualified offer only makes sense if your data, your customers or your industry require it. Conversely, if you handle sensitive data in a US SaaS product, the page on US SaaS and sensitive data explains the risks.
Where to start
List the data your future tool will store and the contractual requirements of your main customers. Those two things determine the hosting. Hosting and backups are planned during scoping for every business app, and the estimator gives you a first budget range for development.
Frequently asked questions
Does EU hosting cost more?
Not necessarily. For a business app, hosting usually runs from a few tens to a few hundred euros a year, and both the European regions of major providers and European hosts fall within that range. SecNumCloud-qualified offers, however, cost more.
Can we change hosts later?
Yes, if the app relies on standard technologies (PostgreSQL, Node.js) and you own the code and access. The migration then takes some preparation and a short downtime. Check this in the contract: reversibility does not happen by accident.
Do third-party services (email, payments, AI) count too?
Yes. Every service that receives personal data is a processor, with its own location and jurisdiction. An app hosted in Paris that sends its emails through a US service transfers email addresses outside the EU, unless a European option is used.
Do we need a certified host for health data?
In France, hosting health data on behalf of a third party requires a specific certification known as HDS. If your app stores this kind of data, check with France’s digital health agency and your lawyer which requirements apply to your case.