OVHcloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
French sovereign cloud (OVH Groupe, Roubaix, 1999), ANSSI SecNumCloud 3.2-qualified Bare Metal Pod; 46 DCs, public on Euronext Paris.
OVHcloud is an EU-owned service hosted in France, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
OVH Groupe SAS (Roubaix, founded 1999 by Octave Klaba, publicly listed on Euronext Paris with the founding family still in control as Chairman + CEO) is one of two recommended EU-sovereign hyperscaler alternatives in this directory: ISO 27001 + ISO 27701 + SOC 2 + PCI DSS + GDPR baseline plus the French government's ANSSI SecNumCloud 3.2 qualification (March 2025, awarded for Bare Metal Pod), the German BSI C5 catalogue, French HDS for healthcare, Spanish ENS, and UK G-Cloud: EU-owned and EU-hosted with no CLOUD Act exposure for customer workloads placed in EU regions.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About OVHcloud
OVHcloud (legal entity OVH Groupe SAS, Roubaix, France) is the largest European hyperscaler alternative and the directory's reference choice for French and EU public-sector sovereign workloads. Founded in 1999 by Octave Klaba, the company is publicly listed on Euronext Paris and remains under founding-family control: as of 20 October 2025, Octave Klaba returned as combined Chairman of the Board and Chief Executive Officer after Benjamin Revcolevschi's one-year tenure. The group reported €1.08B revenue for fiscal year 2025 (+9.3%) at a 40.4% adjusted-EBITDA margin, serves 1.6M customers, and operates 46 data centres across four continents. Flagship customers include Société Générale, Louis Vuitton, Capgemini, and Sopra Steria.
Compliance is the differentiator. OVHcloud carries ISO/IEC 27001:2013, ISO/IEC 27701:2019, SOC 1/2/3, PCI DSS 3.2 Level 1, and GDPR alignment as the baseline. On top of that it holds the French government's ANSSI SecNumCloud 3.2 qualification (March 2025, applied to the Bare Metal Pod platform), the most stringent French sovereign-cloud certification, designed to provide protection from the U.S. CLOUD Act and FISA Section 702 by guaranteeing that cloud operations are immune from non-EU jurisdiction. It also carries French HDS (healthcare data hosting), German BSI C5 (cloud-security catalogue), Spanish ENS, UK G-Cloud public-sector framework, and HIPAA / HITECH for US healthcare workloads. The corporate position is explicit: "We do not sell, use or transfer your data; choose where to store your data and the jurisdiction that protects it."
For procurement, this matters because OVHcloud is one of the four winners of the €180M April 2026 EU sovereign-cloud tender (alongside Scaleway, Clever Cloud, and STACKIT). AWS was deliberately excluded. The Public Cloud product starts at roughly €5/month for small compute instances; first-time customers get US$200 in free credit. Data-centre regions across Frankfurt, Paris, London, Strasbourg, Roubaix, Gravelines, plus North America (Toronto, US), Asia-Pacific (Singapore, Sydney), and others, all customer-elected. Network capacity is 100 Tbit/s globally. Best fit: any EU procurement-grade buyer needing a strict CLOUD-Act-clean hyperscaler alternative, regulated industries (healthcare, finance, public sector), and customers who want SecNumCloud-grade isolation for the most sensitive workloads.
Sub-processor map · none disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of OVHcloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |