Scaleway
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
French sovereign cloud (Iliad-owned, Xavier Niel), HDS + ISO 27001 and on the ANSSI SecNumCloud qualification path; winner of €180M EU Cloud III tender.
Scaleway is an EU-owned service hosted in France, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Scaleway SAS (Paris, French subsidiary of Iliad Group, Xavier Niel's Euronext-Paris-listed telecoms and tech group) is one of two French sovereign-cloud answers in this directory: ISO/IEC 27001:2022, HDS (French healthcare data hosting, July 2024), on the SecNumCloud 3.2 qualification path with ANSSI, and selected April 2026 as one of four winners of the European Commission's €180M Cloud III sovereign-cloud tender: EU-owned and EU-hosted with no CLOUD Act exposure for EU-region customer workloads.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 11 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Scaleway
Scaleway is the French cloud subsidiary of Iliad Group, Xavier Niel's Euronext-Paris-listed telecoms and tech holding (parent of Free in France and Iliad Italia), operated as Scaleway SAS at 8 Rue de la Ville l'Évêque, 75008 Paris. The company traces back to 1999 (Online.net legacy) and runs four multi-AZ cloud regions in Europe with 65+ global points of presence and 5,000+ GPUs. Flagship customers include Mistral AI, Hugging Face, Aternos, France Télévisions, and Veepee. The product surface covers 100+ cloud services including bare metal (Dedibox, Elastic Metal, Apple Mac mini), GPU instances (L40S, L4, H100, B300-SXM), Kubernetes, serverless containers, managed databases (PostgreSQL, MySQL, Redis, MongoDB), Data Warehouse for ClickHouse, AI clusters, and generative APIs.
For procurement-grade EU buyers Scaleway has two structural advantages that place it alongside Hetzner and OVHcloud as an EU-owned, EU-hosted provider with no CLOUD Act exposure. First, on 27 April 2026 it was selected, alongside Post Telecom (with Clever Cloud and OVHcloud), STACKIT, and Proximus (with S3NS, Clarence, and Mistral AI), as one of four winners of the European Commission's Cloud III Dynamic Purchasing System, the €180M sovereign-cloud procurement framework that explicitly excluded AWS, Microsoft Azure, and Google Cloud. Second, it holds ISO/IEC 27001:2022 and HDS certification for healthcare data hosting (issued by the French National Agency for Digital Health in July 2024, with no transfer of personal health data permitted outside France), and it is working through ANSSI SecNumCloud 3.2 qualification, the French government cloud-security framework designed to provide immunity from US extraterritorial laws including the CLOUD Act and FISA Section 702. Scaleway's own security pages describe that qualification as not yet granted and announce an upcoming qualified zone, so buyers who need SecNumCloud today should read it as in progress rather than in place. Scaleway has also been selected to host the French national Health Data Hub, replacing Microsoft Azure in that role, a high-profile public-sector sovereignty win.
Pricing is highly competitive: the Stardust instance class starts from approximately €2/month (smallest virtual instance), Public Cloud Compute scales up from there with hourly and monthly billing, and bare metal Dedibox dedicated servers compete directly with Hetzner on price. Best fit: EU public-sector buyers, regulated industries (healthcare, finance, defence), AI-workload teams who want GPU capacity inside an EU sovereign-cloud envelope, and any procurement-grade buyer who can work inside an HDS-certified French envelope while the SecNumCloud qualification runs its course. Together with OVHcloud and Hetzner, Scaleway forms the recommended three-pillar EU hyperscaler-alternative stack on this directory.
Sub-processor map · 11
-
3S Data Center S.A EUPoland
Colocation services (data center, Poland)
-
Atempo EUFrance
Data recording and archiving for cold storage (Object Storage)
-
Atman sp. z.o.o EUPoland
Colocation services (data center, Poland)
-
Atnorth EUSweden
Colocation services (data center, Sweden)
-
BrainStorm Network Inc. non-USCanada
Service provider for VPS Dedibox
-
Clever Cloud EUFrance
Cloud provider for Web Platform
-
Confia EUFrance
Recycling of WEEE (electrical/electronic waste)
-
Digital Realty USUnited States
Colocation services (datacenter landlord; physical-only, no data access)
-
Equinix EMEA USUnited States
Colocation services (datacenter landlord; physical-only, no data access)
-
Iron Mountain USUnited States
Colocation services (datacenter landlord; physical-only, no data access)
-
Op Core EUFrance
Colocation services (data center, France)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| 3S Data Center S.A | Poland | Colocation services (data center, Poland) | EU |
| Atempo | France | Data recording and archiving for cold storage (Object Storage) | EU |
| Atman sp. z.o.o | Poland | Colocation services (data center, Poland) | EU |
| Atnorth | Sweden | Colocation services (data center, Sweden) | EU |
| BrainStorm Network Inc. | Canada | Service provider for VPS Dedibox | non-US |
| Clever Cloud | France | Cloud provider for Web Platform | EU |
| Confia | France | Recycling of WEEE (electrical/electronic waste) | EU |
| Digital Realty | United States | Colocation services (datacenter landlord; physical-only, no data access) | US |
| Equinix EMEA | United States | Colocation services (datacenter landlord; physical-only, no data access) | US |
| Iron Mountain | United States | Colocation services (datacenter landlord; physical-only, no data access) | US |
| Op Core | France | Colocation services (data center, France) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Scaleway
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |