Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Scaleway

VERIFIED
Cloud & hosting · France
Founded 1999 · scaleway.com ↗

French sovereign cloud (Iliad-owned, Xavier Niel), ANSSI SecNumCloud + HDS + ISO 27001; winner of €180M EU Cloud III tender.

In short

Scaleway, in the Cloud & hosting category, is an EU-owned service with France as its hosting location and no identified CLOUD Act exposure.

Assessment notes

Scaleway SAS (Paris, French subsidiary of Iliad Group, Xavier Niel's Euronext-Paris-listed telecoms and tech group) is one of two French sovereign-cloud answers in this directory: ISO/IEC 27001:2022, HDS (French healthcare data hosting, July 2024), on the SecNumCloud 3.2 qualification path with ANSSI, and selected April 2026 as one of four winners of the European Commission's €180M Cloud III sovereign-cloud tender: EU-owned and EU-hosted with no CLOUD Act exposure for EU-region customer workloads.

CLOUD ACT
OWNERSHIP
SUB-PROCS
11 · 3 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Scaleway

Scaleway is the French cloud subsidiary of Iliad Group, Xavier Niel's Euronext-Paris-listed telecoms and tech holding (parent of Free in France and Iliad Italia), operated as Scaleway SAS at 8 Rue de la Ville l'Évêque, 75008 Paris. The company traces back to 1999 (Online.net legacy) and runs four multi-AZ cloud regions in Europe with 65+ global points of presence and 5,000+ GPUs. Flagship customers include Mistral AI, Hugging Face, Aternos, France Télévisions, and Veepee. The product surface covers 100+ cloud services including bare metal (Dedibox, Elastic Metal, Apple Mac mini), GPU instances (L40S, L4, H100, B300-SXM), Kubernetes, serverless containers, managed databases (PostgreSQL, MySQL, Redis, MongoDB), Data Warehouse for ClickHouse, AI clusters, and generative APIs.

For procurement-grade EU buyers Scaleway has two structural advantages that place it alongside Hetzner and OVHcloud as an EU-owned, EU-hosted provider with no CLOUD Act exposure. First, on 27 April 2026 it was selected, alongside Post Telecom (with Clever Cloud and OVHcloud), STACKIT, and Proximus (with S3NS, Clarence, and Mistral AI), as one of four winners of the European Commission's Cloud III Dynamic Purchasing System, the €180M sovereign-cloud procurement framework that explicitly excluded AWS, Microsoft Azure, and Google Cloud. Second, it carries the ANSSI SecNumCloud 3.2 qualification (the French government cloud-security framework designed to provide immunity from US extraterritorial laws including the CLOUD Act and FISA Section 702) plus HDS certification for healthcare data hosting (issued by the French National Agency for Digital Health in July 2024, with no transfer of personal health data permitted outside France). Scaleway has also been selected to host the French national Health Data Hub, replacing Microsoft Azure in that role, a high-profile public-sector sovereignty win.

Pricing is highly competitive: the Stardust instance class starts from approximately €2/month (smallest virtual instance), Public Cloud Compute scales up from there with hourly and monthly billing, and bare metal Dedibox dedicated servers compete directly with Hetzner on price. Best fit: EU public-sector buyers, regulated industries (healthcare, finance, defence), AI-workload teams who want GPU capacity inside an EU sovereign-cloud envelope, and any procurement-grade buyer needing SecNumCloud-grade isolation. Together with OVHcloud and Hetzner, Scaleway forms the recommended three-pillar EU hyperscaler-alternative stack on this directory.

SUB-PROCESSORS

Sub-processor map · 11

Source ↗
  • 3S Data Center S.A EU
    Poland

    Colocation services (data center, Poland)

  • Atempo EU
    France

    Data recording and archiving for cold storage (Object Storage)

  • Atman sp. z.o.o EU
    Poland

    Colocation services (data center, Poland)

  • Atnorth EU
    Sweden

    Colocation services (data center, Sweden)

  • BrainStorm Network Inc. non-US
    Canada

    Service provider for VPS Dedibox

  • Clever Cloud EU
    France

    Cloud provider for Web Platform

  • Confia EU
    France

    Recycling of WEEE (electrical/electronic waste)

  • Digital Realty US
    United States

    Colocation services (datacenter landlord; physical-only, no data access)

  • Equinix EMEA US
    United States

    Colocation services (datacenter landlord; physical-only, no data access)

  • Iron Mountain US
    United States

    Colocation services (datacenter landlord; physical-only, no data access)

  • Op Core EU
    France

    Colocation services (data center, France)

3 of 11 sub-processors are US-incorporated. These are ancillary processors that do not hold protected customer data, so they do not change the assessment. CLOUD Act exposure is rated none.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
SecNumCloud
ACTIVE
FEATURES

Capability matrix

Dedicated / bare-metal Yes
Object storage (S3) Yes
Managed Kubernetes Yes
Managed databases Yes
GPU instances Yes
Hourly billing Yes
API / Terraform Yes
Countries 3 countries
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
from €2/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

  • Data Processing Addendum (DPA)
    www.scaleway.com/en…
    Open ↗
  • Sub-processors list
    www.scaleway.com/en…
    Open ↗
  • Terms of Service
    www.scaleway.com/en…
    Open ↗
ALTERNATIVES

Alternatives in this category

Aruba Cloud
Italy · Founded 1994
EU-SOVEREIGN

Italian sovereign cloud (Aruba S.p.A.), 4 Italian DCs (Arezzo/Bergamo/Rome), ACN-qualified up to AI3/QC3 for public administration.

Public DPA Sub-processors Open source
FROM
€1/mo
CLOUD ACT
NONE
Cleura
Sweden · Founded 2005
EU-SOVEREIGN

Swedish OpenStack public + compliant cloud (Cleura, ex-City Network, Iver-owned), ISO 27001/27017/27018, EU-only residency.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE
Clever Cloud
France · Founded 2010
EU-SOVEREIGN

French sovereign PaaS/IaaS: deploy apps and managed databases on EU infrastructure, billed per second.

Public DPA Sub-processors Open source
FROM
€4.8/mo
CLOUD ACT
NONE