Sovereign cloud: what is it?

Sovereign cloud is a concept that is gaining importance as our personal and professional data migrates to the cloud. But what exactly does this term mean?

Definition

A sovereign cloud is a data hosting service that guarantees:

• Location: data is stored in a specific country
• Jurisdiction: data is protected by that country's laws
• Independence: data is not subject to foreign extraterritorial laws
• Governance: access control over data is determined by local law

Why it matters

The US CLOUD Act

Adopted in 2018, the Clarify Lawful Overseas Use of Data Act (CLOUD Act) allows US authorities to access data stored by US companies anywhere in the world. Concretely:

• Microsoft, Google, Amazon (all US companies) must comply with US government requests
• Your data hosted with a US giant can be accessed without going through French courts
• You won't even be notified

The European GDPR

The General Data Protection Regulation (GDPR) imposes strict rules:

• Explicit consent for data collection
• Right to erasure ("right to be forgotten")
• Data breach notification
• Fines of up to 4% of global revenue

But the GDPR only applies to European companies. A US giant processing European data is subject to it... but must also comply with the CLOUD Act. Double jeopardy.

The guarantees of a sovereign cloud

A true sovereign cloud rests on several pillars:

1. Physical hosting: servers located in France (or Europe)
2. Open-source software: transparent, auditable code with no backdoors
3. Data encryption: both in transit and at rest
4. Independent infrastructure: no reliance on foreign cloud providers

Why Archibou is sovereign

Archibou is a sovereign cloud because:

• Your files are hosted in France, at OVH
• Under French and European jurisdiction
• The software is open source (Nextcloud)
• No US company is involved in your data chain
• You stay in control of your data at all times