OVHcloud Public Cloud (inkl. SecNumCloud)

Provider-specific sources from the current dataset. Use the Compass for scoring, weighting, and A/B comparison.

Compare in the Compass

Provider Snapshot

Criterion	Score
Customer content in the EU	3.0
Customer-created metadata in the EU	3.0
Physically & logically separated	2.0
EU-based operations & support	4.0
No critical non-EU dependencies	4.0
Ownership / ultimate parent (EU-owned?)	5.0
Controlling interest & FISA 702 risk (jurisdiction ≠ residency)	5.0
Local contracting entity & EU governance (operational model)	3.0
Independent advisory board	0.0
EU root CA / trust services	1.0
BSI C5	3.0
ISO 27001 / ISMS	4.0
IT-Grundschutz (BSI)	0.0
SecNumCloud (ANSSI)	5.0
Open standards / API portability	2.0
Service portfolio depth	3.4
Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)	4.0
Audit reports / evidence pack	3.0
Policy enforcement (guardrails)	2.0
Default deny / secure by default	1.0
Independent verification (continuous)	2.0
Blackbox exposure (ops/control plane)	3.0
Operator access exclusion (workload scope)	3.0
IaC & automation (Terraform/OpenTofu, SDKs, APIs)	4.0
Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)	4.0
Observability (logs/metrics/traces, alerting)	3.0
Limits/quotas (transparency & increase)	3.0
Reference architectures / landing zones	4.0
Unified security stack	2.8
Energieeffizienz / PUE & Zielwerte	4.0
CO₂-/Wasser-Reporting + erneuerbare Energiequellen	4.0

Scope: IaaS+ (inkl. Bare Metal)

Customer content in the EU: 3.0; Customer-created metadata in the EU: 3.0; Physically & logically separated: 2.0; EU-based operations & support: 4.0; No critical non-EU dependencies: 4.0; Ownership / ultimate parent (EU-owned?): 5.0; Controlling interest & FISA 702 risk (jurisdiction ≠ residency): 5.0; Local contracting entity & EU governance (operational model): 3.0; Independent advisory board: 0.0; EU root CA / trust services: 1.0; BSI C5: 3.0; ISO 27001 / ISMS: 4.0; IT-Grundschutz (BSI): 0.0; SecNumCloud (ANSSI): 5.0; Open standards / API portability: 2.0; Service portfolio depth: 3.4; Geographic footprint & redundancy (regions/AZ/DCs in EU/DE): 4.0; Audit reports / evidence pack: 3.0; Policy enforcement (guardrails): 2.0; Default deny / secure by default: 1.0; Independent verification (continuous): 2.0; Blackbox exposure (ops/control plane): 3.0; Operator access exclusion (workload scope): 3.0; IaC & automation (Terraform/OpenTofu, SDKs, APIs): 4.0; Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s): 4.0; Observability (logs/metrics/traces, alerting): 3.0; Limits/quotas (transparency & increase): 3.0; Reference architectures / landing zones: 4.0; Unified security stack: 2.8; Energieeffizienz / PUE & Zielwerte: 4.0; CO₂-/Wasser-Reporting + erneuerbare Energiequellen: 4.0

Sources / Evidence

Customer content in the EU

SecNumCloud: Bare Metal Pod (dediziert/isoliert) in FR DCs (Gravelines, Roubaix, Strasbourg) – für regulierte/sensible Workloads (stated).

Customer-created metadata in the EU

Französisches Unternehmen. RZ in FR (Gravelines, Roubaix, Strasbourg), DE (Limburg). EU-only Operations.

Physically & logically separated

Bare Metal Pod: Isolation physisch & softwareseitig (für SecNumCloud) (stated).

EU-based operations & support

SecNumCloud (OVHcloud): in Frankreich gehostet; Betrieb/Wartung/Monitoring exklusiv durch Personal in Europa (stated).

No critical non-EU dependencies

Französisches Unternehmen (OVH SAS). SecNumCloud-Zertifizierung. Eigene RZ in EU. C5-Attestierung.

Ownership / ultimate parent (EU-owned?)

OVHcloud Groupe (FR/EU) (stated).

Controlling interest & FISA 702 risk (jurisdiction ≠ residency)

Ultimate Parent: OVH Groupe S.A. (FR/EU). Kein US-Parent; Risiko extraterritorialer US-Zugriffspflichten deutlich geringer.

Local contracting entity & EU governance (operational model)

OVHcloud Groupe (FR/EU); SecNumCloud basiert auf ANSSI-Vorgaben (Scope!).

Independent advisory board

Kein unabhängiges Advisory Board dokumentiert.

EU root CA / trust services

Keine spezifische Dokumentation zu EU Root CA / Trust Services.

BSI C5

BSI C5 zertifiziert (stated).

ISO 27001 / ISMS

ISO/IEC 27001 zertifiziert (OVHcloud Compliance/ISO-Seite) (stated).

IT-Grundschutz (BSI)

Kein IT‑Grundschutz öffentlich gelistet (Stand: OVHcloud Compliance/ISO-Seiten).

SecNumCloud (ANSSI)

Bare Metal Pod: Qualifikation SecNumCloud 3.2 (ANSSI); Deploy in Gravelines/Roubaix/Strasbourg; Management über OpenStack API (stated).

Open standards / API portability

Keine bekannte Teilnahme SECA; OpenStack API möglich (Bare Metal Pod) (stated).

Service portfolio depth

Breites Hosting/Cloud Portfolio; SecNumCloud Scope aktuell produktbezogen (stated).

Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)

Mehrere EU/FR Standorte; SecNumCloud-Angebot in FR DCs; Details je Scope (stated).

Audit reports / evidence pack

SecNumCloud: strenge Anforderungen; Evidence je Produkt/Scope anfordern.

Policy enforcement (guardrails)

IAM (Policies/Groups) dokumentiert; org-weite Config-Guardrails nicht explizit belegt (partial).

Default deny / secure by default

Default Security Group erlaubt alle Verbindungen (in/out); restriktive SGs müssen aktiv erstellt/zugewiesen werden.

Independent verification (continuous)

Regelmäßige unabhängige Audits/Attestierungen (ISO etc.) belegt; keine Continuous/maschinenlesbare Verification öffentlich belegt.

Blackbox exposure (ops/control plane)

SecNumCloud erfordert hohe Transparenz. C5-Attestierung. SOC 2 Type 2. Aber Control-Plane-Details begrenzt öffentlich.

Operator access exclusion (workload scope)

Intel SGX und AMD SME/SEV auf Bare-Metal-Servern verfügbar. SECURITEE-Partnerschaft für TEE-basiertes PaaS. vRack für sichere Inter-Server-Kommunikation.

IaC & automation (Terraform/OpenTofu, SDKs, APIs)

Terraform Provider (ovh/ovh) + OpenStack/OVH APIs; Pulumi-Ökosystem vorhanden. OpenTofu i.d.R. kompatibel (Terraform Provider).

Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)

Stark in IaaS/Bare Metal + Managed K8s/DBs; zusätzlich Managed Private Registry & Secret Manager verfügbar (stated).

Observability (logs/metrics/traces, alerting)

Observability-Angebote vorhanden (je Produktlinie unterschiedlich); für konkrete Services/SLAs pro Universe prüfen.

Limits/quotas (transparency & increase)

Quotas je Produkt/Service (Public Cloud) existieren; genaue Limits/Erhöhungsprozess prüfen.

Reference architectures / landing zones

OVHcloud Architecture Centre mit Architecture References und Blueprints.

Energieeffizienz / PUE & Zielwerte

Veröffentlicht Datacenter-KPIs (PUE/WUE) + Group KPI; PUE/WUE per DC inkl. Renewable Electricity share. (Quelle: OVHcloud KPIs per DC FY24)

CO₂-/Wasser-Reporting + erneuerbare Energiequellen

Carbon Balance für 3 Scopes (GHG Protocol) + erneuerbarer Strommix ausgewiesen; Wasser-KPIs je DC separat verfügbar. (Quelle: OVHcloud Carbon Balance + KPIs)

Service catalog (core/security)

Expand to load the service catalog …