Can you introduce Azursafe, its industry, mission and values?

The blockchain sector has been growing steadily for several years, bringing both new opportunities and complex challenges, including stricter regulations in Europe and beyond. In this evolving landscape, AzurSafe was founded with a clear mission to support blockchain companies, financial institutions, fraud victims, analytics partners, security researchers, and law enforcement agencies in one shared goal: Making Blockchain Safer.

We develop and offer transaction analysis and monitoring solutions, to identify malicious activity using intelligent and innovative technologies.

Quickly gaining the support of the French government and several key partners, AzurSafe has established itself as a trusted player in the sector, earning recognition from private and public financial institutions for its innovative solutions which bring a real added value both in operational and regulatory terms.

What were specific challenges you faced before joining OVHcloud’s Blockchain Accelerator?

Deploying such complex and advanced solutions requires significant logistics in all areas, whether technical or business. Like any ambitious start-up, AzurSafe needs to respond to these challenges as part of its development.

On the technical side, we have to manage and orchestrate dozens of services, from massive data flows to the various characteristics that define each blockchain, then process and analyze all of this while offering a near-instantaneous service, because on the blockchain, every second counts when it comes to preventing fraud.

Why did you decide to explore cloud solutions to overcome these obstacles?

As our solution progressed, we realized that we needed to manage more and more features, then orient the infrastructure so it’s modular as we went along, while maintaining high availability, security standards, and data management without blowing our budget, inevitably linked to our business challenges.

After using other cloud services, we immediately understood the relevance of OVHcloud’s offering. What’s more, we offer a sovereign solution to those who want it (SecNumCloud), so the choice was easy.

How did OVHcloud and the Startup Program help you overcome these challenges?

After two years of intense R&D, we were reassured after benchmarking against the current state of the art and quickly realized that our technology had the same technical capabilities, and even better ones. But that wasn’t all it took to deploy a solution of this kind on the market.

We needed to dig deeper and better understand our environment and the distribution of our solutions and technologies in an ecosystem that was already formed with established players requiring equally established solutions. Participating in inspiring industry exchanges and receiving support throughout our deployment greatly contributed to our success.

Which OVHcloud services or features do you use, and how do they stand out from other solutions?

For our part, we use almost all (or nearly all) Public Cloud services, which stand out from other solutions thanks to their simplicity, performance, and competitive pricing.

How has OVHcloud’s support helped you evolve your infrastructure to meet the demands of your business?

Their support has been very useful in various cases, thanks to the organization of workshops, mentoring, and infrastructure support.

What tangible results have you achieved since collaborating with OVHcloud? How have these results helped to accelerate your growth or improve your product/service offering?

Not to mention the ease of use, which saves time, the costs are at least half those of well-known American providers.

How have these results helped to accelerate your growth or improve your product/service offering?

The program has enabled us to better understand our environment and the industry in which we operate, by combining technical and business support.

Future Vision: What are your ambitions for the future of your startup, and how do you see it evolving within the cloud ecosystem?

Current technologies, as well as the various legal and illegal activities involving blockchain, are still in their infancy. It is easy to predict that they will evolve in the coming years, creating new opportunities but also complex challenges. We do not operate directly on the blockchain, but we must monitor it and evolve with it. Our infrastructure and services must be resilient, and the cloud remains the best alternative for our customers who do not want on-premise software.

What future challenges do you foresee, and how do you see the cloud playing a role in solving them?

The volume of data and the number of protocols and services built on decentralized technologies continue to grow rapidly. Yet, they still rely on essential solutions such as RPC nodes, interface hosting, and advanced platforms like ours to operate safely.

The risks are real and can affect everyone. Security is no longer an option in today’s digital age, and increasingly secure solutions will be necessary. The cloud is an excellent candidate for the coming years, provided it is used correctly.

What advice would you give to other growth-stage startups considering the cloud or joining a support program?

Go for it, you have so much to gain!

Conclusions

AzurSafe has recently reached a new milestone, surpassing $90 billion in transaction value monitored across more than 30 blockchains, highlighting emerging fraud trends and providing real-time insights using advanced AI and ML technologies that demonstrate unrivalled accuracy.

The precision of our fraud detection tools has been approved, audited, battle-tested and endorsed by experts in the financial and investigative industries. But this is only the beginning, and we are preparing huge projects that will completely redefine the landscape on an international scale.

We are surpassing ourselves at every stage to create a more secure blockchain and we would like to thank OVHcloud, our webhost for several years, for this great opportunity and for joining us in revolutionising this industry. We invite anyone who wants to contribute to join us as well.

If you’re a startup looking to transform your business, we encourage you to join the OVHcloud Startup Program or contact OVHcloud to discover how our solutions can support your journey!

In the cloud industry, especially in Canada, growth often comes with its own set of challenges. Our Managed Service Providers (MSPs), Value-Added Resellers (VARs), and System Integrators (SIs) are constantly balancing the pressures of staying competitive, embracing rapid innovation, and adhering to the core values that matter most to their clients. I’ve seen how complex this can be, but I’ve also seen how the right partnerships can transform those challenges into meaningful opportunities.

When Growth Meets Sovereignty

One of the key challenges many of our Canadian partners faced was the concern around data residency. Clients were often hesitant to embrace cloud solutions because they didn’t have the assurance that their data would remain within Canadian borders. It’s a valid concern, one that we, at OVHcloud, were ready to address.

By leveraging OVHcloud’s fully Canadian infrastructure, we didn’t just provide a technical solution; we offered peace of mind. This allowed our partners to confidently present cloud solutions that complied with rigorous Canadian data residency laws, empowering their clients to modernize their IT environments without fear of compromising on sovereignty.

What makes this so exciting for me is seeing how this challenge became a catalyst for growth. Our partners now deliver secure, compliant, and high-performance cloud services, transforming regulatory constraints into a foundation for trust and expansion.

This, to me, is the essence of what we do: turning challenges into opportunities, especially when it comes to sovereignty. It’s the kind of problem-solving that drives us and fuels our growth in the Canadian market.

Sustainability as a Business Differentiator

Another trend I’ve observed, particularly from our partners in Canada, is the rising importance of IT sustainability. Clients are asking questions like, “How green is your cloud?” The cloud is no longer just about performance and cost-efficiency—it’s about responsibility.

Thanks to OVHcloud’s water-cooling technology in our data centers, which drastically reduces energy consumption, our partners can now confidently assure their clients that their cloud services aren’t just reliable and affordable, they’re also environmentally conscious. This focus on sustainability has become a game-changer in conversations with clients, and it’s a great way for our partners to stand out from the competition.

As someone who’s passionate about both technology and sustainability, I find this aspect of our work incredibly rewarding. It’s about making the cloud more than just a tool—it’s about making it a responsible and ethical choice.

The Human Touch: Building Real Relationships

One of the things our Canadian partners tell me most often is what truly sets OVHcloud apart: it’s the people behind the technology. Yes, our infrastructure is top-notch, but it’s the personalized relationships that make all the difference.

As a partner manager, I get to be there for our partners—not just through generic portals or automated systems, but as a real person they can reach out to. Whether it’s for strategic advice, troubleshooting, or simply brainstorming new ideas, having that human connection has made all the difference in building trust and navigating the complexities of the market.

Trust is the foundation of any strong partnership, and it’s been amazing to see how our personalized approach has helped our Canadian partners grow. After all, it’s not just about what we do; it’s about how we do it—together.

A New Chapter for Cloud in Canada

Looking at the partner landscape in Canada today, I see much more than just numbers or market share. I see stories of transformation—of small MSPs evolving into national players, of integrators unlocking new opportunities for their clients, of businesses turning regulatory hurdles into competitive advantages.

At OVHcloud, we’ve always believed that partnership is about more than just transactions. It’s about building something together, step by step, project by project, challenge by challenge. And here in Canada, our journey is only just beginning.

The stories I’ve shared are just a glimpse of how human-scale partnerships can help turn challenges into growth, sustainability into opportunity, and technology into trust.

If you’re an MSP, VAR, or SI in Canada looking to expand your offerings, strengthen your client relationships, and leverage cloud solutions that are secure, sovereign, and sustainable, I invite you to join us. Let’s write the next Canadian cloud success story—together.

For startups ready to scale smarter, OVHcloud offers a compelling alternative: high-performance, cost-effective, and sovereignty-first infrastructure. Here’s why more and more growing startups are making the switch.

1. Predictable, Transparent Pricing

OVHcloud’s flat-rate pricing model eliminates hidden fees and unpredictable billing. Bandwidth is included. Egress costs? Zero. This gives startups the ability to budget confidently—even as infrastructure scales rapidly.

2. Cost-Efficient Scaling

Startups that migrate to OVHcloud often report up to 60% cost savings compared to hyperscalers. Whether you’re scaling your backend, AI workloads, or customer-facing applications, OVHcloud lets you do more with less.

3. Performance Without Compromise

From Bare Metal servers and high-memory VMs to GPU and storage-optimized instances, OVHcloud infrastructure is engineered for performance. Ideal for AI, SaaS, analytics, and other compute-intensive use cases.

4. Full Data Sovereignty in the EU

OVHcloud is headquartered in Europe and operates under the strictest data protection laws (like GDPR in the EU or Law 25 in Quebec, Canada). Unlike other providers, your data stays within jurisdictions that respect privacy and sovereignty—no exposure to foreign surveillance laws.

5. Open Standards and No Vendor Lock-In

Freedom matters—especially when you’re building for scale. OVHcloud supports open technologies like Kubernetes, Terraform, and OpenStack, giving your team full flexibility and avoiding lock-in to proprietary tools or services.

6. Infrastructure That Grows With You

Whether you’re launching in new markets or onboarding thousands of new users, OVHcloud enables seamless horizontal and vertical scaling. With availability across multiple regions, your growth won’t hit a wall.

7. Faster Time-to-Market Through Cloud Migration Support

OVHcloud offers cloud migration guidance and tools, including compatibility with major platforms and migration kits. This helps your team move faster, avoid downtime, and focus on innovation—not infrastructure headaches.

8. Dev-Friendly Ecosystem

With support for containerization, automation, and CI/CD pipelines, OVHcloud makes life easier for DevOps teams. You can provision infrastructure programmatically and scale efficiently—just like you would with AWS or GCP.

9. Sustainability Built In

Efficiency is built into OVHcloud’s DNA. By designing and operating its own energy-efficient data centers, OVHcloud helps startups meet their sustainability goals without compromising on performance or cost.

10. A Cloud Partner—Not Just a Provider

Startups need more than compute power—they need guidance, flexibility, and a partner that understands their journey. OVHcloud offers tailored support, technical documentation, and real human engagement to help you succeed at every stage of growth.

OVHcloud: Built to Scale With Startups

If your startup is growing fast and needs infrastructure that can keep up—without breaking the budget or sacrificing control—OVHcloud offers a cloud built around your values: scalability, transparency, freedom, and performance.

Migrate with confidence. Scale with control. Grow with OVHcloud.

If you’re a startup looking to transform your business, we encourage you to join the OVHcloud Startup Program or contact OVHcloud to discover how our solutions can support your journey!

OVHcloud is an industry leader for cloud infrastructure for blockchain and Web3 startups, delivering scalable, compliant, and secure cloud solutions made for decentralised applications, enabling the next era of digital trust.

Whether startups are building blockchain-native products or integrating decentralised technologies, our ecosystem offers the technical support, mentorship, and commercial resources they need to succeed.

Key partners in this accelerator that will help with your go-to-market needs are Degen House, Super Team Solana, Crypto Mondays, Alchemy and Dysnix.

Designed to be light-touch in terms of your time but high-impact in terms of value, the Blockchain and Web3 Accelerator offers everything that is OVHcloud (price/performance, energy efficiency, tech freedom, personal touch, decentralization and security of services) and more.

The 10-week program offers:

• €50k in free cloud credits to use on our Public Cloud solutions. This is in addition to Startup Program credits but the maximum total credits that can be allocated remains €100k.
• Deep-dives into blockchain, GTM strategies, sales training etc.
• Workshops on GTM, sales, investor readiness, and marketing to boost growth
• 1-on-1 mentoring from experts
• Engagement with corporates for possible POCs
• Engagement with Venture Capitalists (VCs) for possible funding

Up to 20 startups will be selected for the cohort of the Blockchain and Web3 Accelerator. Applications open on 4th of June, and the accelerator will run from 16 September 2025 to 20 November 2025.

Entries close on 7^th July 2025 (Apply NOW!) and selected participants will be announced on 23 July 2025.

The 10-week program is divided into 3 phases:

1. Phase I – Go-to-Market
   Focus on refining your product-market fit, marketing, and go-to-market strategy. You’ll work with our team to sharpen your positioning and business foundations.
2. Phase II – Build
   Deep dive into blockchain technology and cloud integration. You’ll collaborate with our Web3 and technical teams to optimize your infrastructure and unlock the full potential of OVHcloud solutions.
3. Phase III – Scale
   Prepare for investor engagement and scalable growth. This phase includes sales strategy and investor readiness, culminating in a final pitch at the OVHcloud Summit in Paris on 20 November 2025.

The accelerator program includes 1-on-1 mentoring from OVHcloud and external experts who will be matched with participants based on their needs. The program is designed to be agile, requiring only three hours a week or less, but can scale to support you as needed. It does also include a 1-year commitment to use OVHcloud’s products and solutions to ensure continuity after exit from the Accelerator.

Applications will need to meet the following criteria to be selected:

• You must be a Startup Program member that has been active in the program or as an OVHcloud customer for at least 1 month (not a member? Apply now)
• Your startup must be working with blockchain technology, but please note that we are unable to admit proof of work or mining blockchain creators into the program
• Preference will be given to Scale level members of the Startup Program

“Startups are an essential part of the blockchain ecosystem and one of the building blocks of the digital trust economy,” says Omar Abi Issa, Global Sales Director, Blockchain, Web3 and AI, OVHcloud. “Many startup ideas are created to solve business problems. However, most businesses and consumers experience these problems differently, and before businesses scale (and ‘go horizontal’) it’s important to learn enough about the market and audience so that your solution is truly innovative and useful.

As a former startup, OVHcloud understands what founders and their teams need, but as a global organisation which shares blockchain’s ethos of decentralisation, transparency and security, OVHcloud is in a unique position to help nurture and support the growth of tomorrow’s blockchain champions. We look forward to meeting latest group of companies participating in our accelerator, and are grateful to each and every application to the program.”

Startups like Bware Labs and Super Protocol have already enjoyed the benefits that the Fast Forward Accelerator offers.

“Our collaboration with OVHcloud has been very fruitful since we started using the platform and we are especially thankful to our account manager.” says Flavian Manea, CEO at Bware Labs

“We are very excited to work with OVHcloud, they are a reliable and high-performing partner. They have seamlessly delivered the growth of Super Protocol’s confidential computing infrastructure on which the future of Web3 is being built,” says Yulia Gontar, COO at Super Protocol

Sign up to the Startup Program and Blockchain and Web3 Accelerator today to benefit from a wealth of support – and scale your business faster.

These themes are not simple. In addition to the core function of AI tools – for example, considering what an AI app does, how it does it, and whether bias is present – most businesses are starting to realise that they need to consider the deeper ‘AI supply chain’.

This is not just altruistic. A number of LLM tools are currently facing the risk of lawsuits for copyright infringement, because they may have been trained without due content permission. AI tools that present biased results are quickly exposed in press, leading to reputational damage and a loss of customer trust. Some countries also have legislation permitting data usage for economic intelligence purposes – but in another region, this may represent a data breach. AI has also received negative publicity for ‘running hot’ and consuming large amounts of energy and water in datacenters.

However, AI can also be a tremendous force for good – if handled correctly. So, what should businesses be thinking about so that they get the most from AI, without incurring undue commercial or reputational risk?

1- Consider Sovereignty from the Start

Understand your data ‘supply chain’ from the very beginning of the process. For example, if you’re using an external LLM for a chatbot, where was this developed? Which data was it trained on, and was this data acquired ethically?

“AI can often be a black box when it comes to processing data,” says Lex Avstreikh, Strategy Lead for Stockholm-based AI firm Hopsworks. “It’s far too complex to show how the system arrived at any one decision. But if you can show people the inputs and the outputs, then that goes a long way to building transparency and trust.”

2- Plan for a Sovereign Future

It’s important to think about where data will be during its future lifecycle – will you be running in an external datacenter, and where will data be in transit and at rest? Where are the headquarters of the datacenter company in question and what does this mean from a regulatory and handling perspective? Perhaps most importantly, will your customers be happy with all of these arrangements?

This was the decision journey faced by Swedish AI firm Ebbot. In July 2020, the Data Protection Commission v. Facebook Ireland case, commonly referred to as Schrems II, resulted in the Court of Justice of the European Union (CJEU) issuing a decision that added more regulations to data protection and processing principles. Ebbot recognised the importance of data security and compliance and thus made it a priority to store and process all data within the EU.

3- Location, location, location

Location isn’t just an important sovereignty concern – it’s also crucial to sustainability. Although Scandinavia may have very green energy, it’s easy to forget that many cloud providers will offer geographical ‘computing zones’ rather than defined locations, which can result in a less green footprint. CPU- and GPU-intensive tasks like model training should be run in green energy zones wherever possible, and are rarely latency-dependent; consequently, you can locate them far away if necessary.

When your AI app goes into production, also remember that backup and redundancy are a necessity – but will also increase your carbon footprint. Consider having a ‘low power’ or passive backup if commercially feasible – it will take longer to bring online in the case of emergency, but you’ll be consuming less power.

4- Always Consider Necessity

A lot of organisations only consider hardware efficiency and power consumption during the development process, but green software is rapidly gaining popularity. Having efficient code which is still fit for purpose can have a huge impact on power consumption, particularly if you’re building an app for very broad use. “We’ll definitely see more efficient and specific LLMs, because they’re absolutely needed,” added Avstreikh.

Although organisations are often considering the cost of development, with FinOps initiatives, we are also seeing the dawn of GreenOps, ensuring that technology is as green as possible from end to end. To that effect, consider benchmarking the CPU and memory usage of your application, because less hardware-intensive apps are usually less power-hungry.

5- Re-use, recycle

Developing bespoke code can make sure that it’s as lean and efficient as possible, but it can also use needless computing power to develop. Many technology organisations will offer PaaS offerings that can automate common parts of the application development and deployment process. For example, consider our AI Endpoints solution, which helps developers to access other AI models, from Bert to Mistral to Llama, all using a simple API.

This is not an easy process, but establishing responsible AI conduct in your organisation’s DNA will avoid complications further down the road, and also show to customers that you are considering data – including theirs – in a responsible, secure way. With increasing numbers of organisations tracking not only their scope three emissions, but also their data supply chains in a more comprehensive fashion, sovereignty and sustainability are two clear ‘musts’ for any modern AI company.

If you’re a startup or scale-up building an AI solution, and would like to work with a sovereign, sustainable cloud provider in turn, you can find more information about OVHcloud – including our cloud credit scheme – on our startup hub.

Recognizing that data is now key to many industries, OVHcloud supports its clients in their data journey. Without compromising data sovereignty and trusted cloud. Nor performance or security. When building its open and trusted Cloud, OVHcloud ensured that customers, partners and cloud users alike can keep their freedom of choice on a secure space. Providing users with clear, transparent, and accessible information on regulations applying to their data. OVHcloud offers a trustworthy environment. A place where data, including the most sensitive one, is protected with the highest standards and transparent certifications. This unique proposition, backed by a resilient infrastructure, ensures that your data stays your data. All the while being immune to extra-territorial laws. We are confident that data sovereignty and trusted cloud can make a difference.

What is Trusted Cloud and how does it support data sovereignty?

Trusted Cloud provides the highest levels of security, privacy, and transparency for its users. It gives industries the tools and the confidence to leverage the cloud for their digital transformation, while preserving their values, interests, and competitiveness.

In other words, Trusted Cloud provides data protection and sovereignty, that encompass both cybersecurity and legal dimensions:

• It ensures that the data of its users is encrypted, and backed up. With this in mind, users keep track of their data usage and have full control and ownership over their data and the insights derived from it. Trusted cloud complies with the strictest regulations and certifications (SNC, C5…) and offers contractual guarantees to its users.
• It gives its users the visibility and the control over the operations of the cloud provider, such as where the data is stored, who can access it, and how it is processed. 

OVHcloud Trusted cloud solutions contribute to the development of a European cloud market that is diverse, dynamic, and resilient. For this reason, our solutions comply with various certifications, including the highest known today in protecting organizations, industries, and governments’ interest: SecNumCloud.

What is SecNumCloud qualification all about?

SecNumCloud is issued by the French National Cybersecurity Agency (ANSSI). Its goal is to guarantee that the cloud service meets the strictest requirements in terms of data protection, and data sovereignty. The SecNumCloud standard covers requirements relating to the service provider, its employees and the way in which services are provided. It guarantees the robustness of the solution in the face of the most common cyber-attacks, as well as the rigor and formalization of the service provider’s processes and methods. The qualification process is a long-term guarantee, ensuring a relationship of trust between service providers and ANSSI.

The requirements of SecNumCloud’s most recent qualification (SecNumCloud 3.2) guarantee the protection of cloud services from non-European law thanks to a combination of three types of measures:

– technical: watertightness test standards of information systems;

– operational: only the service provider can intervene on the resources supporting the service;

– legal: exclusive application of European law.

What is at stakes with SecNumCloud is the use of this qualification for both public administrations and private organizations. Domains – industry sectors – such as finance and banking, health and cybersecurity, anchor their expansion to their ability to protect cloud data and cloud services.

OVHcloud has recently received the SecNumCloud 3.2 qualification on three distinct datacenters located in France: Gravelines, Roubaix and Strasbourg. With an unparallel commitment to SecNumCloud, OVHcloud is a firm believer that the qualification can guarantee the future of business for industries and administrations. For which cloud is now a center piece and a driver for disruption. By providing them with a trusted cloud solution that enables to store, process, and share their sensitive and strategic data.

OVHcloud can support European public and private organizations:

– by offering them a range of cloud services SecNumCloud qualified (such as Hosted Private Cloud, which is a dedicated, scalable, and hybrid cloud solution);
– OVHcloud’s SecNumCloud services are hosted in its own data centers in France;
– OVHcloud ensures that no data is accessible, transferred, or processed outside the European Union.

Extended certifications to meet local regulations

While SecNumCloud is the highest standard of security and data protection available today, our Cloud is multilocal and meets a number of stringent international certifications, such as:

1. ISO/IEC 27001 (International): Widely adopted internationally, including in European countries, this standard focuses on information security management systems.

2. C5 (Cloud Computing Compliance Controls Catalog) certification (Germany): the certification is a recognized standard for cloud service providers that emphasizes information security and data protection. It is designed to ensure compliance with German and European data protection requirements. C5 incorporates elements from ISO 27001 but adds specific criteria tailored to cloud services.

3. ENS (National Security Scheme or Esquema Nacional de Seguridad) certification (Spain): it establishes a common framework of basic principles, requirements, and security measures for adequate protection of information processed and services provided by electronic means. OVHcloud has obtained the highest level of the ENS certification ENS High.

How OVHcloud is paving the way for trusted cloud in Europe

Trusted cloud is pivotal to our customers ensuring they can continue innovating through a secure, reliable, open, and sustainable cloud.

At a European level, OVHcloud meets the most demanding certifications in the countries/markets in which it operates.

Our Group supports the establishment of a future European Cloud Certification Scheme (EUCS), which would provide users with harmonized EU-wide certification and maintain the same high standards of transparency and data protection, including against extraterritorial legislation for the most sensitive data.

If you want to learn more about trusted cloud and how OVHcloud can help you achieve your digital ambitions, please visit our website.

We are convinced that trusted cloud is the future of cloud computing. That it is a strategic asset for the digital sovereignty and the competitiveness of the ecosystems in industries. We invite you to join us in this journey and to discover how OVHcloud can help you to achieve your digital ambitions with trust and confidence.

Links SecNumCloud Trusted Cloud Sovereignty

(1)SecNumCloud: Le visa de sécurité ANSSI

OVHcloud. https://www.ovhcloud.com/fr/enterprise/certification-conformity/secnumcloud/

And it’s easy to see these kinds of regulations things to be complied with. After all, it’s hard enough for startups and scale-ups to market themselves, develop compelling products and seek funding without having to add further due diligence to their workload – let alone understand the data ‘supply chain’ of their suppliers and partners.

But embracing respect for data – data sovereignty – as a design principle, can greatly enhance relationships with customers, investors and the broader ecosystem. To understand why, we have to delve further into what data sovereignty is and isn’t.

What is Data Sovereignty?

Data sovereignty is about control and freedom. It’s also about rights: GDPR laid the foundations for individuals to have control over their personal data, including how it’s handled, stored, whether it’s transferred and who has access to it. These themes are all at the heart of data sovereignty. However, there are many more types of data than personal data, and the future acts from the EU aim to address this.

Data sovereignty is important for many reasons. First and foremost, data is subject to the rules of the country in which it’s stored. So, if your country allows processing of data by the government for intelligence purposes, or your data is transferred to a country like this, then it’s important for customers to understand this.

“Data sovereignty for us means giving customers certainty that the data they transmit to us will remain beyond the remit of foreign government interference.” Ludwig Bull, CEO, CourtCorrect.

But again, sovereignty isn’t just about privacy and control. Having a good sovereignty approach also means that your organization has thought about whether you’ll want to move your data and how technically feasible this is. For example, some cloud providers can charge fees for moving data in and out of their clouds (ingress or egress fees) and others use different standards, making ‘free data movement’ difficult and expensive.

This situation can be a bit like a having bank account, but then when you want to transfer to another bank, you have to pay a large part of your savings to do so – and then also have to pay the new bank to open the account and move your money in! Similarly, many cloud providers have long minimum contract periods, which means that if anything changes at that provider, you won’t be able to pivot your data strategy very quickly to react.

A robust sovereignty strategy also includes making sure that you can pick the right hardware and data handling for your applications and customer requirements, including any specific sectoral needs. This ensures that workloads run in the best possible way, and that data which needs to be handled in certain ways – for example, in the healthcare industry or the public sector – is well managed.

All of these things are not only prerequisites in some cases, but also send a number of messages to customers about the kind of organization you are.

Making Data Sovereignty pay off

So that’s what data sovereignty is. But how does it actually benefit you, beyond simply complying with regulations?

First and foremost, data sovereignty ensures trust. A sovereignty strategy says to other organisations that you’re treating their data with respect, and that you have the flexibility to adapt if needs be. It’s like seeing your doctor wash your hands or put medical gloves on before starting a treatment – it’s respectful and is good practice. This kind of visibility and transparency also tends to sit very well with procurement departments.

“Any organization that sells on the basis of building a trusted relationship with its customers will benefit greatly from Data Sovereignty,” Shân Millie, Bright Blue Hare.

However, there are a number of other benefits:

• Data Security: Consider a startup in the fintech sector. This company processes vast volumes of sensitive financial data daily. A sound approach to sovereignty ensures that data remains under the protective umbrella of the company’s home country, significantly reducing the risk of unauthorized access and data breaches.
  
• Data Compliance and Regulations: Startups and scaleups often operate in a global context, serving customers worldwide. However, different regions have distinct data protection laws and regulations. Showing that your organization is already compliant with such regulations from the get-go can also accelerate your journey through procurement processes.
  
• Data Ethics: In today’s era of heightened data ethics awareness, consumers expect companies to handle their data responsibly and transparently. Data sovereignty empowers startups to adhere to ethical standards in data handling, building trust with their customers and partners. It allows organisations to answer fundamental questions like whose data is this, who controls it, who processes it, and who gets to choose these things?

All of these things are tremendous assets to startups. And in fact, startups often have the edge in developing sovereignty strategies. Large, well-established organisations have many challenges in re-architecting old principles and approaches to meet the needs and requirements of modern society, including sovereignty. Startups are nimble, agile organisations and can include considerations of data sovereignty by default and by design, building them into their company DNA. By adopting these principles, they can show that they are secure by design, compliant by design, ethical and considerate by design – and that’s a very compelling USP for any organisation.

Riding the prevailing winds

It’s also important to note that if you’re in the EU, or doing business with the EU, data sovereignty isn’t just a ‘nice to have’ – it’s the direction that the industry is going in. US organisations are already having to adapt to this, and the data adequacy between the UK and the US, for example, shows just how seriously countries are taking this, let alone large organisations.

EU bodies have started something unstoppable. They are building a landscape of trust and showing that cutting-edge innovation is compatible with respect for consumer data. The sun is setting on the old ways of doing business, and increasingly putting people in charge of their own data. This is inherently a better, more respectful online world – and for those who get on board early enough, a huge market opportunity.

X

It’s a trend that has been accelerated by the COVID-19 pandemic, with analyst Gartner predicting that global spending on public cloud services will grow 23.1% in 2021 to $332.3 billion.  

In the report, Sid Nag, research VP at Gartner, said the pandemic has removed any reluctance to move mission-critical workloads from on-premises to the cloud. “Emerging technologies such as containerisation, virtualisation and edge computing are becoming more mainstream and driving additional cloud spending. Simply put, the pandemic served as a multiplier for CIOs’ interest in the cloud.”  

Data protection complexity and compliance challenges 

However, one of the most important issues to consider before adopting the cloud is ensuring compliance with the growing number of data protection and sovereignty laws. For example, Europe’s General Data Protection Regulation (GDPR) was introduced in 2018 and is designed to keep information collected about EU citizens safe regardless of where in the world it is stored.  

In the US, the legal situation is far more complex because although there are proposals for a federal data law covering all Americans, different states are at differing stages of creating and passing their own data laws, such as the strict California Consumer Privacy Act, which came into effect in January 2020.  

A recent article in The Drum highlights this confusion, saying: “With existing legislation and so many proposed bills in motion, it can be difficult to parse it all and understand how various bills might affect a company’s right to collect, store and sell consumer data. There is no simple guide to navigation. It’s up to individual businesses to do their due diligence to understand which laws they are subject to and to comply accordingly.”  

Falling foul of data sovereignty laws can result in heavy fines and loss of customer confidence. In the first two years following the introduction of GDPR, the EU imposed fines of more than €114m for infringements and the maximum penalty can be as much as 4% of a company’s annual revenue.  

This accelerated push into cloud deployment is causing a “throbbing, unrelenting headache for businesses looking to operate and comply with legislation across borders,” according to Tech Radar. The challenge is that many of these laws are not compatible and, in some cases, they actually contradict each other. 

“It’s very easy to get tangled in a web of data protection infringements. In some countries, like the US, this could well end in a million-dollar lawsuit,” says the article.  

The US Clarifying Lawful Overseas Use of Data (Cloud) Act, enacted in 2018, also allows federal law enforcement to compel US-based technology companies to provide requested data stored on servers, whether stored in the US or any other country. 

With these new data laws, companies remain unsure whether the data they process in the cloud may or may not be accessed by US law enforcement agencies. This can be a barrier to cloud adoption, with many turning to local providers or hosting data internally rather than moving data to an unknown location in the cloud.  

Tackling cloud data sovereignty and security challenges 

These challenges need not be a barrier to cloud adoption. But full transparency regarding data location and the associated regulations are vital factors when it comes to retaining control of your data in the cloud.  

It is worth noting that OVHcloud is the only European cloud provider listed among the major cloud vendors in analyst IDC’s latest worldwide public cloud infrastructure MarketScape report.  

Our advice here at OVHcloud is to ask these key questions of your cloud service provider: 

• Where is my data stored? 
• What laws apply to my data and who could access it? 
• Does my cloud provider follow best practices in terms of security & data protection? 

Some cloud service providers do not communicate to their clients the precise location where their data is stored beyond naming a geographical region or zone. Look for cloud providers that show more transparency and share detailed information with clients about the precise location of datacentres, perhaps even down to the exact room and server where the data is stored.  

Also check the level of security offered by your cloud provider to confirm that it provides industry standard compliance such as ISO/IEC 27001, AICPA SOC II Type 2 and ISO/IEC 27701 certification for data privacy. Check-out your cloud provider Information System Security Policy documentation (ISSP). Everything should be reported there. 

One company that successfully overcame this challenge is Global Data Sentinel (GDS), which has end-users around the world subject to strict compliance requirements due to local laws regarding the handling, storage and transmission of sensitive data.  

While GDS had investigated a number of well-established cloud providers, it became clear that they simply could not offer the level of flexibility – in terms of hardware, location and configuration – their sophisticated projects required. Instead, OVHcloud’s comprehensive range of dedicated servers and global network of 31 first-class datacentres proved the ideal fit for GDS. 

Protecting your organisation’s data is an increasingly complex task. When choosing a cloud provider, organisations should satisfy themselves that the choice of hardware, location of datacentres and connectivity combine to ensure their data is safe and compliant with any relevant legal obligations.

A bit of history…  

This case dates back to 25 June 2013, when Mr Maximilian Schrems, an European citizen, filed a complaint with the Irish Data Protection Commissioner seeking a ban on Facebook Ireland Ltd. from transferring his personal data to the United States.   

This complaint pointed to American mass surveillance activities, which were brought to light at the same time by Mr. Edward Snowden. It highlighted that the regulations in force in the United States did not sufficiently regulate these programs and did not guarantee to data subjects, rights equivalent to those recognised in the European Union.   

In a first judgment dated 6 October 2015 (C362/14), the ECJ ruled in his favour by invalidating the Safe Harbor, a protection mechanism implemented for data transfers to the United States, which the European Commission had considered adequate (decision 2000/520).   

Following this decision, the Irish authority, which had initially rejected the complaint because of the existence of the Safe Harbor, opened an investigation during which Facebook Ireland Ltd then justified having put in place, not the Safe Harbor, but standard contractual clauses in line with those adopted by European Commission Decision 2010/87/EU, which should in principle provide adequate safeguards for individuals affected by transfers of personal data to countries that do not ensure an adequate level of protection.   

This time, the ECJ was asked to rule on the validity of the above-mentioned standard contractual clauses on the one hand, and of the “Privacy Shield”, a new protection mechanism created in the meantime by the United States and the Commission to replace the Safe Harbor.  

Invalidation of the Privacy Shield  

In its judgment of 16 July, the ECJ decided to invalidate, with immediate effect, the Privacy Shield, or more precisely the decision (2016/1250) by which the European Commission had found that the Privacy Shield constituted a sufficient protection mechanism to regulate the transfer of personal data to the United States.   

In its decision, the ECJ considered that the US surveillance programs are not limited to what is strictly necessary, since the authorities may, in particular, carry out large-scale surveillance operations which do not comply with the principles of necessity and proportionality in force in the European Union.  

The ECJ also noted that the United-States, including the ombudsperson mechanism to which the Privacy Shield Decision refers, does not provide real possibility for data subjects to bring legal actions before an independent and impartial court as required under the Charter of Fundamental Rights of the European Union.  

Valid, but not always sufficient standard contractual clauses.  

Concerning the Standard Contractual Clauses, the ECJ confirmed that they remain a valid mechanism to secure transfers of personal data from the European Union to countries that do not benefit from an adequacy decision. However, it recalled that, pursuant to Article 46 of the RGDP, these clauses alone do not always by themselves constitute a sufficient protection, in particular in the case of data transfers to countries which, like the United States, do not sufficiently regulate the power of interference of their authorities.  

In this respect, the ECJ essentially points out that the standard contractual clauses constitute a contract, established between a data controller exporter and a data importer, and that this contract is not enforceable against the authorities of the country receiving the data; the said authorities not being party to the contract.   

Therefore, although valid, the standard contractual clauses do not constitute a sufficient guarantee to regulate transfers of personal data from the European Union to countries such as the United States. In this case,supplementary measures should be put in place in addition to these clauses.  

Impact of these decisions  

The impact of this ^2nd opus is far from negligible.   

Indeed, since 16 July, all economic operators who previously transferred personal data from Europe Union to the United States on the basis of the Privacy Shield have been obliged, if they wish to continue such transfers, to replace the Privacy Shield by valid alternative guarantees.   

However, the alternative mechanisms that can be put in place – which are listed in Article 46 of the PGRD and which include the standard contractual clauses – are, for the most part, contractual mechanisms that the ECJ has found insufficient because of their unenforceability against the US authorities.   

The implementation of these alternative mechanisms must therefore be accompanied by the adoption of additional measures to ensure the required protection.   

The question then arises as to what types of measures can, in addition to the standard contractual clauses, constitute adequate protection against interference by the US authorities.   

The ECJ has not ruled on this issue, and data protection authorities have not yet published information on the subject, which may make compliance a little bit difficult.   

In concrete terms, it seems difficult to technically prevent the US authorities from accessing data transiting from the European Union to the United States, since, as the ECJ has noted, the US authorities intercept traffic on network cables, particularly in the context of Upstream programmes.   

In this respect, even the implementation of end-to-end encryption solutions could be considered insufficient, due in particular to the decryption solution that are or may be available to authorities, notably as a result of quantum technologies. In addition some regulations may require operators to communicate their encryption keys to the authorities, or even prohibit some of them in the future. The United States are notably discussing the « Lawful Access to Encrypted Data Act ».  

The use of solutions hosted within the European Union could be the alternative. However, it is not even certain that this would be sufficient in all circumstances, particularly in the case of processing being carried out remotely from the United States, for example in the context of administration, maintenance or support activities.  

Indeed, some remote processing operations, such as accesses, technically imply a temporary transfer and therefore expose the data. This is moreover considered as a data transfer within the meaning of European regulation.  

Some economic operators also question whether it is possible to adapt the additional measures depending of the risk to rights and freedoms, in particular to ensure that the use of data with a low risk to the privacy of individuals is not unduly impeded. Here, too, nothing is less certain, even though the risk-based approach, which is predominant in the RGDP and in the standard contractual clauses, may suggest this.   

Beyond the United States, these questions arise whenever a transfer is operated, based the standard contractual clauses, to countries that have not been subject to an adequacy decision and for which it is not possible to establish with certainty that they provide equivalent guarantees than those recognised within the European Union in respect of interference by the authorities.   

Uncertainty about the type of supplementary measures to be put in place creates insecurity, not only for data subjects, who may not benefit from appropriate protection when their data is transferred, but also for economic operators, many of whom still looking forward to have confirmation of compliance, particularly when they depend on third party service providers or solutions operating outside the European Union.   

As such, the predominance – or near-monopoly – of GAFAM in sectors such as online research, social networks and advertising, makes it extremely difficult, if not impossible from a competitive stand point, to do without their services. And such services usually involve transfers to the United States for which it is not easy, due in particular to the uncertainties mentioned above, to ensure that appropriate additional safeguards have been put in place.   

In this context, it seems essential that the data protection authorities continue to support economic operators so that the supplementary measures required in the event of transfers to the United States and other equivalent countries can be clearly identified and implemented.   

What about using OVHcloud Services?  

No transfers to the United States   

Except for services ordered directly from OVHcloud’s US entity, in the course of performing its services, OVHcloud does not transfer its customers’ data to the United States.   

Indeed, OVHcloud’s data centers located in the United States do not host any of the services marketed by OVHcloud’s non-U.S. entities; said US data centers being only used to host services marketed by OVHcloud’s U.S. entity. In addition, OVHcloud’s US entity is not involved in the provision of services provided by OVHcloud non-American entities. In particular, none of these services are administered from the United States, and therefore no related data processing can be remotely operated, and notably accessed, from the United States.   

Therefore, the invalidation of the Privacy Shield has no impact here.   

Regarding the services ordered from OVHcloud’s US entity, they are generally not used to process data subject to European regulations, in which case the above-mentioned European solutions are preferred. However, OVHcloud United States is nevertheless studying solutions for customers that could be impacted.   

Limited transfers to other countries  

When the customer chooses a service hosted in an OVHcloud data center located in the European Union, only the European and Canadian entities of OVHcloud have, within the framework of the administration and maintenance of the services, the possibility to carry out processing operations on the data hosted by the Customers.   

With regard to Canada, it was the subject of an adequacy decision (2002/2/EC) 

by which the European Commission notably noted that Canadian law « covers all the basic principles necessary for an adequate level of protection fornatural persons, even if exceptions and limitations are also provided for in order to safeguard important public interests. The application of these standards is guaranteed by judicial remedy and by independent supervision carried out by the authorities, such as the Federal Privacy Commissioner invested with powers of investigation and intervention ». Furthermore, the provisions of Canadian law regarding civil liability apply in the event of unlawful processing which is prejudicial to the persons ».

Also, OVHcloud has never received any request from the Canadian authorities that was disproportionate with respect to the fundamental rights and principles of the European Union.

Therefore, even if the said adequacy decision is limited in scope to activities falling under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) – which led OVHcloud to adopt contractual clauses for certain processing operations outside the scope of PIPEDA – the foregoing findings about Canadian law make it consistent to consider that the implementation of standard contractual clauses for activities not subject to PIPEDA does not require any supplementary measure with respect to interference by the authorities.

Nevertheless, OVHcloud has implement supplementary measures according to its security policy, and is seeking to get confirmation, notably from the Commission, of the consistency of the foregoing findings. More generally, it would be desirable that the Commission review all the adequacy decisions that were taken especially before the ECJ judgements and the entry into force of the GDPR.

OVHcloud customers also have the option of choosing data centers located outside the European Union to host their services, particularly in Singapore and Australia. However, these data centers are generally not used to process data covered by GDPR; the European data centers being in this case preferred. However, for customers who wish to operate such transfer to Asia, OVHcloud has set up standard contractual clauses. In these cases, the Customer should conduct, if necessary with the help of OVHcloud, a compliance analysis of the solution that it deploys on OVHcloud Services.

Concerning the use of OVHcloud’s internal tools, some of which contain customer data (customer account data, invoicing, support tickets, data relating to the use of services, etc.), and which are used by other OVHcloud non-European entities, OVHcloud has put in place standard contractual clauses in addition to which various technical and organisational measures have been implemented to limit transfers as much as possible according to OVHcloud security policy.

In particular, OVHcloud systematically favours to host its IT system within the European Union. This makes it possible to avoid by design mass transfers, as transfers are only occasional and temporary in such a remote access case.

Furthermore, access is limited on the basis of the principle of least privilege, which ensures that only the data necessary to carry out legitimate business operations is accessible to operators. These accesses are systematically traced. In addition, in the event of recourse to third-party solutions, OVHcloud favours “on premise” hosting on its own infrastructure in order to keep control.

All these measures, combined with the implementation of a strict policy concerning the treatment of requests from authorities, appear to provide adequate protection against possible interference from authorities in non-adequate countries.

However, OVHcloud will continue to pay close attention to the recommendations of the authorities to ensure that its mechanism is appropriate.

In addition, OVHcloud Group is undertaking to reexamine the legal order of the countries in which it is present in order to assess their compliance in the light of this new ECJ judgment, and be able to support its customer in the best possible way.