OVHcloud vs Scaleway

IaaS/hosting provider, not a no-logs VPN product. Security is covered via ISO/SOC programme rather than a public no-logs audit.

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

Vendor compliance pages assert ISO/IEC 27001 (with 27017/27018) for cloud services and datacentres; US pages reference Schellman certificate directory. Confirm current scope per product and region.

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

Vendor asserts SSAE 18 Type 2 SOC 1, SOC 2 (+NIST), and SOC 3 attestations; reports available to prospective customers under vendor process.

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

EU headquartered; GDPR compliance asserted; DPA documents published for relevant subsidiaries. Residency depends on chosen region.

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

French group with no known US parent, but operates US datacentres (Vint Hill, Hillsboro) and OVH US LLC. Medium indicative exposure: EU-region workloads on EU contracts differ from US-region workloads. Not legal advice.

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Published DPAs form part of terms (e.g. OVH SAS Europe paths; separate US DPA for OVH US LLC). Obtain the DPA matching your contracting entity.

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

Core product is IaaS/bare metal/hosting; AI/ML platforms are optional infrastructure offerings, not a single AI system product under typical procurement framing.

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

Hosted Private Cloud (VMware on OVHcloud and related) holds SecNumCloud qualification; hosted in French sites (Roubaix, Gravelines, Strasbourg). Not all products are SecNumCloud-qualified.

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Vendor lists HDS certification for healthcare data hosting options; confirm which products and locations are in scope.

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

Vendor asserts PCI DSS Level 1 certification for payment data hosting—confirm applicability to your architecture.

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

US East/West datacentres and OVH US LLC mean CLOUD Act and US process risk apply to US-placed data and some contracts. EU-only deployment reduces this but buyers must enforce region and contracting path.

A major fire at SBG caused widespread customer outages. Treat multi-AZ/multi-region backup design as mandatory for critical data; do not rely on single-site assumptions.

ISO, SOC, HDS, SecNumCloud, and PCI claims do not automatically cover every SKU and location. Procurement should request the exact report for the services ordered.

Vendor documents unmetered traffic exceptions for Asia-Pacific (lower default bandwidth and monthly volume caps vs Europe/North America). Model egress and bandwidth options for APAC workloads.

Bare Metal, Public Cloud, Private Cloud, and Web Cloud under one brand can confuse account structure, IAM, and billing. Define landing-zone standards early.

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.