Sovereignty
European cybersecurity sovereignty: verifiable criteria beyond data residency
By Steven Carrier Updated on
“Sovereign” has become a marketing claim. We would rather prove it. Sovereignty is about more than hosting in France: it covers ownership of the technology, applicable law, subcontractors, encryption, reversibility and transparency on AI. This page sets out, criterion by criterion, what BEAROPS applies and how you can verify it.
- Verifiable criteria
- No exposure to the US CLOUD Act
- Documented supply chain
Is hosting in France enough to guarantee sovereignty?
A service hosted in France can still be subject to foreign law if its vendor or one of its subcontractors is linked to that jurisdiction. The real question is not only “where is the data”, but “who can lawfully access it, through whom, and how far does the chain of dependencies extend”. That is the chain we document.
What we claim, and what proves it
| Criterion | What we claim | Verifiable evidence |
|---|---|---|
| Ownership and control | Technology developed by our teams in France | Proprietary engines, no core component under a foreign licence |
| Applicable law | French software vendor, with no exposure to the US CLOUD Act | French company, contracts governed by French law |
| Hosting | Data hosted in France | OVHcloud infrastructure, certified ISO/IEC 27001 (the hosting provider’s certification) |
| Location of support | Operations run by our own teams | In-house operations, with no outsourcing of operations |
| Subcontractors | Documented chain of dependencies | List of subcontractors available on request |
| Encryption | Data protected in transit and at rest | Technical description available on request |
| Reversibility | Retrieval of your data on exit | Contractual reversibility clause |
| AI transparency | AI models hosted and audited in France | Description of the architecture available on request |
This page sets out our sovereignty doctrine and the claim / evidence table. The detailed technical facts (architecture, subcontractors, encryption, access, coordinated vulnerability disclosure) are published in our trust center .
What is the CLOUD Act, and why does it matter?
The CLOUD Act is a US law that allows the United States authorities to require access to data held by US companies, even when that data is hosted elsewhere. For offensive security data, which is particularly sensitive, this exposure is a real risk. A French vendor with no US connection is not subject to it.
We document the whole chain
An experienced CISO knows that a single foreign link in the update or operations chain can be enough to break sovereignty. We document our dependencies: subcontractors, hosting, software delivery chain. This information can be shared as part of a supplier review or a DORA requirement .
Hosting
Hosted in France on OVHcloud infrastructure certified ISO/IEC 27001. This certification belongs to the hosting provider, not to BEAROPS.
Sources and references
Frequently asked questions
Is “hosted in France” enough to be sovereign?
No. A service hosted in France can still be subject to foreign law if its vendor or a subcontractor is linked to that jurisdiction. Sovereignty is judged across the whole chain: ownership of the technology, applicable law, subcontractors, encryption, reversibility. We document all of these criteria.
Is BEAROPS ISO 27001 certified?
The ISO/IEC 27001 certification mentioned applies to our hosting provider, OVHcloud, not to BEAROPS as a software vendor. We are transparent on this point: we distinguish the certifications of our infrastructure from our own practices.
What does the CLOUD Act change for my data?
The CLOUD Act allows US authorities to require access to data held by US companies, even when hosted elsewhere. A French vendor with no US connection is not subject to it, which matters particularly for offensive security data.
Can I obtain evidence for your claims?
Yes. Our architecture, our list of subcontractors and our contractual guarantees (reversibility, location, access) can be shared as part of a supplier review or a DORA requirement. Transparency is part of our definition of sovereignty.
Request our sovereignty evidence
For a supplier review or a DORA requirement, we share our architecture, our subcontracting chain and our contractual guarantees. Request the file.