PREMI3NS: HOW S3NS MEETS THE REQUIREMENTS OF SECNUMCLOUD QUALIFICATION
Published on 08/04/2026
The granting, in December 2025, of SecNumCloud 3.2 qualification for PREMI3NS, the Trusted Cloud by S3NS, marks the culmination of a rigorous process conducted in line with the framework set by ANSSI, the French National Agency for Information Systems Security.
What concrete mechanisms make it possible to obtain this qualification? A breakdown of six areas of the approach implemented by S3NS to ensure the security, resilience and protection of sensitive data.
Key takeaways:
- SecNumCloud is not limited to data localisation.
- S3NS controls operations, updates and any third-party interventions.
- The qualification guarantees an assessed operational autonomy, not absolute technological independence.
What is SecNumCloud and why is this qualification essential?
SecNumCloud is a qualification certifying that a cloud service presents a high level of security suited to sensitive use cases for French and European public bodies and businesses. It is the result of a rigorous verification process covering nearly 1,200 requirements.
It covers three categories of risk:
- technical risks, in particular cyberattacks
- legal risks, in particular those related to the application of non-European extraterritorial laws
- organisational risks, in particular those related to the management of responsibilities, privileges and internal access
It also requires that the qualified provider be subject exclusively to the laws of the European Union.
The six areas of the approach implemented by S3NS
1. Separation of duties
The objective is to prevent any single individual from concentrating responsibilities or privileges that would allow them to carry out a sensitive action alone. S3NS's approach includes:
- differentiating the teams responsible for security, operations and controls
- separating administration perimeters and strengthening the monitoring of administration activities
- using Multi-Party Approval (MPA), a mechanism derived from Google Cloud technology that prevents an administrator from performing a sensitive action alone without validation from a second authorised individual
- ensuring that Site Reliability Engineers (SREs) cannot access customer data
2. Supply chain security
The SecNumCloud framework requires the ability to inspect installed software in order to verify its authenticity and integrity. S3NS operates across two perimeters:
- For its administration information system, built on open source technologies, S3NS uses tools such as OpenSSF Scorecard to automate various security checks covering vulnerabilities, code reviews and the signing of published releases.
- For the cloud infrastructure based on Google Cloud technology, S3NS has set up a quarantine cloud region. Google Cloud updates are installed there and are only deployed to production after behavioural analyses as well as automated and manual analyses of binary and configuration files have been carried out. These controls are used in particular to detect obfuscated code - i.e. code that has been deliberately made difficult to analyse - as well as misconfigured access rights.
3. Source code audit
S3NS has implemented an inspectability chain shared in full with ANSSI, but shared very little, if at all, with Google Cloud.
It makes it possible in particular to:
- verify the correct implementation of critical security functions, such as encryption, logical isolation and network filtering
- analyse the differences between open source versions of certain Google Cloud technologies and their internal versions
- conduct periodic source code reviews with a dedicated team and external experts
- facilitate investigation and the resolution of doubts in the event of potentially abnormal behaviour
4. Oversight of third-party support
SecNumCloud imposes strict oversight of the use of third parties to ensure that a non-European provider cannot access customer data. Any potential recourse to Google Cloud support is governed by two mechanisms:
- Filtering of shared metrics: precise rules are defined and validated in advance to ensure that shared telemetry data is limited to infrastructure metrics.
- Intervention via a read-only bastion: in situations requiring high-level vendor expertise, S3NS may use a shared session mechanism specifically designed for this use case and strictly limited to read-only access. Support must be previously invited and manually authorised by an S3NS SRE, who retains control of the session and can terminate access at any time.
5. Protection against non-European extraterritorial laws
SecNumCloud requires in particular:
- the localisation of data storage and processing within the European Union
- the operation of the service by a provider established in the European Union and not controlled by an entity located outside the European Union
- the provider's autonomy in the continuous operation of the service
- assurance that a non-European provider does not have access to customer data
By combining legal, technical and organisational guarantees, these requirements aim to reduce the risks of data access or service interruption resulting from the application of non-European extraterritorial laws.
In the case of PREMI3NS, the Trusted Cloud by S3NS, the offering is operated and administered exclusively by S3NS employees in data centres located in France.
S3NS is a company incorporated under French law, headquartered in France, majority-owned and fully controlled by Thales. Google Cloud holds an extremely minority stake in its share capital. Its representative sits on the board of directors as an observer, with no voting rights or veto rights.
6. Knowledge transfer and operational autonomy
Mastery of a cloud infrastructure depends as much on technology as on the skills of the teams operating it.
The S3NS project involves a significant transfer of knowledge from Google Cloud to S3NS teams. Covering the operation of a large-scale cloud infrastructure, this skills transfer is unique in the world. It provides S3NS with the know-how essential to the operational autonomy required by SecNumCloud.
S3NS is actively consolidating this expertise through its policy of recruiting and training technical, cyber and support profiles.
What SecNumCloud qualification covers and does not cover
Beyond these six areas, several distinctions are necessary to precisely understand the scope of the qualification.
Operational autonomy but not technological autarky: no cloud offering is entirely independent of non-European hardware or software components. A prolonged interruption of access to updates would lead to a progressive degradation of its security level. SecNumCloud therefore requires the ability to operate the service autonomously, not an absolute absence of technological dependency.
The same level of requirements for all qualified offerings: so-called "hybrid" offerings, based on non-European technology operated by a European provider, must meet the same requirements as other qualified offerings. The provider must in particular demonstrate its impermeability with respect to the technology vendor.
A cybersecurity tool, not an instrument of industrial policy: SecNumCloud assesses an offering against precise technical, legal, organisational and operational requirements. The qualification does not relate to the origin of the technology used and is not intended to foster the emergence of alternative technologies.
Conclusion
For PREMI3NS, SecNumCloud qualification attests to S3NS's ability to operate and administer Google Cloud technology at scale in France, within a strict framework of autonomy, control and protection of sensitive data.
PREMI3NS thus provides access to a broad catalogue of Google Cloud services, operated by qualified teams, without compromise on security and trust requirements.
This qualification reflects an approach to Trusted Cloud based on concrete guarantees that are assessed and maintained over time.
About S3NS
An alliance between Thales, a global leader in data protection and cybersecurity, and Google Cloud, one of the world’s leading cloud technology providers, S3NS offers public institutions and private companies—seeking to further protect their most sensitive data—highly secure public cloud solutions to support their transition to a trusted cloud, in compliance with the SecNumCloud framework defined by ANSSI, the French National Agency for the Security of Information Systems. S3NS is a company incorporated under French law and wholly controlled by Thales.