| SOV-1 Strategic Sovereignty | SEAL-2 | |
| SOV-2 Legal & Jurisdictional Sovereignty | SEAL-2 | |
| SOV-3 Data & AI Sovereignty | SEAL-2 | |
| SOV-4 Operational Sovereignty | SEAL-3 | |
| SOV-5 Supply Chain Sovereignty | SEAL-2 | |
| SOV-6 Technology Sovereignty | SEAL-2 | |
| SOV-7 Security & Compliance Sovereignty | SEAL-2 | |
| SOV-8 Environmental Sustainability | SEAL-2 |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-1.1 | EU/EEA legal entity control | 4. Entirely within the EU | 125/125 | SEAL-4 | high | eu_entity: French company incorporated and HQ in France, jointly owned by Orange and Capgemini (both EU); Microsoft holds no equity, acting only as a technology licensor -> SOV-1.1 opt4. (src: https://newsroom.orange.com/capgemini-and-orange-are-pleased-to-announce-the-launch-of-commercial-activities-of-bleu-their-future-cloud-de-confiance-platform/) |
| SOV-1.2 | Change of control risk | 4. Unlikely takeover/transfer to non-EU sovereign entity | 94/125 | SEAL-4 | medium | Owned 50/50 by Orange and Capgemini, two large French listed groups; takeover by a non-EU sovereign entity unlikely -> opt4 (kept). |
| SOV-1.3 | Control over roadmap | 3. Governance bodies exist with EU actors participation | 83/125 | SEAL-3 | medium | Bleu controls French deployment/operations and there is JV governance with EU actors; the core Azure/M365 roadmap is set by Microsoft, so EU-actor governance participation but not full control -> SOV-1.3 opt3 (key: EU governance, some external influence). |
| SOV-1.4 | Financial independence from non-EU capital | 5. Entirely EU-based funding | 125/125 | SEAL-4 | medium | Funded by Orange and Capgemini, both EU-based; Microsoft provides technology under license, not capital -> opt5 (kept). |
| SOV-1.5 | EU economic contribution | 5. Fully in the EU | 125/125 | SEAL-4 | high | Data centers, operations, staff and support entirely in France; EU economic footprint -> opt5 (kept). |
| SOV-1.6 | Participation in EU strategic programs | 3. Active participant in strategic projects | 63/125 | SEAL-4 | medium | Flagship French 'cloud de confiance' for the State/OIV/OSE, in the SecNumCloud 3.2 process; active participant in France's sovereign-cloud strategy -> opt3 (kept). (src: https://newsroom.orange.com/capgemini-and-orange-are-pleased-to-announce-the-launch-of-commercial-activities-of-bleu-their-future-cloud-de-confiance-platform/) |
| SOV-1.7 | Alignment with EU industrial strategies | 2. Existing action plan | 42/125 | SEAL-4 | medium | Existing action plan aligned with French/EU 'cloud de confiance' doctrine, but sovereignty rests on licensed US technology rather than EU-built industrial capacity -> opt2 (kept). |
| SOV-1.8 | Resilience to cut-off | 4. Ability to source alternatives or internalise key functions | 94/125 | SEAL-2 | low | NOT own_stack: continuity depends on Microsoft (non-EU vendor) for the core Azure/M365 stack and updates; SecNumCloud-targeted reversibility/continuity provisions and Bleu's French-operated isolated environment give it the ability to operate temporarily and source/internalise some functions, but full autonomy is limited by Microsoft technology dependence -> SOV-1.8 opt4 (seal 2), same seal-2 treatment as S3NS. Full autonomy (opt5) not credited. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-2.1 | Primary legal jurisdiction | 3. Exclusively EU law | 167/167 | SEAL-4 | high | French entity; the SecNumCloud-targeted design contracts the service exclusively under EU/French law, same as S3NS -> SOV-2.1 opt3. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-2.2 | Extraterritorial laws exposure | 4. Legal structures shielding from foreign law | 125/167 | SEAL-2 | medium | immunity structural-not-certified: French-only operations and the Orange/Capgemini JV structure isolated from Microsoft shield from the CLOUD Act, but SecNumCloud 3.2 is only at milestone J1 (not yet granted), so no certified immunity -> SOV-2.2 opt4 (seal 2 ceiling), same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-2.3 | Data access pathways for non-EU authorities | 5. Requests always rejected by the provider | 167/167 | SEAL-4 | medium | No foreign_parent (Microsoft is licensor, not owner); EU-exclusive isolated offer where only the French entity/staff can intervene and Microsoft has no operational access, so non-EU compelled access has no compellable holder and requests would be rejected -> SOV-2.3 opt5, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-2.4 | Export control restrictions | 5. Part of offer shielded from restrictions towards EU MSs/intl orgs | 167/167 | SEAL-4 | low | Consistency with S3NS: the Bleu sovereign offer is a French-operated 'cloud de confiance' structured for the State/OIV/OSE and is shielded from restrictions toward EU member states and international organisations the same way as S3NS -> SOV-2.4 opt5. (src: https://newsroom.orange.com/capgemini-and-orange-are-pleased-to-announce-the-launch-of-commercial-activities-of-bleu-their-future-cloud-de-confiance-platform/) |
| SOV-2.5 | Origin of IP | 1. Entirely outside the EU | 0/167 | SEAL-4 | high | foreign_core: core IP (Azure, M365 stack) developed and owned by Microsoft in the US; Bleu develops essentially no core platform IP -> opt1 (kept). |
| SOV-2.6 | IP holder jurisdiction | 1. Non-EU law, single country | 0/167 | SEAL-3 | high | Platform IP held by Microsoft, a single non-EU (US) jurisdiction under US law -> opt1 (kept). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-3.1 | Customer control over encryption keys | 5. Customer exclusive control - provider cannot read data | 200/200 | SEAL-4 | medium | Customer-held/HYOK keys (Key Vault / HSM) under the SecNumCloud isolation model; operator cannot read customer data -> opt5, same as S3NS. (src: https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview) |
| SOV-3.2 | Transparent data flows & access logs | 4. Full customer-controlled visibility, not real-time | 150/200 | SEAL-3 | low | Azure customer-accessible activity/access logs under customer control, but fully independent real-time auditability not clearly evidenced -> opt4 (kept). |
| SOV-3.3 | Secure deletion & proof of erasure | 4. Deletion technically verified with access logs | 150/200 | SEAL-3 | low | Consistency with S3NS: the SecNumCloud-targeted regime requires secure deletion with access logs, so deletion is technically verified with logs (independent proof-of-erasure not separately evidenced) -> SOV-3.3 opt4, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-3.4 | Data location strictly in EU/EEA | 5. Exclusively EU, no third-country fallback | 200/200 | SEAL-4 | high | eu_exclusive: data hosted exclusively in French data centres operated by Bleu and strictly separated from Microsoft's global data-centre infrastructure, with no third-country fallback -> SOV-3.4 opt5, same as S3NS. (src: https://www.datacenterdynamics.com/en/news/orange-and-capgemini-launch-french-cloud-company-bleu-will-sell-microsoft-services-from-local-data-centers/) |
| SOV-3.5 | AI services sovereignty | 2. Mostly non-EU: licensed AI, chip dependency | 50/200 | SEAL-2 | low | Any AI would be Azure OpenAI/Copilot: licensed non-EU models on foreign (NVIDIA) accelerators; mostly non-EU with chip dependency -> opt2 (kept). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-4.1 | Portability & interoperability | 4. Formal migration services available | 125/167 | SEAL-4 | medium | Standard Azure APIs with documented export and formal migration tooling, though Azure-specific proprietary services constrain portability off the stack -> opt4 (kept). |
| SOV-4.2 | Ability to operate without foreign dependencies | 5. Entire stack managed by fully EU-based team | 167/167 | SEAL-4 | high | eu_ops: the platform is entirely operated by Bleu's own staff in France within an isolated environment strictly separated from Microsoft; only the provider can intervene -> opt5, same as S3NS (software updates still originate from Microsoft, captured elsewhere). (src: https://www.datacenterdynamics.com/en/news/orange-and-capgemini-launch-french-cloud-company-bleu-will-sell-microsoft-services-from-local-data-centers/) |
| SOV-4.3 | Skill availability in the EU | 4. All EU staff | 125/167 | SEAL-3 | medium | Operated by French/EU staff; deep ops skills in France; security clearances not universally documented -> all-EU-staff opt4 (kept). |
| SOV-4.4 | Support channels | 4. All support staff in EU | 125/167 | SEAL-3 | high | Support provided by Bleu's own French teams, all based in France -> opt4 (kept). |
| SOV-4.5 | Documentation & knowledge transfer | 3. EU primary with non-EU fallback | 84/167 | SEAL-4 | low | Operational docs French/EU-primary, but Microsoft product documentation/engineering knowledge bases are global, implying a non-EU fallback -> EU-primary-with-fallback opt3 (kept). |
| SOV-4.6 | Subcontractor & supplier jurisdiction | 3. Continue temporarily per contractual agreement | 84/167 | SEAL-3 | low | Microsoft is a critical software subcontractor; SecNumCloud-targeted + Microsoft contingency commitments allow the service to continue temporarily per contract -> opt3 (kept). |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-5.1 | Origin of components (physical parts) | 3. Transparent with exceptions | 72/143 | SEAL-3 | low | Consistency with S3NS: hardware (foreign-designed) runs in French data centres operated by Bleu within the SecNumCloud-targeted ANSSI perimeter, so component provenance is transparent with exceptions (audit rights inside the qualified perimeter) -> SOV-5.1 opt3, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-5.2 | Manufacturing location | 3. Mixed sourcing, EU audit rights | 72/143 | SEAL-3 | low | Consistency with S3NS: servers/silicon are foreign-designed but sourced and operated under the SecNumCloud-targeted ANSSI perimeter with EU audit rights -> mixed sourcing with EU audit rights, SOV-5.2 opt3, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-5.3 | Embedded code/firmware provenance | 2. Partial disclosure | 36/143 | SEAL-4 | low | Firmware/microcode from foreign vendors (Intel/AMD/NVIDIA, BMC) with partial disclosure -> opt2 (kept). |
| SOV-5.4 | Origin of software | 2. Foreign origin, partial disclosure | 36/143 | SEAL-2 | high | foreign_core: core platform software is Microsoft Azure/M365, foreign-origin closed-source with only partial disclosure; Bleu operates but does not maintain the core -> SOV-5.4 opt2 (seal 2 ceiling), same as S3NS. (src: https://www.datacenterdynamics.com/en/news/orange-and-capgemini-launch-french-cloud-company-bleu-will-sell-microsoft-services-from-local-data-centers/) |
| SOV-5.5 | Software build/release jurisdiction | 3. Non-EU control, EU execution | 72/143 | SEAL-3 | medium | Consistency with S3NS: Microsoft controls the upstream build/release of Azure/M365 (non-EU) while Bleu controls and executes deployment into its isolated French environment with EU policy gating -> non-EU control with EU execution, SOV-5.5 opt3, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-5.6 | Single point of dependency | 3. Few non-EU in critical services / documented | 72/143 | SEAL-2 | high | Consistency with S3NS: Microsoft is a single documented critical non-EU technology dependency for the core platform; the SecNumCloud-targeted structure mitigates access risk but the dependency on one non-EU vendor for critical services remains -> SOV-5.6 opt3, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-5.7 | Supply chain transparency | 3. Critical suppliers auditable | 72/143 | SEAL-2 | low | Consistency with S3NS: critical suppliers are auditable within the SecNumCloud-targeted ANSSI qualification perimeter, though the full upstream Microsoft supply chain is not openly auditable by any party -> critical suppliers auditable, SOV-5.7 opt3, same as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-6.1 | Interoperability & open interfaces | 4. Standards-based and broadly compatible | 150/200 | SEAL-3 | medium | Consistency with S3NS: Azure exposes broadly used, standards-based and widely compatible APIs (mirroring S3NS's GCP-API treatment), supporting interoperability, though core interfaces remain vendor-defined rather than open-by-default -> SOV-6.1 opt4, same as S3NS. (src: https://learn.microsoft.com/en-us/rest/api/azure/) |
| SOV-6.2 | Open standards compliance | 3. Partial core adoption | 100/200 | SEAL-2 | low | Some open standards supported (Kubernetes/AKS, standard storage/networking) but adoption partial across the Microsoft stack -> opt3 (kept). |
| SOV-6.3 | Open source availability | 2. Source available for review, strict rights | 50/200 | SEAL-2 | high | foreign_core: core platform (Azure/M365) is closed-source and vendor-controlled by Microsoft -> SOV-6.3 opt2 (key: foreign_core -> opt2, seal 2 ceiling), same as S3NS. (src: https://www.datacenterdynamics.com/en/news/orange-and-capgemini-launch-french-cloud-company-bleu-will-sell-microsoft-services-from-local-data-centers/) |
| SOV-6.4 | Service architecture transparency | 2. Insight accessible during audits | 50/200 | SEAL-2 | low | Architecture insight into the Microsoft stack is limited, mainly accessible during audits/certification; deep internals not publicly transparent -> opt2 (kept). |
| SOV-6.5 | HPC sovereignty | 2. EU-hosted, foreign stack | 50/200 | SEAL-3 | low | No in-scope HPC: Bleu is an IaaS/PaaS reselling Azure; it markets no dedicated sovereign HPC/supercomputing product, so there is no imported black-box HPC dependency in scope -> SOV-6.5 opt2 (key: 'no in-scope HPC' -> opt2, seal 3), same uniform treatment as S3NS and the SEAL-3 champions. |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-7.1 | Security certification (EAL) | 3. EAL2 | 72/143 | SEAL-2 | medium | GENUINE DIFFERENTIATOR vs S3NS: Bleu holds ISO 27001 + HDS (a French EU health-data certification on the ISO 27001 base) but SecNumCloud 3.2 is only at milestone J1 (NOT granted), so it cannot be credited the SecNumCloud->EAL3 mapping S3NS earns. ISO 27001 plus a second EU certification maps to EAL2 -> SOV-7.1 opt3 (seal 2), one tier below S3NS opt4. Real cert gap preserved. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| SOV-7.2 | EU regulatory compliance (GDPR/NIS2/DORA) | 4. Partial compliance to most | 107/143 | SEAL-4 | medium | Designed for GDPR/NIS2/DORA, holds HDS and ISO 27001-family certs, pursuing SecNumCloud 3.2; broad compliance but full independently-audited SecNumCloud not yet granted -> opt4 (kept). (src: https://learn.microsoft.com/en-us/compliance/regulatory/offering-hds-france) |
| SOV-7.3 | EU-based SOC & incident handling | 4. Entire lifecycle by EU teams, EU threat intel | 107/143 | SEAL-3 | medium | Security ops and incident handling run by Bleu's French teams from Paris/Rennes; EU-managed lifecycle, ENISA/CSIRT sharing not specifically evidenced -> EU-team-lifecycle opt4 (kept). |
| SOV-7.4 | Control over security monitoring/logging | 4. Full direct access, logs stored in EU | 107/143 | SEAL-3 | medium | Customers get direct access to monitoring/logging (Azure Monitor) with logs stored in French regions; immutable tamper-proof in-EU logging not specifically guaranteed -> opt4 (kept). |
| SOV-7.5 | Disclosure of incidents | 4. Partial compliance, monitored flow, SLAs | 107/143 | SEAL-3 | low | NIS2/GDPR-aligned incident disclosure with monitored flow and SLAs; full real-time CSIRT sharing not specifically documented -> opt4 (kept). |
| SOV-7.6 | Maintenance autonomy | 3. Moderate autonomy (notice + testing, except zero-day) | 72/143 | SEAL-4 | medium | Consistency with S3NS: like S3NS, Bleu operates the foreign core in an isolated French-controlled environment and validates/deploys updates within that perimeter with notice and testing (full deviation limited by the vendor for zero-days) -> moderate maintenance autonomy, SOV-7.6 opt3, same as S3NS. (src: https://www.datacenterdynamics.com/en/news/orange-and-capgemini-launch-french-cloud-company-bleu-will-sell-microsoft-services-from-local-data-centers/) |
| SOV-7.7 | Auditability | 5. Full independent audit by any entity | 143/143 | SEAL-4 | low | Consistency with S3NS (tender-grade audit_rights credited per the key from public sovereign-offer terms, low confidence): Bleu's SecNumCloud-3.2-targeted offer is built on an ANSSI-accepted (J1) audit perimeter, wholly French-operated and isolated from Microsoft, implying full independent audit of the qualified perimeter by the contracting authority and EU bodies -> SOV-7.7 opt5, same uniform treatment as S3NS. (src: https://www.usine-digitale.fr/article/cloud-de-confiance-bleu-passe-le-jalon-j1-pour-la-qualification-secnumcloud-3-2.N2241512) |
| ID | Factor | Value | Score | SEAL | Conf. | Justification |
|---|---|---|---|---|---|---|
| SOV-8.1 | Energy efficiency (PUE) | 3. PUE < 1.5 + roadmap | 125/250 | SEAL-4 | low | Modern French data centers typically run PUE under 1.5 with efficiency roadmaps; specific verified Bleu PUE not published -> PUE<1.5+roadmap opt3 (kept). |
| SOV-8.2 | Hardware reuse & recycling | 3. Documented program | 125/250 | SEAL-3 | low | Operated in French data centers that maintain documented hardware reuse/recycling programs; no Bleu-specific EU-certified lifecycle published -> documented-program opt3 (kept). |
| SOV-8.3 | Environmental impact reporting | 3. Annual report | 125/250 | SEAL-2 | low | Parent groups (Orange, Capgemini) publish annual environmental reporting and data centers report metrics; Bleu-specific EU-audited reporting not evidenced -> annual-report opt3 (kept). |
| SOV-8.4 | Energy supplies | 3. Mix of EU and non-EU supplies | 125/250 | SEAL-4 | low | French data centers draw on the largely low-carbon French grid (EU energy); specific green-only contracting for Bleu not separately documented -> EU/non-EU mix opt3 (kept). |