Digital Sovereignty: Your GRC Data Stored in France

Three separate requirements tend to get bundled together. Location: where the data is stored and processed. Jurisdiction: which law the organisation operating the service answers to, which does not follow the address of the servers. Reversibility: your ability to get your data back in a usable format and move to another supplier. A contract can settle the first and leave the other two open, so it pays to examine them one at a time.

No. Where data sits and which law binds the provider are two different questions. The US CLOUD Act, passed in 2018, lets American authorities compel a provider subject to their jurisdiction to hand over data it holds, including data stored elsewhere. What matters is therefore not only the address of the data centre, but the organisation operating the service, who owns it, and the chain of subcontractors with access to the systems.

No, and the confusion is a common one. The GDPR sets no localisation rule: it governs transfers outside the European Economic Area, which remain lawful where the destination country is covered by an adequacy decision, or under appropriate safeguards such as standard contractual clauses. Localisation requirements come from elsewhere: sector regulation, the French state's cloud doctrine for its own sensitive data, or the clauses you impose on your suppliers. Vailor stores its SaaS data in France by choice, not because a text orders it.

Six questions do most of the sorting. Which legal entity signs the contract, and which law does it answer to? Who owns its capital? Where are the data, the backups and the logs held? Which subcontractors have access, and from which countries? What does the supplier do when a foreign authority serves it a request? In what format, and how quickly, do you get your data back on the day you leave? Ask for those answers in writing, ours included.

No. Open-weight means the model weights are published and can be downloaded, then run on infrastructure you choose. Open source, strictly speaking, also implies publishing the training code and information about the data used, which few models do. The distinction matters for sovereignty: an open-weight model can run inside European infrastructure with no call to an external API, and you know which model is processing your assessments.

SecNumCloud is a qualification granted by ANSSI, the French cybersecurity agency, to cloud service providers. Its framework restates the usual security requirements and adds criteria on where the provider is established and who controls it, meant to place it beyond the reach of non-European law. It qualifies the provider's service, not your own compliance. Vailor is not SecNumCloud qualified. Its SaaS stores data in France (AWS Paris region), it also installs on your premises, and an offering on SecNumCloud-qualified hosting is planned.

Because a file travels. A risk assessment kept in a spreadsheet ends up duplicated across attachments, laptops and a sharing space whose operator may not answer to European law, and you lose track of who holds the latest version and who has read it. What travels that way is your asset inventory and your vulnerabilities. A platform keeps that material in one place, under access control and with a history. With Vailor, you also choose that place: our SaaS, with data stored in France, or your own infrastructure.