SecNumCloud: business data hosting rules tightened in 2026

An August 2026 order revised the framework for hosts handling sensitive data. Qualification replaces the sales promise. For a business owner, the question is where software data lives and who can prove it in writing.

SecNumCloud is the ANSSI qualification attesting that business-data hosting meets a requirements framework. An August 12, 2026 order, published in the Official Journal August 14 and effective August 17 (Légifrance), approves a new framework version. Compliance is now attested through that qualification or a recognised equivalent European certification.

What the text says and whom it addresses

The framework rests on Decree no. 2026-272 of April 14, 2026 concerning 'particularly sensitive data'. Article 2 targets 'a cloud computing service supplied by a private provider'. In plain terms, the text concerns cloud providers and sensitive data under the April decree, not ordinary commerce. What changes is clients' vocabulary: public buyers, local authorities, hospitals, or large groups subcontracting software will start writing this term in tenders, requiring more than 'our data is secure'. This article describes the law at publication; check your case with your adviser.

The question deciding everything

When software runs, three places see data and many owners know only one. First is application hosting itself, covered by the order. Second is backup, often going elsewhere without anyone deciding. Third, the newest, is the AI provider involved in building or continuing to work within the software. We detailed this after CNIL's agent note: who answers for your data when agents work remains the least well-treated question in contracts we read.

What Maestro keeps with you and sends out

We must be precise because nuance costs marketing simplicity. Projects, documents, and code stay on your Mac in a local database, unseen by Maestro servers. Optional online backup goes to your own GitHub account, not us. Access keys live in macOS Keychain. When an agent works, however, what it reads and writes passes through your selected assistant's provider, Claude Code, Codex, Cursor, or Mistral Vibe. That journey exists, is the service's price, and denying it would be lying. We receive only anonymous failure categories, never project contents, detailed on our data page.

The European option open since August 11

On August 11, 2026, Mistral opened Europe and US regional endpoints, presenting itself as 'the only European AI lab to offer both: choice of processing region and a committed, SLA-backed service level' (Mistral announcement, August 11, 2026). It names Amadeus, ASML, Capgemini, Caisse des Dépôts, and CMA CGM among capacity-program participants and targets a gigawatt by 2030. For owners answering public buyers, processing-region choice belongs in a contract, worth more than reassuring marketing. We asked the underlying question in September, do you need French AI to build software, and the honest answer depends on whom you must convince.

Three lines to require in writing

Before signing, ask every provider which country hosts production data, which country receives backups, and which subcontractors see plaintext data. The answers fit a paragraph and bind the writer. If you handle public procurement or sensitive data under the April 2026 decree, add a fourth line: which qualification or certification attests hosting, and when does it expire? A provider saying 'our servers are secure' without country or certificate has answered, and you know what to do with it.