ISO 27001 datacenter: what our certificate covers, site by site

An ISO 27001 datacenter relies on an information security management system (ISMS). An accredited body audits that system. Thésée Datacenter holds ISO/IEC 27001:2022 certification for its two sites in the Yvelines. It underpins our approach to the secure datacenter.

Check our ISO 27001 certificate at a glance

An ISO 27001 datacenter certificate states the standard, the certification body, the activity and the sites. Ours sets out the following details.

Item	Certificate content
Standard	ISO/IEC 27001:2022 (NF EN ISO/IEC 27001:2023)
Certification body	BYCYB, accredited by the French Accreditation Committee (COFRAC) under no. 4-0660
Number	40647-2 (renews certificate no. 40647-1)
Validity	From 17 July 2026 to 20 July 2029
Certified activity	"Hosting services for IT and telecom infrastructure with very high physical, power and network connectivity availability"
Sites covered	Aubergenville (32 rue du Clos Reine) and Voisins-le-Bretonneux (146 avenue Joseph Kessel)
Statement of Applicability	Referenced on the certificate

Our certificate remains valid until 20 July 2029. Only the activity and the sites listed in the annex fall within the certificate. Any other service stays outside the scope, even when sold by the same operator.

Keycard access control at the secure area entrance

Certified, compliant or hosted by a certified provider: what each claim actually gives you

ISO 27001 certified: an accredited body audits the ISMS and issues a named certificate, with the scope and sites listed in the annex.
Compliant with or aligned to ISO 27001: the company claims to apply the standard, without a certificate or an independent audit.
Hosted in a certified datacenter: the certification belongs to the site operator and does not cover your systems.

In your audits, our certificate documents the physical layer of the hosting service. Your auditors use it for the premises, the power supply and access control.

The 14 physical controls in Annex A, applied to a hosting site

Annex A of ISO/IEC 27001:2022 lists 93 controls grouped into four themes. It includes 37 organisational controls, eight people controls, 14 physical controls and 34 technological controls. For a datacenter, the physical controls play a direct role. The table below maps eight of them to measures in place at Thésée Datacenter.

Annex A control	Purpose	Example of implementation at Thésée Datacenter
A.7.1 Physical security perimeters	Define and protect sensitive areas	Bunker-type construction and seven levels of security up to the data halls
A.7.2 Physical entry	Allow access to authorised people only	Biometric access control
A.7.4 Physical security monitoring	Detect any intrusion	Round-the-clock video surveillance
A.7.5 Protecting against physical and environmental threats	Reduce the risk of fire, flooding or malicious acts	Very early warning fire detection
A.7.8 Equipment siting and protection	Position and monitor equipment	Temperature, humidity and load monitoring in the Thésiris customer portal
A.7.11 Supporting utilities	Ensure continuity of power and cooling	2N power supply, "Continuous Power" generators and "Continuous Cooling" at TDC01
A.7.12 Cabling security	Protect power and telecommunications cabling	Two separate power supply routes into the site
A.7.13 Equipment maintenance	Maintain equipment without compromising security	Planned maintenance with no shutdown of the data halls, made possible by the Tier IV certification of TDC01

The list includes six further physical controls. They cover offices, working in secure areas and the clear desk policy. They also cover off-site assets, storage media and equipment disposal.

ISO 27001 and HDS: a single foundation for your health data

Our Health Data Hosting (HDS) certificate version 2.0 carries no. 40648-1. Its validity depends explicitly on the ISO 27001 certificate, over the same scope. The HDS V2 framework uses ISO/IEC 27001:2022 as its foundation. For health data, therefore, review both certificates together. The HDS datacenter page sets out the activities covered.

Five points for checking the certificate of an ISO 27001 datacenter

The certification body: check its accreditation, in France with the French Accreditation Committee (COFRAC).
The version: ask for ISO/IEC 27001:2022, since certificates issued against the 2013 version expired on 31/10/2025.
The dates: the certificate must still be valid on the date you make your decision.
The annex: it lists the sites covered and must name the one intended for your equipment.
The activity: the wording must cover the service you are buying from your ISO 27001 hosting provider.

View our ISO 27001 certificate together with its annex listing the sites.

Completing a supplier security questionnaire? Contact our team: we will send the evidence your audit requires.

Frequently asked questions about ISO 27001 certification

Find the answers to the most common questions about ISO 27001 certification, how long it lasts and the scope it covers.

Is ISO 27001 certification mandatory for a datacenter?

No regulation imposes it on every datacenter. It becomes necessary for hosting health data, because the HDS certificate depends on it. Many buyers also ask for it in their tenders.

How long does an ISO 27001 certification last?

The certification cycle runs for three years. The certification body carries out a surveillance audit each year. It then performs a recertification audit at the end of the cycle.

What is the difference between ISO 27001 and SecNumCloud?

ISO 27001 is an international standard open to any organisation. SecNumCloud is a qualification awarded by the French National Cybersecurity Agency (ANSSI). It targets cloud service providers. Thésée Datacenter hosts physical infrastructure and does not hold the SecNumCloud qualification. Our sites do, however, host providers whose services are SecNumCloud qualified, such as OUTSCALE.

What is a Statement of Applicability?

This document lists the Annex A controls that have been selected or excluded, together with the reasons why. Our certificate references it. It helps you check that the controls relevant to your project fall within the scope.

Do my servers become ISO 27001 certified at Thésée Datacenter?

No. An ISO 27001 datacenter certifies its own ISMS and its sites. The certification covers neither your servers nor your applications. Those remain part of your own certification effort.