Secure datacenter: our ISO 27001, PCI DSS and ISO 50001 evidence
A secure datacenter proves itself through its audits and through the documents it makes available. In the Yvelines, Thésée Datacenter applies three complementary standards across its two sites. ISO/IEC 27001 covers information security. PCI DSS (Payment Card Industry Data Security Standard) sets the framework for card payment systems. ISO 50001 organises energy management. These standards come in addition to all of our certifications.
Which certifications should you require from a secure datacenter?
The list that matters depends on the data you entrust to your digital partner. French law imposes some requirements. Your customers or the card networks call for others. This table links each need to the supporting document you should obtain.
These standards add up rather than replace one another. Our HDS certificate remains valid for as long as our ISO 27001 certificate is valid for the same scope. So always check both documents at the same time.
ISO 27001 datacenter: information security audited every year
ISO/IEC 27001:2022 requires a formalised ISMS driven by risk analysis. A certification body audits it every year. Its Annex A contains 93 controls, including 14 physical security controls. These controls apply above all to a hosting site: perimeter, access, monitoring, power and cabling. The ISO 27001 datacenter page sets out the scope, the controls and the verification method.
PCI DSS datacenter: a physical scope assessed for your payment systems
PCI DSS applies to any entity that stores, processes or transmits payment card data. Thésée Datacenter secures the physical environment. Your servers and your applications remain your responsibility. Our PCI DSS v4.0.1 attestation covers video surveillance, physical access, power supply and cooling. A qualified assessor from CNPP carried out the testing procedures. The PCI DSS datacenter page explains how responsibilities are shared.
ISO 50001 datacenter: energy consumption that is managed and measurable
ISO 50001 governs energy management through an energy review, indicators and improvement targets. Since 29/03/2024, the British Standards Institution (BSI) has certified our system across both of our sites. The certificate runs until 28/03/2027. The ISO 50001 datacenter page sets out our levers and how we read the power usage effectiveness indicator (PUE).
What our certifications cover, and what remains your responsibility
- Our scope: our certifications apply to physical colocation hosting. They cover the buildings, power, cooling, security and connectivity.
- Your scope: your servers, your systems and your applications remain subject to your own controls and audits.
- The scope of a certificate: it proves an audited system, for a given activity and for the sites listed in its annex.
- The right habit: compare the certified activity with the service you are buying, before signing anything.
To check a French certification body, consult the scopes published by the Comité français d'accréditation (COFRAC).
Our supporting documents can be downloaded without filling in a form: ISO 27001 certificate, PCI DSS attestation and ISO 50001 certificate.
Are you preparing a security questionnaire or a supplier audit? Contact our team to obtain any further information you need.
See also: Tier IV certified datacenter · HDS datacenter · Sovereign datacenter
Frequently asked questions about our ISO and PCI DSS certifications
Find the answers to the most common questions about which certifications to require, what they cover and how to verify them.
Which certifications should you require to host regulated data?
The nature of the data determines the requirements. For healthcare data, the hosting provider must be HDS certified. Payment card data falls within the scope of PCI DSS. ISO 27001 is the common foundation for both situations.
What is the difference between a secure datacenter and a sovereign datacenter?
A secure datacenter protects infrastructure against failures, intrusions and incidents. A sovereign datacenter adds legal protection linked to location, ownership and applicable law. Thésée Datacenter documents both dimensions.
Does a secure datacenter make my application compliant?
No. Our certifications apply to the physical infrastructure we operate. The compliance of your systems and applications rests on your own measures and your own audits.
How do you verify a certificate presented by a datacenter?
Check the body, its accreditation, the validity dates and the site annex. In France, COFRAC publishes the scope of accredited bodies. BSI also provides an online verification service for the certificates it issues.