Sovereign data center: our Gaia-X Level 3 and CISPE proof
A sovereign data center keeps your equipment in the European Union, with a European company in charge. This set-up reduces exposure to extraterritorial laws, including the US Cloud Act. Thésée Datacenter applies these requirements at its two sites in the Yvelines, under French law. We link each criterion to verifiable evidence, together with our other data center certifications.
What is a sovereign data center? Four criteria to check
The address of the servers alone is not enough. Even when located in France, a site may belong to a company controlled from a third country. It then remains exposed to the risk of requests from a non-European authority. The criteria for a sovereign data center therefore assess the operator as much as the technical building.
- Location: the data halls, the power supply and the network are located in the European Union. Our two sites are in Aubergenville and Voisins-le-Bretonneux, in the Yvelines.
- Headquarters: the operator has its registered office and its main place of business in the European Union.
- Shareholding: no shareholder based outside the Union holds control of the operator.
- Subcontracting and autonomy: customer data and access management remain beyond the reach of any third-party company. The operator delivers its services with its own in-house teams.
These four criteria match those of the Gaia-X Level 3 label. We declare them for the hosting services of our two campuses.
Protect every link: sovereign data center and sovereign cloud
Sovereign cloud covers IT services operated under European jurisdiction: virtual servers, platforms or software. The sovereign data center is their physical foundation. It provides the building, the power, the cooling, access control and connectivity. Thésée Datacenter operates at this layer, in colocation, in our data centers in the Paris region.
A hosting chain only becomes sovereign when every link respects this principle. Installed in a building exposed to a foreign law, a trusted cloud loses part of its protection. Conversely, a sovereign physical infrastructure does not make software published outside the Union sovereign.
Check our proof: Gaia-X Level 3 label and CISPE commitments
On 21 November 2025, CISPE (Cloud Infrastructure Services Providers in Europe) unveiled the first five companies awarded the Gaia-X Level 3 label. The announcement was made during the Gaia-X summit in Porto. Thésée Datacenter is one of them. Our self-declaration covers the Level 2 and Level 3 criteria for the hosting services of both campuses. CISPE verified its compliance as a Gaia-X Clearing House. It lists labelled services in its Gaia-X catalogue.
Our data protection policy is part of the CISPE Code of Conduct. This code sets out a GDPR framework for infrastructure providers. It governs data processing within the European Economic Area.
Download our Gaia-X self-declaration with no form to fill in. This document states the services covered and the criteria declared.
Track our CISPE sovereignty badge, from "Declared" to "Certified"
In April 2026, CISPE published the CISPE Sovereign & Resilient Cloud Services framework. It classifies each service along two paths: sovereign or resilient. A sovereign service falls under the relevant jurisdiction for its ownership, its governance and its operation. No foreign power can therefore access it, disrupt it or interrupt it, by legal or technical means.
The audit examines the entire sovereignty chain, from the servers to the shareholding. In June 2026, Thésée Datacenter passed the preliminary audit, carried out by CISPE and independent experts. Since then, we have displayed the "Declared" level CISPE sovereignty badge.
- "Declared" level: Thésée Datacenter has self-certified its services under this framework. This badge remains valid for six months.
- "Certified" level: it requires a six-month in-depth audit, conducted according to the framework's published methodology.
- Renewal: an independent third-party body then renews the badge every year. Anyone can check it online.
The CISPE sovereignty framework website sets out the criteria and the register of services.
Complete your compliance: what sovereignty does not cover
Sovereignty is often confused with several other frameworks. A sensitive project generally combines them.
- SecNumCloud: ANSSI (the French national cybersecurity agency) awards this qualification to certain trusted cloud offerings. It targets infrastructure, platform and software as a service offerings (IaaS, PaaS, SaaS). It does not cover physical colocation hosting, and Thésée Datacenter does not claim it (ANSSI overview). Our infrastructures do host providers whose services are SecNumCloud-qualified, such as OUTSCALE. They meet the security, resilience and sovereignty requirements expected of a trusted cloud.
- GDPR: the regulation governs all processing of personal data, regardless of where it is hosted. A sovereign datacenter supports compliance, but the data controller keeps its own obligations.
- Data Act: the European data regulation has applied since 12 September 2025. It organises switching between data processing service providers. It removes switching charges from 12 January 2027.
- HDS: hosting health data (HDS) requires a specific certification. Its version two requires physical hosting within the European Economic Area (EEA). Our HDS certification covers both of our sites.
Who needs a sovereign data center?
Sovereignty becomes a selection criterion whenever a foreign law creates a legal, strategic or reputational risk.
- Public sector: government bodies and local authorities host citizen data as well as critical systems.
- Healthcare: hospitals and medical software publishers control the location of and the access to health data.
- Finance and insurance: entities subject to the DORA regulation (Digital Operational Resilience Act) oversee their critical technology providers.
- Industry and defence: companies protect their manufacturing secrets and their design data.
In November 2024, France Télévisions, Radio France, France Médias Monde and TV5 Monde chose Thésée Datacenter. These four public broadcasting companies host their infrastructure at our sites in the Yvelines.
Choose a digital partner governed by French law
Thésée Datacenter is a French company with 100% European capital. Our teams operate the Aubergenville campus (TDC01) and the Voisins-le-Bretonneux site (TDC02). The two sites are 30 km apart and linked by a private network of 144 dark fibres. You can spread your critical workloads across two sites while staying in France. With the Aubergenville campus, Thésée Datacenter is also one of the few Tier IV certified operators in France. The about Thésée Datacenter page presents our organisation.
Does a tender or an audit require you to prove the sovereignty of your hosting? Our teams provide the supporting evidence and review your project: talk to an expert.
See also: Tier IV certified data center · Secure data center: ISO 27001, PCI DSS and ISO 50001
Frequently asked questions about sovereign data centers
Find the answers to the most common questions about digital sovereignty, its labels and the scope of extraterritorial laws.
What is sovereign hosting?
Sovereign hosting keeps equipment and data in the European Union, with a European operator. Its shareholding and its subcontractors create no exposure to any extraterritorial law. Public evidence, including the Gaia-X Level 3 label, makes this verifiable.
What is digital sovereignty?
Digital sovereignty means keeping control of your data and your infrastructure. It depends on the choice of hosting providers, cloud providers and software.
How many companies have obtained the Gaia-X Level 3 label?
On 21 November 2025, at the Gaia-X summit in Porto, CISPE unveiled the first five. They are Cloud Temple, Thésée Datacenter, Opiquad, OVHcloud and Seeweb.
What is the CISPE sovereignty badge?
CISPE awards this badge under its Sovereign & Resilient Cloud Services framework, published in April 2026. It measures the sovereignty of a service, from the servers to the shareholding. The "Declared" level follows a self-certification. The "Certified" level follows an in-depth audit. Thésée Datacenter displays the "Declared" badge.
Is a sovereign data center SecNumCloud-qualified?
Not necessarily. SecNumCloud qualifies cloud offerings against the ANSSI framework. A colocation data center such as Thésée Datacenter provides the physical infrastructure, without holding this qualification itself. Our sites do, however, host providers whose services are SecNumCloud-qualified, such as OUTSCALE.
Does the Cloud Act apply to a European hosting provider?
The Cloud Act is a US law adopted in 2018. It allows US authorities to request data from providers falling under their jurisdiction. This obligation also applies to data hosted outside the United States. In principle, a European hosting provider that is not controlled by a US entity falls outside this scope.