Why choose sovereign hosting for your data?

“Your data is hosted in France.” The sentence is reassuring, and it now appears on many online software websites. Yet it tells only part of the story. What matters is not only where the servers are, but also the law that applies to whoever operates them, and to each of their providers.

That is what sovereign hosting is all about. For an SMB that entrusts its employees' or customers' data to software, the question deserves a few minutes.

Location and jurisdiction: two different things

Two notions are often confused:

• Location: the country where the servers and backups are physically located.
• Jurisdiction: the law that applies to the company that operates these servers, or that has access to them.

A US company can operate a data center in Paris. The data is then located in France, but the company remains subject to US law, including for data stored outside the United States. Sovereign hosting, as the term is generally understood, combines the two: data in Europe, with providers that are not subject to a foreign law with extraterritorial reach.

What US laws say

The Patriot Act is often cited. The texts to know today are mainly two others.

The CLOUD Act (2018)

The Clarifying Lawful Overseas Use of Data Act, passed in March 2018, made clear that providers of communication or storage services subject to US jurisdiction must hand over, upon lawful request from US authorities, data in their “possession, custody, or control”, regardless of where that data is located. The criterion is therefore not the location of the server, but the control the provider exercises over the data.

FISA Section 702

Section 702 of the Foreign Intelligence Surveillance Act, introduced in 2008, allows US intelligence agencies to target the communications of non-US persons located outside the United States, relying on US service providers, without an individual court order. It has been extended several times by Congress, and its renewal is still being debated in 2026.

The consequences in Europe

It was largely because of these surveillance programs that the Court of Justice of the European Union invalidated the Privacy Shield, the agreement that governed data transfers to the United States, in the Schrems II ruling of July 16, 2020. A new framework, the Data Privacy Framework, was adopted by the European Commission on July 10, 2023. It remains contested, and many companies prefer not to make their data depend on a legal balance that has already been called into question twice.

Why sovereign hosting matters for an SMB

You might think these questions only concern large groups or sensitive data. Yet:

• the GDPR makes you responsible for the data you entrust to your providers, including any transfers outside the European Union;
• your customers and clients increasingly ask the question, especially in public tenders;
• your employees' and prospects' data (contact details, organization, sales contacts) has real competitive value;
• consistency matters: it's hard to boast of your rigor with data while entrusting your teams' data to tools whose hosting you know nothing about.

Questions to ask a software publisher

Before choosing an online tool, ask these questions, and expect precise answers:

1. Where are the application, database, files and backups hosted? Backups are often forgotten.
2. Who is the hosting provider, and which law applies to it? A name, a country, a region.
3. Who are the other subprocessors? Email sending, payment, support, analytics tools: each is a link in the chain.
4. Is the list of subprocessors published, and dated? A serious publisher keeps it up to date and gives notice of changes.
5. Are there transfers outside the European Union? If so, on what legal basis?
6. Which law governs the contract, and what happens to your data at the end of the subscription?

The honest limits of sovereignty

Total sovereignty is rare, and it's best to be wary of it when it is promised without nuance. A few concrete examples:

• Apple Wallet and Google Wallet cards necessarily involve Apple and Google, since the card lives in their app.
• Credit card payment often goes through international providers.
• Sending transactional emails (login codes, notifications) often relies on specialized services, not always European ones.

What matters is that these dependencies are known, limited to what is strictly necessary, and set down in black and white.

And at Profiles Flow?

Profiles Flow is published by a French company, and its contracts are governed by French law. Here is the situation as it is, link by link:

• Hosting of the application, database, files and backups: Scaleway, a French hosting provider, in data centers in France.
• Transactional emails (login codes, lead notifications): Scaleway, in France.
• Payment: Stripe, by credit card or SEPA direct debit. Profiles Flow never sees card numbers or bank details.
• Invoicing: Sellsy, a French software publisher.
• Wallet cards: Apple and Google, necessarily, for the card itself.

On the data side, several choices limit what circulates: cookieless analytics with no IP address stored, passwordless login, Active Directory password encrypted and never displayed again, Google Workspace delegation without any access to messages. The list of subprocessors is published and dated on the dedicated legal page. The details are on the sovereign cloud page, and the contractual commitments in the GTC.

Frequently asked questions

Want to see how your data is handled? Profiles Flow offers a 30-day free trial, no credit card required.