For Thales engineering director Olivier Flous, the cloud equation has become central for businesses: quality of service, elasticity and acceleration through the managed services ecosystem. "Operating services with availability and reliability rates comparable to those of hyperscalers is not easy on-premises", he explains, contacted by Teams, insisting on the fact that AI has made the value of cloud services more visible: "AI services evolve every day, sometimes every hour. Knowing how to take advantage of them via APIs and managed services has become essential."
In this landscape dominated by three US leaders, Thales is adopting a hybrid strategy: cloud user, supplier of security technologies to hyperscalers and, now, operator of a so-called "trusted cloud" offering, dubbed S3NS. Olivier Flous sums up the objective as follows: "To offer the capabilities of the cloud with guarantees of sovereignty", while acknowledging an "effective dependence" on the underlying technology "from Google, in this case Google Cloud Platform (GCP)".
Joined separately, S3NS CEO Cyprien Falque clarifies the industrial and legal framework: "S3NS is a dedicated subsidiary of Thales entirely controlled by Thales and dedicated to a partnership with Google Cloud to do what we call in France trusted cloud (...) associated with a precise qualification (...): SecNumCloud". According to him, the specific discussions on this partnership began in 2020, based on the following observation: "As early as 2020, we realised that the cloud had become indispensable not only to digital transformation, but also to the transformation of businesses in general." He insists on a point of education: "The cloud isn't just about server sharing."
A broader catalogue of services
For Cyprien Falque, the key to competitiveness lies in the catalogue of services, not just the infrastructure: "Today, what brings what we call 'hyperscalers' is a whole catalogue of services that enable us to innovate much more quickly. Unfortunately, there are three American players with no European equivalent." He points out that Thales already tried, around ten years ago, to "rebuild a sovereign cloud based on open source" and that the group found that "it was very difficult to achieve the same level of performance and service as the hyperscalers".
This diagnosis is in line with Olivier Flous' reading on sovereignty: "Being sovereign means being master of one's destiny. It doesn't mean doing everything yourself, but controlling your dependencies." He warns against declarative sovereignty: "Saying 'I use open source so I'm sovereign', when you analyse open source communities, you're going to find Chinese contributions or go and detect a backdoor in a code that's 30 million lines of code... Good luck!"
S3NS claims an intermediate proposal: retain the advantages of a public cloud, but with an operating model that is supposed to reduce exposure to extraterritoriality. "The idea was to say that there must be no compromise. If there's too much degradation compared to the public cloud, (...) it's not attractive for customers", explains Cyprien Falque, who assumes an extra cost: "Our price positioning is to have a premium price around 15 to 20% more expensive than (...) public GCP."
The claimed equivalence, according to him, comes in three dimensions: "The same level of performance, the same level of SLA, a BigQuery, with the same 99.99% SLA", "the same catalogue of target services" and "synchronous updates", so as not to create "a six-month gap between our offering and GCP public". As for the architecture, Cyprien Falque details a system built around three data centres: "We have built three dedicated data centres around the Paris region that are physically secure and operated by S3NS. Google can't get into any of them. He describes a segmentation: "In these data centres, there is a production zone, a quarantine zone and our administration IS." The update mechanism is presented as central: "Updates are sent to us by Google Cloud in the quarantine zone at the same time as all the other regions. We take a few days to check, we have the right to audit the source code if necessary and once we've validated, we put the update into production."
European law contracts with S3NS, without going through Google
Olivier Flous was already insisting on this audit and control logic: "There is no Google administrator who has access to these data centres. They have been audited! Six months of audits to check that Google does not have the capacity to access the data. He added: "We inspect the code to check that there is no backdoor, no kill switch, we have probes with AI. As soon as there's an anomaly, we can shut it down and ask Google for access to the source code."
Cyprien Falque nevertheless introduces an operational nuance: total autonomy is, in his view, "illusory" for all possible incidents. The model is therefore based on supervised assistance: "We can call on a Google SRE in the form of an escorted session. They come and help us, but they don't have any control over the system. He adds that customer support is also in-house - "Customer support is done by our employees" - and that contracts are structured without Google - "In the end, the contracts are European law contracts between the customer and S3NS, without Google's presence."
On commercial maturity, Cyprien Falque locates a milestone: "This solution was made available to the first customers a year ago and, at the end of last year, we obtained qualification and went to general availability", which means that "contractually, we guarantee service levels".
As far as the market is concerned, S3NS claims to have its sights set broadly, while observing sectoral priorities. Cyprien Falque explains: "All sectors are interested, except retail or mass distribution", and points to a particular target, "critical infrastructures, organisations of vital importance in France - transport, energy, aeronautics, defence, telecoms". He cites several references, including mutual insurers such as Matmut and MGEN, mentions "discussions with major banks", and also mentions Club Med as well as EDF and Veolia, pointing out that "EDF (...) made the strategic choice to join forces in November". He adds that the public sector is involved: "First small administrations, then now large administrations, government departments."
International deployment
These elements are in line with the idea advocated by Olivier Flous of segmenting environments according to criticality: "The more security you have, the less performance you have. It depends on the use cases, by analysing their needs, functionality and security or sovereignty."
For Luxembourg, the S3NS offering is technically accessible, but still commercially structured from France. Cyprien Falque observes that "technically, the solution is accessible outside France from any European country", and notes "interest from non-French European customers, particularly large banks". On the sales approach, he says: "Outside France, we rely on either Thales, Thales Luxembourg, Thales Germany sales people, or Google Cloud sales people", while acknowledging that a more direct strategy outside France is "under consideration".
When asked about the specific requirements of the financial sector and regulations, Cyprien Falque rules out automatic equivalence: "To my knowledge, there is no equivalence stricto sensu between SecNumCloud and other vertical regulations." Instead, he stresses the role of a foundation: "SecNumCloud is a kind of essential foundation", but one that needs to be supplemented depending on the sector: "We also know that we're going to have to pass other vertical-specific certifications." One example he cites is the HDS certification for healthcare data hosting in France. "We're responsible for the infrastructure part, not the way it's used and implemented above it", and linking this point to Dora: "With Dora, in any case, the whole value chain is going to be concerned in the event of a problem."
On product differentiation from other sovereign offerings, Cyprien Falque says that SecNumCloud-qualified players in France often deliver mainly "IaaS, compute network storage" services. "What sets us apart is the whole PaaS layer, in particular containment and then data", he says, citing "the BigQuery tool". He also announces an AI trajectory: "Soon, during 2026, we'll also have managed services, the Vertex suite", while adding: "We already have GPUs and enough to run models." Comparing this with a Luxembourg offering based on an "entirely disconnected" Google product, he reckons that this has "a slightly smaller catalogue".
