Sovereignty frameworks

SecNumCloud, HDS, SEAL, CADA: what each framework actually proves

A qualification, a certification and an assurance level answer different questions. This page explains them, then shows how Recapro (recapro.ai), AI meeting minutes software, answers the seven questions worth asking any provider.

The seven questions The frameworks

A certification attests a security level. Sovereignty also depends on which law applies to the provider and on who can switch the service off. Hosting data in Europe is therefore not enough when the provider, its identity provider or its AI model falls under foreign law.

Statuses checked on 9 October 2026 against the official sources cited on this page.

Three dimensions behind one word

European frameworks assess sovereignty along three axes. Keeping data in Europe covers the first one at best.

01

Legal

Which law applies to the provider, and which law can compel it?

A Paris datacenter operated by a company subject to US law remains exposed to the CLOUD Act.

02

Operational

Who runs the service, updates it, holds the keys and can interrupt it?

Support teams and encryption keys managed outside the Union are enough to move effective control elsewhere.

03

Technological

What is the stack made of, and can it be audited or replaced?

Hardware, software, identity provider, DNS and AI models weigh as much as the hosting location.

Why an EU region does not shield you from US law

Four mechanisms explain why hosting in Europe with a non-European provider leaves the legal risk intact.

The CLOUD Act (2018)

This US law lets American authorities require a provider subject to US jurisdiction to hand over data it controls, wherever that data is stored, EU regions included.

Source: Clarifying Lawful Overseas Use of Data Act, H.R.4943 (2018)

FISA 702 surveillance

This US surveillance programme led the Court of Justice of the European Union to strike down the Privacy Shield in its Schrems II ruling of 16 July 2020.

Source: CJEU, case C-311/18 (Schrems II)

The kill-switch risk

Sanctions or an embargo can force a non-European provider to suspend a service. After the US sanctions of February 2025 against the Prosecutor of the International Criminal Court, his access to his mailbox was cut off, which the vendor denies having decided. The case prompted a written question in the European Parliament.

Source: European Parliament, written question P-10-2025-002270

Hidden dependencies

Identity provider, DNS, CDN, transactional email and AI models are often American by default. A service hosted in Europe whose inference runs through a model operated under US law drops to the level of that link.

Our analysis of AI inference sovereignty

The frameworks, and what they cover

A qualification requires an audit by a third party, a certification covers a defined scope, and a regulation binds those it targets.

The frameworks, and what they cover
Framework	Owner	Type	Status	What it covers
SecNumCloud 3.2	ANSSI (France)	Qualification after a third-party audit	In force	Security and immunity from non-European laws, with EU headquarters and law and non-EU ownership capped at 24%.
HDS v2	French Ministry of Health, Agence du numérique en santé	Certification	In force since the decree of 26 April 2024; v1 holders had until 16 May 2026 to switch	Hosting of health data, with mandatory storage in the European Economic Area.
ISO/IEC 27001:2022	ISO	Certification of the security management system	In force	How information security is organised. The standard does not address which law applies to the provider.
EUCS	ENISA (European Union)	Cybersecurity certification scheme	Not adopted; sovereignty criteria removed from the draft in March 2024	Three assurance levels: basic, substantial, high.
Cloud Sovereignty Framework	European Commission	Assessment grid for public procurement	Published on 20 October 2025 (version 1.2.1)	Sovereignty score from 0 to 100 and levels SEAL-0 to SEAL-4, across eight weighted objectives.
CADA	European Commission	Proposed regulation	Proposed on 3 June 2026, legislative procedure under way	Four assurance levels binding on the public sector and EU entities.
GDPR	European Union	Regulation 2016/679	Applicable since 25 May 2018	Transfers outside the Union, processors, retention periods for personal data.
Data Act	European Union	Regulation 2023/2854	Applicable since 12 September 2025; switching charges banned from 12 January 2027	Data portability and switching between cloud providers.
DORA	European Union	Regulation 2022/2554	Applicable since 17 January 2025	Digital operational resilience of the financial sector, including management of IT and cloud providers.
NIS2	European Union	Directive 2022/2555	Transposition due by Member States on 17 October 2024	Risk and supply-chain management for essential and important entities.

How to read this: France has a demanding but national framework, SecNumCloud. Europe, after six years of deadlock on EUCS, changed approach in 2025 and 2026 with a scoring grid (the Cloud Sovereignty Framework) followed by a draft regulation (CADA).

SEAL levels in the Cloud Sovereignty Framework

The Commission assesses eight weighted objectives, from strategy (15%) to supply chain (20%), then ranks each offer on five levels.

SEAL-0 No sovereignty. Control is exclusively non-European and governed outside EU jurisdiction.
SEAL-1 Jurisdictional sovereignty. EU law formally applies, but control remains non-European.
SEAL-2 Data sovereignty. EU law applies and is enforceable; significant non-European dependencies remain.
SEAL-3 Digital resilience. European actors exert significant influence, non-European control stays marginal and the offer withstands supply-chain disruption from third countries.
SEAL-4 Full digital sovereignty. Complete European control, under EU law alone, with no critical non-European dependency, down to the chips.

A public buyer assigns the SEAL level during a procurement procedure, objective by objective. No provider can therefore declare itself SEAL-3. The first contract awarded on this basis, the Commission’s “Sovereign Cloud” tender, dates from 17 April 2026. It covers up to €180 million over six years, with SEAL-2 as the minimum threshold.

Source: European Commission, press release of 17 April 2026

Seven questions to ask any provider

They map to objectives SOV-1 to SOV-7 of the Cloud Sovereignty Framework and apply to a cloud, an identity provider, a critical SaaS or an AI tool. Here are Recapro’s answers.

01
Who owns and controls the company?

Recapro is published by NOBULLSHIT CONSEIL, a French company registered in Vendée (SIREN 989 598 727) and subject to French law.
Legal notice
02
Where are the data, and where are the operations?

Scaleway, in Paris, hosts the database, authentication, file storage and APIs. France-Nuage, in Vendée, handles hosting and fleet monitoring. Transcription and summaries run on our own servers in France.
Hosting and architecture
03
Who holds the keys?

Service data and its backups are encrypted at rest on Scaleway’s infrastructure in Paris, and TLS protects every connection. On the Cloud plan, Cloudflare, a US company, terminates that TLS at the network edge, inference traffic included, so content is decrypted there in transit. Calendar access tokens get additional AES-256-GCM application-level encryption. With Fortress on-premise, your meetings stay on your premises.
Encryption and safeguards
04
Which hidden dependencies?

European frameworks flag the AI model under objective SOV-3. At Recapro, transcription and summaries rely on open-weight models running on our own servers, with no third-party LLM at inference. One dependency remains in the content path, since on the Cloud plan Cloudflare terminates TLS for inference traffic. Our other providers, US ones included, are listed with their role on the Security page.
AI inference sovereignty
05
How reversible is it?

Email [email protected] and you receive a full export of your meetings, transcripts and minutes. You do not have to justify leaving or negotiate anything.
Our commitments
06
Which level is declared, and with what evidence?

Recapro holds no certification of its own. It has no ISO/IEC 27001, no HDS certification, no SecNumCloud qualification and no SEAL level. Instead we publish our hosting providers, our architecture and our commitments, all verifiable on the Security page.
What we publish
07
What happens if the provider disappears?

The full export stays available on request. In an air-gapped deployment, the Fortress server runs inside your network, with no connection to our services and the models installed on your side.
Air-gapped deployment

Where Recapro stands, as of 9 October 2026

What we hold, what we do not hold, and what our hosting providers carry within their own scope.

SecNumCloud: No qualification and no process under way. Scaleway, one of our hosting providers, is listed among providers undergoing qualification; it had not been granted as of 9 October 2026.
HDS: Recapro is HDS-ready, with no HDS certification claimed. Scaleway is HDS certified within its own scope, which does not cover the Recapro application.
ISO/IEC 27001: No certification of our own. Scaleway claims ISO/IEC 27001 for its infrastructure.
SEAL level: None. Recapro has never been assessed in a public tender using the Cloud Sovereignty Framework, and a SEAL level cannot be self-assigned.
AI inference: Open-weight models running on our own servers in France, with no third-party LLM at inference.

ANSSI list of providers undergoing SecNumCloud qualification (checked on 9 October 2026)

Frequently asked questions

01

What is SecNumCloud?

SecNumCloud is the qualification that France’s cybersecurity agency, ANSSI, grants to cloud offers. It combines an in-depth security audit by a third party with criteria of immunity from non-European laws, namely EU headquarters, EU law and non-EU ownership capped at 24%. It is valid for three years, with annual surveillance audits.

02

What is a SEAL level?

A SEAL level (Sovereignty Effectiveness Assurance Level) rates, from SEAL-0 to SEAL-4, how sovereign a cloud offer really is under the Cloud Sovereignty Framework published by the European Commission on 20 October 2025. A public buyer assigns it objective by objective during a tender, and no provider can assign it to itself.

03

Is Recapro SecNumCloud qualified, HDS certified or ISO 27001 certified?

No. Recapro holds no SecNumCloud qualification, no HDS certification and no ISO/IEC 27001 certification, and has no SEAL level. Recapro is HDS-ready, with no certification claimed. Instead we publish our hosting providers, our architecture and our commitments on the Security page.

04

Does hosting in Europe protect against the CLOUD Act?

Not on its own. The CLOUD Act targets the provider subject to US law, wherever the data is stored, so an EU region at a US hyperscaler remains exposed. Protection comes from a provider and a chain of subcontractors that fall under European law, AI model included.

05

What is CADA?

The Cloud and AI Development Act (CADA) is a regulation proposed by the European Commission on 3 June 2026. It turns the SEAL logic into four assurance levels, from “base” to “maximum”, binding on the public sector and EU entities. The legislative procedure is ongoing and nothing applies to the private sector yet.

06

What is sovereignty washing?

Sovereignty washing means presenting an offer as sovereign on the strength of European hosting or a logo, while the provider, its operations or its dependencies fall under foreign law. To see through it, ask for audit reports, the ownership structure, the list of subprocessors and the origin of the AI model.

07

What is the difference between SecNumCloud and HDS?

SecNumCloud qualifies the security and extraterritorial immunity of a cloud offer, under ANSSI’s authority. HDS certifies a health data hosting provider; version 2, set by the decree of 26 April 2024, requires storage in the European Economic Area. An offer can hold one without the other.

08

Does the Data Act change anything for reversibility?

Yes. Applicable since 12 September 2025, the Data Act regulates switching between cloud providers and bans switching charges from 12 January 2027. At Recapro, a full export of your meetings, transcripts and minutes is already available on request.

09

Why does the AI model matter for sovereignty?

During inference, the model reads your data in clear text. If that model is operated by a company subject to US law, the service drops to the level of that link, even when hosted in France. Recapro runs open-weight models on its own servers, with no third-party LLM at inference.

Going further on sovereignty

Frameworks raise the questions. Your deployment architecture answers them.