Cloud sovereignty: Alan's €3 billion deal says it all
Three billion euros. The complementary health insurance of 360,000 French social-security employees goes to Alan, the French insuretech. On paper, it is a national victory: a young domestic player displacing legacy insurers on a flagship government contract.
Except the controversy that followed was never about the provider. It was about the hosting. Alan runs on AWS, Amazon's cloud. In other words, the health data of hundreds of thousands of civil servants will sit on American infrastructure, subject to US law.
What the unions are actually contesting
French labor unions did not challenge the choice of Alan. They challenged the hosting. The nuance matters, because it captures the whole problem: nobody disputes the company's product. What raises eyebrows is that the social-security system, arguably the most data-sensitive institution in the country, hands its technical foundation to a foreign hyperscaler.
The digital sovereignty debate is not new. It has simply reached unprecedented scale, because the contract itself is unprecedented.
The problem is mechanical, not ideological
Let's be honest about the root cause. No French hosting provider today offers the scale, the service coverage, and the certifications a contract of this size demands. AWS is the global leader in cloud infrastructure, and that gap does not close within a single budget cycle.
The result is a mechanical vicious circle. The bigger a public contract gets, the more it requires cloud capacity only hyperscalers can provide. But the bigger it gets, the more sensitive data it carries, and the more foreign hosting becomes a problem. Every major contract awarded to a US provider widens the very gap the European cloud industry hopes to close.
The French state wants sovereignty and competitiveness. It picks the second, because it cannot have both. The choice is not immoral. It is constrained. That is exactly the real problem.
What this means for European cloud sovereignty
Sovereign cloud in France is not dying from a court ruling or a technical flaw. It is dying from repetition: at every major tender, economics win because the national alternative is not ready. Until domestic providers close the gap in scale and certification (SecNumCloud first and foremost), every landmark contract strengthens the position of the US giants.
For IT teams in both the public and private sectors, the lesson is twofold. First, sovereignty is a criterion you negotiate upstream, not a debate you launch after the award. Second, when data is deemed strategic, its legal location matters as much as its technical protection — a reality made vivid by how physically vulnerable cloud infrastructure already is in wartime.
Meanwhile, the country's most critical health data now flows through servers outside French jurisdiction. The next contract of this size will raise the exact same question, unless policy changes the rules of the game.