“Where is our data hosted?” now appears in the vendor questionnaires of large accounts, in the specifications attached to public tenders and on the agenda of board meetings. Answering “in the cloud” satisfies nobody any more. We set out in writing which systems process your data from inside the European Union, which ones leave the territory and what mechanism each transfer rests on. Then we bring home whatever ought to come home. Ruling on the lawfulness of a transfer belongs to your counsel or your DPO; from us they get checkable technical facts instead of impressions.
Inventory first, routine operation last. Surprises hardly ever come out of the main application: they hide in the fringes, website plugins, marketing widgets, signature platforms and backup jobs set up once, five years back, and never revisited.
We list the applications and online services, the region each instance runs in, their own sub-processors and the place a supplier's support desk dials in from when it helps you. Scripts loaded by your website are examined the same way: live chat, audience measurement, advertising pixels, remote fonts.
Each transfer leaving the Union is logged with the mechanism its supplier invokes: standard contractual clauses, a decision on adequacy, whatever extra measures are advertised. Judging whether any of it holds up falls to your DPO or your solicitor, who will also draw on CNIL publications. We provide the material, not the opinion.
The checks cover the zone in which the tenant was originally created, the residency settings your particular licence really makes available, and the features capable of handling content somewhere else: add-ins accumulated over the years, connectors, and AI assistants that arrive enabled after an update.
VPS servers, dedicated servers or object storage at OVHcloud, Scaleway, Outscale or another provider based in the Union. The choice weighs load, budget, your contractual commitments and the nationality of the parent company. Where a tender calls for a SecNumCloud qualified offer, we help you pick a provider that holds it.
Something we run into constantly: production sits with a French provider while the backups land in an American region, simply because that was preselected on the day someone set the job up. We relocate the copies, switch encryption on, confirm which party holds the keys, then run a restore before declaring the matter closed.
Data, settings and integrations travel under a plan that provides for a dress rehearsal and a route back. Once the switchover is behind you, the new environment gets closer attention for an agreed stretch of time, and the paperwork, flow map included, is refreshed.
Very little of this is compulsory movement. Changing one region setting occasionally covers it; elsewhere a tool has to give way to another; and in some cases the sensible answer is staying put and documenting the transfer properly. Dates get fixed once the inventory exists, never ahead of it.
Systems, regions, onward processors and the dependencies binding applications together, all written down. Your legal adviser works from that to decide what stays put and what leaves.
Infrastructure goes up inside the Union, the data is copied over, and a few willing colleagues put it through its paces. Faults surface during the rehearsal rather than at nine o'clock on a Monday.
Evenings or weekends, application by application. Nothing is torn down on the old side until you confirm that everything runs, printing and integrations included.
Redundant subscriptions are cancelled so that nothing is paid for twice, erasure is requested from the previous supplier, and you receive the flow map in its updated form.
Data leaves the Union through the side door. The contact form posts enquiries through a mailing service hosted elsewhere, the shop pulls in a chat window run from outside Europe, the signature tool archives contracts in a region other than the one where they were signed, and the analytics extension installed for a trial in 2019 is still running. Which is precisely why this job opens with a map and not with picking a data centre.
Not in so many words. Any transfer leaving the Union has to rest on a proper basis, and establishing whether yours does is work for your counsel or your DPO. Day to day, the insistence that everything remain European tends to arrive from a major customer, a public buyer, or directors who would rather not revisit the subject annually. Our job is to show what the technical picture looks like and what changing it would cost.
SecNumCloud is a qualification that ANSSI grants to hosting offers, not to the firms that operate them on your behalf. Apply does not hold it and will not pretend otherwise. What we do instead: identify the qualified offers your applications can actually run on, estimate the effort and budget a move would take, and prepare the technical answers you will hand back to whoever asked.
In France personal health data falls under HDS hosting, and the certification is held by the hosting provider. Apply is not a hosting provider and is not HDS certified; what we do is help you choose an HDS certified host, install your application there properly and document how responsibilities are split. Classifying your processing activities and handling the formalities stays with your DPO and your legal adviser.
The contents of a backup match those of the system it came from, so ordinarily the same constraints ride along with it. This remains the most overlooked corner of the whole exercise: production came home two years ago while the off-site copy still travels elsewhere every night. Mapping therefore always covers where the copies rest, their encryption, and which party genuinely keeps the decryption keys.
Three routes present themselves. Stand up a free software alternative on a machine inside the Union, which moves the expense towards operating it. Separate the data so that nothing but pseudonymised records, with identifiers stripped away, ever reaches the foreign service. Or hold on to the tool and document the grounds for the transfer with real care. Budget decides between them, alongside the legal assessment that your DPO draws up rather than us.
List the applications and services your company uses and, if you know it, where they are hosted. We come back within one working day with a proposed flow map and its price.
Message received
An answer follows inside one working day. Report an outage that is stopping people working and it moves ahead of everything else.
Nothing here under that name. Check the spelling, or simply choose the nearest large city instead. Since every engagement runs remotely, whichever you pick changes nothing about what we do for you.
