The European conversation around digital sovereignty takes another step down to the operational layer. Bitdefender, a European cybersecurity provider with a global presence, and OVHcloud, a leading hyperscaler in Europe, have announced a strategic partnership to host the Bitdefender GravityZone security platform on OVHcloud SecNumCloud services in France. The agreement promises one thing simple to state and difficult to execute: that client data, configurations, security events, and telemetry do not leave the European Union and are not accessible or processed outside of it, while maintaining top-tier prevention, detection, and response capabilities.
The move arrives as residency requirements, regulatory pressures, and sensitivity to extraterritorial laws have turned the location, control, and processing of information into strategic issues for companies and public administrations. With this announcement, Bitdefender and OVHcloud offer a combination that many European CISOs have been demanding: advanced security technology within a qualified infrastructure compliant with national and EU standards, with access controls and usage under European jurisdiction.
“We provide a secure and sovereign infrastructure that meets the highest French standards and enables Bitdefender to deliver its cybersecurity suite, the same that protects OVHcloud as a client,” emphasizes Julien Levrard, CISO of OVHcloud. “Together, we bring European sovereign security to organizations across the region, helping them to innovate and operate with confidence.”
What do we mean when we talk about “sovereignty” in cybersecurity?
The core of the initiative is Bitdefender GravityZone, a unified platform for security, risk analysis, and compliance that covers Endpoint Protection (EPP), Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), and native cloud security. In this deployment, GravityZone is hosted within OVHcloud SecNumCloud, the certified offering by ANSSI (France’s National Agency for the Security of Information Systems) that certifies —through more than 360 technical, organizational, and legal requirements— robustness, control, and immunity to extraterritorial laws.
Why does SecNumCloud matter?
- Data residency: the services run in data centers in France (Roubaix, Gravelines, and Strasbourg), ensuring data remains within the EU territory.
- ANSSI qualification: the SecNumCloud framework is currently France’s reference for hosting sensitive information (government records, patents, intellectual property, critical datasets for AI).
- Extraterritorial immunity: the requirement that no laws from third countries apply reduces the risk of access via non-European legal channels, a persistent concern since 2018 (GDPR) and reinforced by the EU’s digital sovereignty agenda.
For Bitdefender, this fit allows extending its “end-to-end” coverage — deep context detection along the attack chain and MDR services (management detection and response) — without sacrificing data sovereignty.
“European companies need advanced prevention, protection, detection, and response without renouncing to data sovereignty,” highlights Andrei Florescu, President and CEO of Bitdefender Business Solutions Group. “With OVHcloud SecNumCloud, clients know their data stays within the EU and have a clearer pathway toward compliance with GDPR, NIS2, DORA, and other regulations.”
What each provides (and what the customer gains)
Bitdefender brings the security layer:
- GravityZone as a unified platform with EPP/EDR/XDR and cloud security.
- Enriched detection context, correlation across the kill chain, and MDR services that leverage telemetry.
- A strengthened channel ecosystem: partners and MSPs can offer GravityZone hosted in the EU and manage it on behalf of clients with residency requirements.
OVHcloud contributes the sovereign infrastructure layer:
- SecNumCloud qualified by ANSSI, with requirements for security, organization, and legal compliance (more than 360 controls).
- Data centers in France and an integrated model (own servers, data centers, network) aimed at full control over the value chain.
- Commitments of exterritorial immunity and operational transparency.
The client benefits from three things that rarely coexist:
- Cutting-edge cybersecurity technology in a unified platform (less complexity, better visibility).
- Residency and control of data within the EU, on a qualified service approved by the national regulator.
- A more direct path to compliance with GDPR, NIS2 (essential/important services), DORA (finance), and other sector-specific standards (healthcare, education, energy, manufacturing).
A regulatory environment tightening… and a culture still maturing
The partnership is announced alongside an unsettling statistic: according to a Bitdefender survey, 35% of IT and security professionals in France admit to experiencing pressure to remain silent about breaches, even when they felt they should disclose. It’s a warning that regulation and compliance matter, but the culture of transparency in incident reporting still needs reinforcement.
Within this framework, sovereign platforms and clear residency and usage control of data can reduce internal friction: it becomes easier to communicate, notify, and remediate when flows are governed in own jurisdiction and with auditable controls.
Sectors and use cases: where it fits best
The proposal targets public and private entities of all sizes with strict residency or sovereignty requirements for data. It is particularly suited for:
- Financial services (DORA, SOC 24/7, MDR with EU residency).
- Healthcare (medical records, HL7/FHIR, sensitive telemetry).
- Energy and critical infrastructure (NIS2, business continuity, hardening).
- Education (PIs, research, minors’ data).
- Manufacturing and intellectual property (patents, designs, trade secrets).
- Public sector (government records, justice, interior, local authorities).
Additionally, the channel benefits: partners and MSPs can resell GravityZone hosted in SecNumCloud, complying with residency and managing environments on behalf of clients (multi-tenant model and secure delegation).
What does “immunity from extraterritorial laws” mean?
One of the most intriguing points is the promise of immunity against laws by third countries. Practically, SecNumCloud services are designed to prevent non-European authorities from demanding access to data stored in France, even indirectly. This relies on:
- Physical data location and processing within France.
- Governance and ownership of infrastructure by European entities.
- Legal and contractual controls reinforcing this non-subjection.
For organizations sensitive to Cloud Act, FISA, or other extraterritorial regulations, this provides an additional guarantee that complements encryption, segregation, and technical access controls.
What does this mean for a SOC’s daily operations?
- Consolidation: EPP/EDR/XDR and MDR on a single telemetry base.
- Context: detections with depth across the attack (techniques, tactics, origins).
- Guaranteed residency: Events, artifacts, and configurations are stored and processed in France/EU.
- Compliance pathways: Auditable alerts and reports simplify notification to authorities (e.g., NIS2 timelines) and interactions with auditors.
- Operational model: collaboration with MDR (if contracted) to provide 24/7 coverage with joint teams under a sovereign framework.
What doesn’t it resolve (and what remains client’s responsibility)?
- Internal governance: data classification, retention, deletion, minimum access, and training remain the client’s responsibility.
- Incident response process: transparency and notification depend on corporate policies; the platform facilitates but does not decide.
- Integration with other systems: federating signals and automation (SOAR, ITSM) requires projects and architecture.
- Global coverage: if operations extend outside the EU, mixed environments (sovereign within EU + global outside) may be needed.
Conclusion: first-rate technology within a European trusted perimeter
The Bitdefender–OVHcloud alliance encapsulates a trend: maturing Europe’s digital sovereignty without lowering the technical bar. GravityZone in SecNumCloud combines advanced defense (EPP/EDR/XDR/MDR) with residency, control, and ANSSI qualification — a formula that facilitates compliance, reduces legal risk, and brings cybersecurity closer to European regulatory standards.
For CISO, CIO, and DPO seeking a balance between risk, performance, and compliance, this proposal offers a practical path: protect with cutting-edge technology without taking data outside the European home. And for the ecosystem, it reinforces the idea that sovereignty and technical excellence are not mutually exclusive objectives.
Frequently Asked Questions (FAQ)
What is OVHcloud SecNumCloud, and why is it relevant to data sovereignty?
SecNumCloud is the qualification from France’s ANSSI for cloud services that meet more than 360 technical, organizational, and legal requirements. It certifies enhanced security, residency, and control in France, as well as immunity from extraterritorial laws. It’s the benchmark for hosting sensitive data (State, healthcare, finance, IP) with European guarantees.
What security components does Bitdefender GravityZone include on OVHcloud?
GravityZone offers endpoint protection (EPP), detection and response (EDR), extended detection and response (XDR), and native cloud security. The platform provides unified visibility of the kill chain, deep detection context, and can extend to MDR services (managed detection and response) for 24/7 coverage.
How does this partnership facilitate compliance with GDPR, NIS2, or DORA?
Residency and processing within the EU simplifies GDPR compliance (sovereignty, international transfers), while the audited model and governed telemetry streamline reporting and timelines for NIS2 (essential/important services). For finance, traceability, access control, and incident management aid compliance with DORA. The platform does not replace internal policies but provides a solid framework.
Which sectors and company sizes is this designed for?
It targets public and private sectors of any size with residency or sovereignty requirements. Especially relevant for financial services, healthcare, education, critical infrastructures, energy, and manufacturing. Partners and MSPs can resell GravityZone hosted in SecNumCloud, managing EU data residency environments on behalf of clients.
Can client data or telemetry be transferred outside the EU for support or analysis?
The framework establishes that client data, configurations, security events, and telemetry will not be accessible, transferred, or processed outside the EU. The goal is to keep the entire chain —storage and processing— under European jurisdiction.