A European datacentre isn't enough for European sovereignty
Okta, Auth0, Microsoft Entra ID and most US identity providers offer hosting on a European region. Your data sits in Frankfurt, Paris or Dublin, but the company running it is American, and US law follows the company, not the server.
US law gives Washington two levers over a US provider, wherever its servers are: the CLOUD Act to obtain your data, and sanctions to cut your access.
US authorities can order a US provider to hand over the data it controls, even on a server in Frankfurt. A gag order can stop it from telling you: you may never know.
US sanctions oblige US companies to stop serving whoever they target. Cut the IAM and nobody signs in anywhere: not your employees, not your customers, not your partners.
For an IAM, that means your directory, your login history, the keys to your applications, and the ability to sign in at all.
| US provider, European region | Cloud-IAM | |
|---|---|---|
| Data stored in Europe | Yes | Yes |
| Zero exposure to extraterritorial laws | No | Yes |
| No foreign government can cut your access | No | Yes |
| No US sub-processor on your users' data | No | Yes |
| Login traffic served directly by your deployment | No | Yes |
| Operated only from France | No | Yes |
| Run the same IAM on your own servers | No | Yes |
Of all your data, your IAM is the one to keep out of reach
Your IAM isn't one more database. It's the one that opens all the others, and it holds everything needed to do so.
What it holds
Names, emails, phone numbers, password hashes, and the OTP secrets and passkeys meant to stop a stolen password.
Who can access what, and who signed in, when, from which IP address and device.
The keys that sign your tokens and the credentials to your directories. Whoever holds them can sign in as anyone, to any app.
What that means for you
Personal data on every user you have. A breach must be reported within 72 hours, and fines reach 4% of global turnover.
If your users are patients, their accounts can count as health data, which French law requires an HDS-certified host to hold.
Access control and MFA are measures NIS2 requires, so your IAM and whoever runs it belong in your supplier risk assessment.
A copy of your CRM exposes your customers. A copy of your IAM lets someone become them.
Sovereignty through European operating control
A French operator, the cloud you choose, and every dependency named.
Cloud-IAM is independent and 100% French-owned, with no US parent or shareholder. Only our employees, based in France, can operate your deployment.
Your deployment runs at 3DS Outscale or Scaleway, in France, including Outscale's SecNumCloud region. AWS, Google Cloud and Azure remain available if you need them.
A data processing agreement, a public list of every sub-processor and where it runs, and ISO 27001 certification to hand to your DPO.
Data residency across the whole service
Your database in the region you choose, backups, logs and keys in France, and logins straight to your deployment.
Sovereign means always available, and always yours
Your users can always sign in, and you can always take everything with you, whatever happens to our prices. It's your Keycloak: we run it, you keep it.
A highly available Keycloak and its database on European clouds, with an uptime SLA of up to 99.98%.
Our team monitors your deployment around the clock, tests every Keycloak release and rolls back if anything breaks.
On paid plans, export your realms as Keycloak JSON and download full PostgreSQL backups, encrypted with your own key.
Standard Keycloak on open standards, and no exit fee. If our prices go up, your team or another operator can run it tomorrow: you're never stuck paying.
What it means for your compliance
GDPR
GDPR restricts transfers of personal data outside the EU, and access by a US provider counts as one. It also refuses to recognise a foreign authority's order to hand data over, unless an international agreement provides for it. On a European cloud, your users' data stays in the EU and never reaches a US company.
Cloud-IAM acts as your processor under a data processing agreement.
CLOUD Act and FISA 702
The CLOUD Act lets US authorities demand data a US provider controls, wherever it is stored, and FISA Section 702 lets US intelligence target the data of non-Americans held by US providers.
US vendors answer with the EU-US Data Privacy Framework. It makes transfers to certified US companies legal under GDPR, but does nothing about the CLOUD Act, which needs no transfer at all. And the two frameworks before it, Safe Harbor and Privacy Shield, were struck down by the EU Court of Justice in 2015 and 2020.
Cloud-IAM is a French company with no US parent: these laws don't apply to us.
EU Cloud Sovereignty Framework (SEAL)
The European Commission's Cloud Sovereignty Framework grades cloud services on eight sovereignty objectives, from SEAL-0, no sovereignty, to SEAL-4, full digital sovereignty. A service gets the lowest level it reaches on any objective, and the Commission now sets a minimum SEAL in its own cloud tenders.
Scaleway, one of our two French hosts, reached SEAL-3 in the Commission's 2026 tender. Cloud-IAM is designed around the framework's objectives for the layer we run on top: a French company, operated from France, on standard Keycloak you can take elsewhere.
NIS2
NIS2 makes essential and important entities answer for the security of their suppliers, and its Article 21 names access control and multi-factor authentication among the measures they must take.
Cloud-IAM is ISO 27001 certified and gives you MFA, audit logs and admin access controls out of the box, from a European supplier you can document.
SecNumCloud and HDS
SecNumCloud is ANSSI's qualification for cloud services, and since version 3.2 it requires protection from non-EU laws. HDS is the certification French law requires to host health data.
Cloud-IAM can deploy your Keycloak on Outscale's SecNumCloud-qualified region and on HDS-certified hosting, for the public sector, health and critical industries.
Is Cloud-IAM subject to the US CLOUD Act?
No. Cloud-IAM is a French company, 100% French-owned, with no US parent, subsidiary or shareholder. The CLOUD Act binds providers under US jurisdiction, and Cloud-IAM is not one.
Doesn't a European region at AWS, Azure or Google protect my data?
It keeps the data in Europe, not out of reach. The CLOUD Act and FISA 702 apply to US companies wherever they store data, so a server in Frankfurt run by a US provider can still be ordered to hand it over.
Isn't the EU-US Data Privacy Framework enough?
Where is my users' data stored?
In your deployment, on the cloud and region you choose: 3DS Outscale or Scaleway, in France, for a sovereign setup. Logs, metrics and encrypted backups are kept in France, at Scaleway and Outscale.
Does Cloud-IAM use any US company?
Not for your users' data. Your deployment, its logs and its backups stay with European providers. For running our own business, we use a few US services, such as Stripe for billing, HubSpot for our CRM and Google Workspace for company email. They handle your account details (console users, contacts, invoices), never the identities in your deployment. The sub-processor list names every one and what it handles.
Who at Cloud-IAM can access my deployment?
Only Cloud-IAM's operations and support team, all employees based in France.
Can I keep my own encryption keys?
Yes, bring your own key (BYOK). Otherwise, keys are managed at Scaleway, in France.
Is Cloud-IAM SecNumCloud-qualified?
Our host is. Cloud-IAM can deploy on Outscale's SecNumCloud-qualified region; Cloud-IAM itself does not hold the qualification. Cloud-IAM is ISO 27001 certified.
How does Cloud-IAM help with NIS2?
NIS2 asks you to secure access to your systems, including with multi-factor authentication, and to answer for your suppliers. Cloud-IAM gives you MFA, audit logs and admin access controls, as a European, ISO 27001-certified supplier you can document in your risk assessment.
Can I leave Cloud-IAM and take my users with me?
Yes. Cloud-IAM runs open-source Keycloak, so you can export your realms, users and configuration and import them into any Keycloak, including one on your own servers.
Can I still host on AWS, Azure or Google Cloud?
Yes, Cloud-IAM runs on them too, in the region you choose. They are American companies, so a deployment there doesn't get the sovereignty described on this page.
