---
title: "Best sovereign cloud hosting for business apps in 2026"
url: https://while.sh/en/comparisons/sovereign-cloud-business-apps/
author: "Grégoire Mougeolle, co-founder of Nextmap"
updated: 2026-11-02
---

# The best sovereign hosting for business apps in 2026

Your teams now build their business apps with an AI agent, and IT has to keep up. Here's where to host them in France, behind the company account, and still keep control over what goes to production.

## The right choice depends on your app

- **Do your apps handle health data, or do your customers require certifications?** Choose Scalingo: it is ISO 27001 certified and offers health data hosting (source 1).
- **Does your team prefer to assemble its own European cloud?** Choose Scaleway: containers, database and network are separate products there, with a region in France (source 2).
- **Do your teams deploy with their AI agent, and does IT need to stay in control?** Choose while: each app opens with the company account, and sensitive actions wait for a person.

## The comparison

| Host | In France | The company account in front of the app | Your teams' AI agents | The database |
|---|---|---|---|---|
| Scalingo | Yes (source 3) | No: filtering by IP address (source 4) | No official MCP server: the command line | Managed PostgreSQL, with point-in-time recovery over 7 to 30 days (source 5) |
| Upsun | Yes, two regions (source 6) | No: a username and password, or a list of IP addresses (source 7) | An MCP server in beta, read-only by default (source 8) | Managed PostgreSQL, one backup per day kept 2 days by default (source 9) |
| Scaleway | Yes, in its French region (source 2) | No: a technical key to call the container (source 10) | An MCP server in the CLI, with every command open by default (source 11) | Managed PostgreSQL, one backup per day kept 7 days (source 12) |
| while | Yes, with Nextmap, a French company | Yes: Google Workspace, Microsoft Entra or Keycloak, with no code to write | Over MCP: sensitive actions, like deleting a production database, wait for a person, and every action is recorded in the audit log | PostgreSQL backed up every day, with point-in-time recovery over 14 days (source 14) |

## Scalingo, built for compliance

Scalingo is built for compliance, with ISO 27001 and health data hosting, and it responds to critical incidents in under 15 minutes on average (source 1).

## Upsun, production cloned for every branch

Upsun, formerly Platform.sh, clones all of production for every branch, database included (source 13).

## Scaleway, the European cloud you assemble yourself

Scaleway runs your containers from zero to 200 instances depending on demand, in a European cloud (source 2).

## while, your teams' apps under IT's control

Your teams deploy their apps with their AI agent, over MCP, and IT stays in control. Each app opens with the company account, whether Google Workspace, Microsoft Entra or Keycloak, without a line of code. Sensitive actions, like deleting a production database, wait for a person, permissions go down to the table, and every action is recorded in a signed audit log. With the Enterprise plan, high availability is there by default, the audit log goes to your SIEM and is kept for 7 years, and a production deployment can require two approvals. Everything runs in France, with Nextmap.

## Next steps

- [Restrict an internal tool to company accounts](/en/guides/internal-tool-company-sign-in/)
- [Security on while](/en/security/)

## Sources

1. [Scalingo, home page](https://scalingo.com/), 2026-11-02
2. [Scaleway, Serverless Containers](https://www.scaleway.com/en/serverless-containers/), 2026-11-02
3. [Scalingo, regions](https://doc.scalingo.com/platform/internals/regions), 2026-11-02
4. [Scalingo, the application firewall](https://doc.scalingo.com/platform/networking/public/application-firewall), 2026-11-02
5. [Scalingo, database backups](https://doc.scalingo.com/databases/about/backup-policies), 2026-11-02
6. [Upsun, regions](https://upsun.com/regions/), 2026-11-02
7. [Upsun, HTTP access control](https://developer.upsun.com/docs/environments/http-access-control), 2026-11-02
8. [Upsun, the MCP server](https://developer.upsun.com/docs/get-started/ai/using-the-mcp), 2026-11-02
9. [Upsun, backups](https://developer.upsun.com/docs/environments/backup), 2026-11-02
10. [Scaleway, making a container private](https://www.scaleway.com/en/docs/serverless-containers/how-to/secure-a-container/), 2026-11-02
11. [Scaleway, the CLI's MCP server](https://www.scaleway.com/en/developers/cli/mcp), 2026-11-02
12. [Scaleway, managed database backups](https://www.scaleway.com/en/docs/managed-databases-for-postgresql-and-mysql/how-to/manage-backups/), 2026-11-02
13. [Upsun, platform overview (llms.txt)](https://upsun.com/llms.txt), 2026-11-02
14. [while, tested backups](https://while.sh/fr/docs/briques/sauvegardes/), 2026-11-03

## Questions

### Which one is SecNumCloud qualified?

None of the PaaS platforms in this comparison is qualified itself. Scalingo offers a region on Outscale's qualified infrastructure (source 1).

### Can your teams deploy without going through IT?

On while, yes, within the limits IT sets: sensitive actions, like deleting a production database, wait for a person who is allowed to approve them.

### Do you have to invite every employee who opens an app?

No. They sign in with the company account, through their group or their email domain, with no while account to create.

### What about the contract?

The Enterprise plan is on quote. Write to the team: hello@while.sh.