| Question | Short answer | Key takeaway |
|---|---|---|
| Where is the health data of Galeon's hospital clients hosted? | On a sovereign, HDS-certified cloud infrastructure operated by Scaleway, a French provider with fully European governance. | The host's governance is European, not just the storage location. |
| Is HDS certification mandatory for an EHR? | Yes. It is required to host health data on behalf of third parties, under article L.1111-8 of the French Public Health Code. | Without HDS, an EHR cannot be operated in France: it is the legal foundation, not a marketing claim. |
| Why does sovereignty matter beyond HDS? | Because data stored in Europe can still be exposed to the law of a third country, such as the US Cloud Act. | The jurisdiction applying to the host matters as much as where the servers sit. |
| How does choosing Scaleway keep data away from the Cloud Act? | Scaleway is a French company with fully European governance, not subject to the extraterritorial reach of US law. | A European host closes a door that a non-European hyperscaler would leave ajar. |
| What does the partnership bring on the technical side? | A cloud-native architecture orchestrated by Kubernetes (Kapsule), with S3-compatible Object Storage, Secret Manager and Container Registry. | Elasticity, resilience and continuity of service for a critical system. |
| What operational gains are measured? | Adding a node 3 to 4 times faster, capacity added in under 5 minutes, infrastructure cost reduced by 50 to 67 %. | Meeting the availability of a critical system without over-provisioning or overspending. |
| Is sovereignty an absolute guarantee? | No. No arrangement makes data untouchable; sovereignty is a set of legal and technical guarantees. | The goal is to reduce exposure and keep data reversible. |
When a healthcare facility entrusts its electronic health record (EHR) to a software vendor, one question comes before all others: where will the health data be hosted, and under which jurisdiction? For a hospital executive, a CIO or a CISO, this is not a technical footnote. It is a matter of legal accountability, patient trust and regulatory compliance.
At Galeon, this sensitive data is hosted on a sovereign, HDS-certified cloud infrastructure operated by Scaleway, a French provider with fully European governance. This article explains, in concrete terms, what that choice means for a healthcare organization: sovereignty, security, compliance, and keeping data beyond the reach of the US Cloud Act.
In France, hosting personal health data on behalf of third parties is governed by the HDS certification (Health Data Host), under article L.1111-8 of the Public Health Code. No facility may entrust its patient data to a provider that is not HDS-certified according to the standard in force.
On top of that requirement sits the General Data Protection Regulation (GDPR), which mandates a legal basis for processing, data minimization, access traceability and safeguards on transfers. For an EHR, this translates into very concrete obligations: encryption, isolation, logging, reversibility and controlled data location.
HDS certification is therefore not a marketing claim. It is the legal foundation without which an EHR cannot be operated in France. The real point of differentiation lies elsewhere: in the jurisdiction that applies to the host.
Data can be physically stored in Europe while remaining exposed to the law of a third country. This is the heart of the debate around the Cloud Act (Clarifying Lawful Overseas Use of Data Act). This 2018 US law allows, under certain conditions, US authorities to require a provider subject to their jurisdiction to hand over data, even when it is hosted outside US territory.
The decisive criterion is therefore not only the physical location of the servers, but the nationality and control structure of the host. A provider subject to US law could, in theory, receive such a request regardless of where its data centers sit.
This is precisely why Galeon selected a host with European governance. Scaleway is a French company, and its fully European governance means it is not subject to the extraterritorial reach of US law. The health data of Galeon's hospital clients thus remains under the protection of the European framework, away from the reach of the Cloud Act.
Nuance matters: no arrangement makes data untouchable, and sovereignty is a set of legal and technical guarantees rather than an absolute promise. But choosing a European host closes a door that selecting a non-European hyperscaler would, by design, leave ajar.
Beyond the legal framework, the operational question remains: how do you run a hospital EHR reliably, securely and at scale? The partnership between Galeon and Scaleway answers on several fronts.
Galeon's infrastructure runs on a cloud-native architecture orchestrated by Kubernetes, through Scaleway's Kubernetes Kapsule service. This approach brings three direct benefits for a facility:
Several Scaleway building blocks complete the picture: S3-compatible Object Storage for backups, Secret Manager for centralized management of secrets and keys, and Container Registry for controlled distribution of application images.
The testimonial published by Scaleway highlights operational gains measured on the Galeon side:
| Indicator | Observed result |
|---|---|
| Adding a node to the cluster | 3 to 4 times faster |
| Adding capacity | in under 5 minutes |
| Infrastructure cost at comparable load | 50 to 67 % reduction |
| Scale at peak periods | up to 200 Kubernetes nodes |
For a CIO, these indicators translate into plain terms: the ability to absorb load spikes without over-provisioning, and therefore to control spending while meeting the availability requirements of a critical system.
Galeon also uses Scaleway's compute capabilities for artificial intelligence workloads applied to health data, such as optical character recognition (OCR) and voice transcription. The benefit is twofold: these demanding workloads run on suitable infrastructure while staying within the same sovereign, HDS-certified perimeter as the rest of the data. Innovation therefore does not come at the cost of a compromise on confidentiality.
For a hospital executive, a CIO or a CISO, Galeon's hosting choice can be read through a simple grid.
That last point deserves attention. Sovereignty is not limited to location: it includes the ability to retrieve your data in usable formats. Relying on open standards is a guarantee of long-term freedom for the facility.
The context is shifting fast. Hospital leadership increasingly factors digital sovereignty into its selection criteria, whereas HDS compliance alone was sometimes enough to win the decision a few years ago. As Laurent Charvolin, Chief Information Officer at Galeon, summarizes in the Scaleway testimonial, facilities were until recently willing to work with non-European providers, but mindsets are changing rapidly.
This shift is not merely about image. It reflects a growing awareness: health data is a strategic asset, and protecting it engages the facility's responsibility well beyond the technical dimension alone.
Read the full story on the Scaleway side: the Galeon sovereign-cloud case study.
Hosting an EHR is not just about storing files. It commits patient trust, the facility's legal accountability and the continuity of a critical service. By relying on Scaleway, a French HDS-certified host with European governance, Galeon makes sovereignty and compliance a foundation rather than an option bolted on afterwards.
Would you like to understand exactly how Galeon protects your facility's data and where it is hosted? Our teams can walk you through the architecture and answer your compliance questions in a demonstration tailored to your hospital context.
Want to know more about our smart EHR ?
Book a demoScaleway testimonial: the Galeon sovereign-cloud case study
