Hosted exclusively on OVH Cloud France — Cloud Act inapplicable, native NIS2, ISO 27001 certified. Your data never leaves French territory.
Why France
Choosing your host is a strategic and legal decision — not just a technical one. Your key account clients, your ISO auditors and your NIS2 prospects all look at where your data is stored.
AWS / Azure
Cloud Act applicable — data accessible by the US
Vercel / Scaleway
Partially sovereign — limited security
OVH Cloud France
Absolute sovereignty — Cloud Act inapplicable
The US Cloud Act: an underestimated risk
The Cloud Act allows US authorities to demand access to the data of any company subject to US jurisdiction — including if the data is in Europe. AWS, Azure and Google Cloud are all subject to this law. OVH, as a French company, is subject exclusively to European law. For your CIOs, CISOs or clients in regulated sectors, this is a decisive contractual argument.
Technical architecture
In Cybercoding, infrastructure is specified and hardened before coding begins. You inherit a foundation validated by CISOs that would have taken 2 to 3 years to build in-house.
Keycloak IAM — Zero Trust identity
Multi-tenant authentication, SSO, mandatory MFA. JWT deliberately kept empty — permissions are validated in real time on every API call. A revoked account is invalidated within milliseconds across the whole infrastructure.
Used by 50%+ of the world's banksKubernetes — Orchestration & scalability
Containers isolated per microservice. Automatic horizontal autoscaling. Hot updates with no downtime. Strict network policies — each service can only talk to what it's authorised to see.
99.9% uptime contractually guaranteedOpenBao / Vault — Secrets vault
No API keys or environment variables in the source code. Secrets are temporarily injected into memory at startup. Automatic rotation according to ISO 27001 policies.
Zero secrets exposed in the codePostgreSQL RLS + MongoDB — Multi-tenant isolation
Native Row-Level Security: an SQL query can never read another client's data. MongoDB Time Series for real-time audit logs and metrics.
Watertight per-tenant partitioningOpenTelemetry + Grafana — Full observability
Distributed logs, metrics and traces. Immutable audit logs cryptographically signed (WORM Object Lock). Real-time SecOps dashboards.
Native ISO 27001 forensicsWAF + Post-quantum encryption
Application firewall active on all routes. Hybrid encryption via Liboqs — resistant to quantum computers. ML-DSA for build signing, ML-KEM for key exchange.
Ready for the post-quantum eraWakaStart technical stack
Hosting packages
Every package includes the production Kubernetes environment, WakaStart monitoring and the OVH contractual SLA.
Hosting package
Startup
Applications at launch stage — a few thousand users, moderate load.
Hosting package
ScaleUp
High-growth applications — tens of thousands of users.
Hosting package
Legacy
Mature vendors and high-volume projects — advanced scalability.
| SLA indicator | Startup | ScaleUp | Legacy |
|---|---|---|---|
| Guaranteed availability | 99,9% | 99,9% | 99,95% |
| 24/7 on-call | Included | Included | Included |
| EU geo-redundancy | Optional | Included | Included |
| Automatic failover | < 60s | < 30s | < 15s |
| Audit log retention | 12 months | 24 months | 36 months |
Resilience & continuity
The NIS2 directive requires demonstrated business continuity. WakaStart deploys your SaaS in an Active-Active architecture across two physically distant datacenters — a complete outage doesn't affect you.
Multi-site Active-Active deployment
Application and security runtime continuously replicated across two datacenters hundreds of kilometres apart. In the event of a complete site outage, traffic automatically switches over via GSLB/DNS Anycast — the user experiences no interruption.
Security preserved during failover
Whichever datacenter is active, the protection level remains at 100%: WAF active, Keycloak IAM operational, forensic log integrity maintained. A revoked account is invalidated across the entire network within milliseconds.
Immutable logs and forensic traceability
Audit logs replicated to immutable Object Lock storage (strict Compliance mode). No risk of losing traceability in the event of hardware failure. Every action is timestamped and cryptographically signed.
End-to-end post-quantum encryption
Build archives signed with ML-DSA (quantum-computer resistant). Hybrid key exchange via ML-KEM. Your infrastructure is ready for the post-quantum era before the threat becomes real.
On-premise deployment
For large organisations subject to mandatory physical isolation requirements — defence, healthcare, finance — WakaStart can be deployed on your internal infrastructure.
Guaranteed GitOps consistency
Continuous reconciliation architecture. If a configuration drifts locally, the engine detects it and automatically realigns it with the validated target state.
Cryptographically signed build
Application package signed with ML-DSA before transfer. Dual cryptographic validation + local SAST/DAST scan proves the integrity of the transfer.
Air-gap for critical cases
For classified environments, transfer via encrypted, sealed physical media, handed directly between authorised operators.
On-premise deployment flow
Frequently asked questions
Why OVH rather than AWS or Azure?
AWS and Azure are subject to the US Cloud Act — US authorities can access your data without your consent, even if it's physically located in Europe. OVH is a French company subject exclusively to European law. For your CIOs, CISOs, or healthcare and defence clients, this is a non-negotiable contractual requirement.
What does NIS2 compliance mean for my hosting?
The NIS2 directive requires geo-redundancy, forensic access traceability, encryption in transit and at rest, and automatic failover capability. It also makes your key account clients responsible for the security of their suppliers — without ISO 27001 and sovereign hosting, you're excluded from their tenders.
What does Kubernetes actually give me?
Kubernetes splits your application into isolated containers. If a feature experiences a load spike, Kubernetes duplicates that container within seconds without affecting the rest. Hot updates, zero 500 errors, 99.9% availability contractually guaranteed.
Can WakaStart be deployed on-premise?
Yes. For large organisations with mandatory physical isolation, WakaStart deploys on your internal infrastructure. The Cybercoding Control Plane maintains consistency via continuous reconciliation GitOps. For classified environments, transfer takes place via Air-gap on encrypted physical media.
French sovereignty, Kubernetes, ISO 27001, NIS2 — all natively included. Start with a free audit to assess your current infrastructure.