A SaaS company sends its SOC 2 Type 2 report to a French enterprise and the deal stalls for six weeks. Not on price or product, but on questions the sales team has never been asked: where does the data reside, is the platform SecNumCloud-qualified, and is there a French-language DPA aligned to CNIL’s reference clauses?

Why SOC 2 does not travel the same way. A Type 2 report is strong evidence of a mature security program, but French procurement evaluates vendors through data sovereignty, not just security. SOC 2 says nothing about where data physically resides, which country’s laws can compel access to it, or whether your contracts work for a French legal team.

Where deals stall:

Documentation. The CNIL publishes reference clauses for processing agreements, and French DPO offices expect them reflected accurately. A French-language DPA and SLA should be native documents, not a translation with a French cover page.

Data residency. Hosting in Dublin or Frankfurt is often enough elsewhere in the EU, but French financial and public-sector-adjacent buyers screen for protection from extraterritorial law such as the US CLOUD Act.

SecNumCloud. ANSSI’s qualification covers close to 1,200 requirements and explicitly protects against extraterritorial laws. It is mandatory for sensitive central-government data and a signal of sovereignty-focused procurement when it appears in an RFP.

HDS. Hosting personal health data in France requires Hébergement de Données de Santé certification, and recent changes tie it to SecNumCloud v2.3 for the underlying infrastructure.

Sector regulators. Financial buyers may ask whether a platform is declared to the ACPR or integrates with the AMF’s reporting portal.

What to prepare: keep SOC 2 and ISO 27001 current, invest in native French legal documents checked against CNIL clauses, decide your sovereignty positioning before an RFP forces it, and confirm early which requirements actually apply to your target buyers.

Full guide with the FAQs:
https://accorppartners.com/blogs/soc-2/selling-saas-to-french-enterprises-why-a-soc-2-report-alone-wont-close-the-deal