Loading the catalogue…
Scaleway Generative APIs
L3 · Sovereignscaleway-generative-apisFranceEurope
Scaleway, the cloud arm of the French Iliad Group, serves open-weight models such as Mistral, Qwen, Llama and gpt-oss from a Paris data centre operated by OPCORE. Prices are per token in euros.
Compliance posture · Stav's assessment
Jurisdiction
EU · France
Data residency
EU
CLOUD Act / FISA 702
Not exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Strong
Legal exposure
Strong
Serving retention
Adequate
Security posture
Weak
Contractual posture
Adequate
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 7 risk items · 7 safeguards · 3 privacy-policy issues · DPA, sub-processor list, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 17 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L3SovereignIndicativeregistry 4.2
This level applies to traffic routed through Stav.
Scaleway SAS, 96% owned by the French Iliad SA, is at L3. L4 is blocked because SecNumCloud qualification is in progress but not granted, and NVIDIA's proprietary CUDA and GPU software is a third-country dependency Scaleway cannot maintain itself.
3 criteria from L4: Sovereign cloud qualification, Effective software control, No revocable third-country dependency.
Stav's own assessment against criterion registry 4.2. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 20 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
ISO/IEC 27001:2022
Providing the technical infrastructure platform to support the Scaleway's Public Cloud products, according to SOA V.1.1 dated 2 October 2023. Holder named on the certificate: SCALEWAY, Legal Site 8 rue de la Ville l'Évêque, Paris 75008, France (plus listed colocation sites in FR, NL, PL). · Claimed by the provider
HDS (Hébergeur de Données de Santé)
Health data hosting — specific perimeter of CPU/GPU Instances, Object and Block Storage, Bare Metal, and VPC, limited to Scaleway's data centers in France · Current
SecNumCloud
ANSSI qualification for the "Scaleway Cloud" offering · In progress
HDS (Hébergeur de Données de Santé) — hosting of health data
Scaleway SAS and Opcore SAS certified for health-data hosting; Scaleway's page lists activities #1–#5 depending on product (Instances, Block/Object Storage, Dedibox, Elastic Metal, VPC, Load Balancer, Kapsule); HDS hosting limited to datacenters in France, contract and Business/Enterprise support plan required. · Claimed by the provider
SecNumCloud (ANSSI qualification)
Qualification process underway; provider states the qualification is 'not yet granted' and that no current service is SecNumCloud 3.2-qualified. · In progress
CSA STAR Level 1 (self-assessment)
Claimed by the provider
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listpublished
Links to every document and certificate — 4 legal documents, 6 certification sources
Compiled by Stav from the provider's published documentation. Last verified 1 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 14
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| DeepSeek V4.1 Flash (1017) | €0.60 | €1.80 | — | — |
| GLM-5.3 | €1.80 | €5.50 | 0.37 s | 652 |
| DeepSeek V4 Flash (0731) | €0.40 | €0.80 | 0.45 s | 597 |
| mistral-medium-3.5-128b | €1.50 | €7.50 | 0.25 s | 72 |
| qwen3.6-35b-a3b | €0.25 | €1.50 | 0.22 s | 193 |
| Gemma 4 26B A4B IT | €0.25 | €0.50 | 0.19 s | 260 |
| qwen3.5-397b-a17b | €0.60 | €3.60 | 0.23 s | 103 |
| qwen3-235b-a22b-instruct-2507 | €0.75 | €2.25 | 0.19 s | 117 |
| Mistral-Small-3.2-24B-Instruct-2506 | €0.15 | €0.35 | 0.18 s | 169 |
| Qwen3 Embedding 8B | €0.10 | Free | — | — |
| Llama-3.3-70B-Instruct | €0.90 | €0.90 | 0.20 s | 103 |
| bge-multilingual-gemma2 | €0.10 | Free | — | — |
| gpt-oss-120b | €0.15 | €0.60 | 0.21 s | 243 |
| qwen3.8-27b | €0.60 | €3.30 | 0.28 s | 237 |