How to reconcile innovation, operational performance and protection of the most sensitive data? At Tech For Industry Show 2026 (Paris Expo Porte de Versailles), three players in a partnership announced on 27 April 2026 shared a concrete experience: Rodolphe (Thales CDO, the customer), Olivier (SAP, the vendor) and Cyprien (S3NS, the sovereign cloud — a Thales × Google Cloud joint venture). A rare use case: migrating critical processes to a sovereign cloud certified SecNumCloud.

Thales, a typical aerospace and defense company (engineering to order, on customer specification), launched a transformation program built on three triggers.

First, an unprecedented ramp-up: production volumes never seen before, requiring several steps up in operational performance (volumes, deadlines, quality). Then obsolescence: almost every business line has its own ERP, most on SAP ECC, a version set to disappear — a need for technological change that is also an opportunity. Finally a socio-dynamic dimension: engagement surveys point to overly complex, insufficiently harmonized and tooled processes — barriers to engagement and performance that employees themselves ask to address.

The question, Thales notes, contains two: cloud, then sovereign.

Cloud brings performance (compute, redundancy, disaster recovery), access to vendors' most dynamic roadmaps — now focused on the cloud — and to hyperscalers' data, analytics and AI capabilities. For a project migrating many ERPs to a harmonized solution, two paths exist: brownfield (replicating the existing setup with its customizations) or greenfield (designing target processes, without starting from existing technical solutions). Thales chose greenfield, hence standardization and fit-to-standard (SaaS, no customization, to follow vendor roadmaps) — a choice with strong governance and cultural implications, where SAP acts as the locomotive for the entire application ecosystem (PLM, CRM, project management, MES).

Thales's data involves intellectual property and intrinsic sensitivity: even simple supply chain item data can reveal production volumes or capabilities. It must therefore be hosted in a certified SecNumCloud cloud. In this niche, Thales sees very strong momentum in the S3NS offering — a "no brainer" to pull the application ecosystem toward the sovereign cloud.

SAP, at the heart of critical processes worldwide, has pursued a cloud strategy for six years (agility, innovation capacity). Four factors made sovereignty a priority: supporting customers like Thales who couldn't migrate without compliant infrastructure; the geopolitical context (illustrated by the rapid halt of a US technology's distribution); regulatory reinforcement (GDPR, etc.); and the AI wave, which makes cloud indispensable. SAP made sovereignty — which some customers call "autonomy" — a strategic priority, with a €20 billion investment plan announced in late 2025, extended to Australia and the US too. The choice of S3NS was compelling for three reasons: its maturity (already SecNumCloud-certified), the endorsement of a cybersecurity and defense company (Thales), and Thales being both shareholder and customer.

Cyprien recounts S3NS's genesis. The starting observation, five years ago, shared with Google: cloud is becoming the indispensable foundation of transformation, but the three technology leaders (AWS, Microsoft, Google) are American with no European equivalent. Companies adopted these solutions on their non-sensitive scope (often multicloud), but remained reluctant to put their sensitive data there, fearing extraterritorial laws. With France having defined the SecNumCloud framework early, S3NS was created to offer the same Google technology, without compromise, with that certification.

The model is demanding: Google becomes a mere technology supplier, while S3NS secures, operates, commercializes and supports the solution. Three dedicated, physically secured data centers in France, with permanent source-code auditing; the customer has no contractual interface with Google, which no longer controls operations. The SecNumCloud certification — the most demanding from France's ANSSI, with 1,200 control points — was obtained in December. S3NS now has around a hundred customers and sees a clearly accelerating market on scopes deemed sensitive.

Concretely, Thales is already migrating its MES (non-SAP) to S3NS, with a first milestone in mid-2026 deemed "challenging." The method: examining process by process, functional need by functional need, how to tool the solution — favoring the SAP stack (core, extensions, partner solutions), for example SAP IBP for S&OP and integrated supply chain. This applies to every major process area: engineering and configuration management, supply chain, procurement, finance, manufacturing, service.

Historically, PLM and legacy ERP exchanged via nightly batch — a source of limitations. Thales is strongly enriching shared objects and targeting real-time / event-driven integrations, which only cloud solutions make possible.

The project's analogy: no one knows the best-selling car of all time is the Toyota Corolla, because Toyota is first synonymous with a production system and continuous improvement. Thales, very strong on its products, wants to become an aerospace-and-defense reference in how it manufactures. Hence value-based steering (productivity, throughput expected by the market): every choice (IBP, digital continuity) is dictated by the performance level to reach and prepares the foundations of analytics, AI and agentic AI.

Initially designed for regulated sectors (defense, nuclear…), sovereign cloud now interests companies with no regulatory constraint. The keyword becomes autonomy: what happens if a country can withdraw access to a technology (the famous kill switch)? SAP, a European vendor behind critical processes, highlights a European full stack, thus sovereign. S3NS cites varied customers: Thales (first customer), EDF, the European Commission, mutual insurers (MGEN, Matmut, Macif), but also Club Med (protecting customer personal data) and retailers — for whom data localization in Europe conditions AI acceptance. A structuring detail: S3NS is a subsidiary entirely controlled by Thales, a French company, which strengthens the guarantees.

S3NS is already in general availability and certified; the SAP roadmap runs from early 2027 to 2028, with the S/4 core available in early 2027. Over 3-5 years, S3NS targets service equivalence with Google Cloud and AI integration. The next topic is end-to-end sovereignty: integrating partner vendors (PLM PTC…) and, for AI, relying on a European building block like Mistral. S3NS also plans to bring GCP managed services into its infrastructure and has a framework for managing industrial data (IoT, machine) — unstructured data, processed via semantics and ontology — for predictive maintenance and production optimization, tied to Thales's MES migration from 2026.

Quoting Germany's Digital Minister at VivaTech, the speakers conclude: sovereignty doesn't mean isolation, it offers the freedom to choose — avoiding protectionist rigidity while letting companies innovate. The real stake, S3NS stresses, is not forcing companies to arbitrate between competitiveness/innovation and sovereignty/data protection: the longer you wait, the wider the gap.

S3NS is today a region with three data centers in France, accessible from across Europe (subject to latency). The extension to Germany, recently announced, meets a real German market need and, above all, increases resilience: a second region enables redundancy if the three French data centers fail, avoiding any fallback to public cloud that would lose the sovereignty value.

What is sovereign cloud? It's a cloud guaranteeing that sensitive data stays protected from extraterritorial laws and localized within a national or European framework. In France, the reference is SecNumCloud, ANSSI's most demanding certification (1,200 control points).

What is S3NS? S3NS is a joint venture entirely controlled by Thales, operating Google Cloud technology in dedicated data centers in France under SecNumCloud certification. Google becomes a mere technology supplier, with no control over operations.

Is sovereign cloud only for defense? No: initially designed for regulated sectors (defense, nuclear, finance, healthcare), it now interests all sectors, through the lens of autonomy and data protection — from EDF to Club Med to AI-adopting retailers.

Should you migrate everything to a sovereign cloud? No: companies don't put their entire IT scope on a sovereign cloud, only the data and processes they deem sensitive or critical.

This panel was recorded at Tech For Industry Show 2026, the B2B trade show for industrial transformation (Smart Manufacturing, AI, Supply Chain) at Paris Expo Porte de Versailles. Watch the full discussion above, and join us on May 19–20, 2027, Hall 7, for the next edition.