In a bid to guarantee the country's "digital sovereignty," the French government chose to promote the French-made instant messaging app Olvid. In an order dated November 22, the prime minister's office asked members of the government and their advisers to "deploy [Olvid] as a replacement for any other" apps, such as Signal and WhatsApp, by December 8, "in order to ensure the security of conversations and information shared."

The decision gave a boost to the messaging service, created in 2019 and until now relatively confidential. One week later, Minister for Digital Affairs Jean-Noël Barrot described Olvid as "the most secure instant messaging service in the world."

But after the publication of two critical articles – by the website L'Informé, on December 8, and the newspaper Le Canard Enchaîné, on December 13 – questions have arisen over the judiciousness of the French government's choice.

Le Canard Enchaîné pointed out that the app is hosted by Amazon Web Services (AWS), and is therefore subject to US extraterritorial laws. This was not a secret: It is mentioned in the documentation available on Olvid's website. But given that the government has constantly been saying that it wants to favor French or European hosting solutions, the choice of Olvid could raise eyebrows.

In its May 31 update to the "doctrine for the use of cloud computing by the French state," the government decreed that "particularly sensitive" data should be "immune to any extra-EU regulation," and hosted "by solutions with SecNumPlus qualification issued by the ANSSI," the French National Agency for the Security of Information Systems. This is not the case for AWS. However, in her November order, the prime minister exempted Olvid from this obligation, arguing that the data transiting through AWS servers "is end-to-end encrypted" and "deleted as soon as a message is delivered."

Thomas Baignères, the company's CEO and one of its four founders, has continued to defend the quality of Olvid's service. The messaging service differs from its competitors in that it also secures message confidentiality, encrypted from end to end, but adds a layer of authentication for correspondents. Therefore, Olvid does not use a centralized directory – which could suffer a security breach – but offers unique authentication keys to each of its users. The company itself has no access to its users' personal data, since they don't need to leave their telephone number or e-mail address to sign up.

You have 40% of this article left to read. The rest is for subscribers only.