We address the security concerns that occur when outsourcing graph data and query evaluation to an honest-but-curious cloud i.e., that executes tasks dutifully, but tries to gain as much information as possible. We present GOOSE, a secure framework for Graph OutsOurcing and SPARQL Evaluation. GOOSE relies on cryptographic schemes and secure multi-party computation to achieve desirable security properties: (i) no cloud node can learn the graph, (ii) no cloud node can learn at the same time the query and the query answers, and (iii) an external network observer cannot learn the graph, the query, or the query answers. As query language, GOOSE supports Unions of Conjunctions of Regular Path Queries (UCRPQ) that are at the core of the W3C’s SPARQL 1.1, including recursive queries. We show that the overhead due to cryptographic schemes is linear in the input’s and output’s size. We empirically show the scalability of GOOSE via a large-scale experimental study.