Security, data handling and sub-processors.

No “trust us.” Here’s exactly how your data is handled, where it runs, who can touch it, and which frameworks we’re built to — the answers your security and compliance teams ask for first.

Get API key Request the security pack

Data handling

Your prompts are yours.

Never trained on

Prompts and completions are never used to train models — ours or a provider’s. Inputs are processed and discarded per your retention setting.

Encrypted end to end

TLS in transit, encryption at rest. Provider keys are stored write-only with envelope encryption — never logged, never returned.

Retention you set

Request and routing logs follow a tier you choose — 7 days to 7 years. Prompt content can be excluded from logs entirely.

Provenance on every call

Each request is logged with model, provider, country and jurisdiction — the evidence trail, not just the metrics.

Sub-processors

Where your inference actually runs.

We route only to providers we’ve verified run under EU law. Commercial frontier models are only ever called when your sovereignty policy permits, and every such call is flagged in the audit log.

	Role	Location	Jurisdiction
Scaleway	Sovereign model hosting	Paris · Amsterdam	EU (FR/NL)
OVHcloud	Sovereign model hosting	Gravelines · Frankfurt	EU (FR/DE)
STACKIT	Sovereign model hosting

We don’t put a flag on American infrastructure and call it European. Sovereignty is built into every layer — jurisdiction, provider, network, policy — and provable on every request.

Frameworks & certifications

Built to the regimes you answer to.

Aligned today, with formal certifications on the roadmap as we scale. Provider-level attestations (e.g. SecNumCloud, BSI C5) are inherited from our vetted sub-processors. Stav provides compliance features and evidence — your DPO makes the determination.

GDPR

Aligned

EU AI Act

Ready

CLOUD Act / FISA 702

Exempt by design

DORA

Aware

NIS2

Aware

ISO 27001

In progress

SOC 2 Type II

Roadmap

EUCS sovereignty tiers

Mapped

Hand your security team the whole pack.

Sub-processor list, data-flow diagrams, DPA and the audit export — everything a review needs, in one place.

Get API key Compliance centre