Your data stays in Europe

By default, European or open AI models, hosted in the European Union, at no extra cost. We choose the right model for the task, without depending on a single supplier; this choice is documented, justified and open to review, and switching AI supplier is simple. If, for a specific task, the right tool is outside the Union, the exception is written down, justified and approved by you.

The “where your data goes” page, attached to your proposal or your contract, names the providers involved. Your data is never used to train an AI model. If you choose Monitoring, it adapts what is in service when a model changes.

No, never. Your data is never reused to train an AI model: this is written into every one of our projects, and we only use the business offerings of providers that rule out this use. Check this point in writing with any provider: consumer tools, for their part, sometimes allow what your teams enter into them to be reused.

Not in what we put into service, unless you agree in writing. The documents you give us during the project stay in France, on our server. By default, our projects use European or open AI models, hosted in the European Union, at no extra cost. Many solutions go outside Europe by default; our default is Europe. If, for a specific task, the right tool is located outside the Union, the exception is written down, justified and approved by you: for this task, what leaves, where, and why.

Yes, with Sovereignty level 2 (France), offered as an option on Task Automation, the Process Agent, Business Agents and the Company Brain. The AI models and the hosting are in France. We check the whole chain end to end (logs, backups and monitoring tools included), then give you a written commitment on where your data is located, re-checked every year. If moving to a French model calls for adjustments, we redo the settings and the checks: the quality stays as agreed.

Three boundaries your data does not leave, which you choose when you order:

• Sovereignty level 1 (European), included as standard: Europe, with European or open AI models hosted in the European Union;
• Sovereignty level 2 (France), optional: France, with the whole chain checked and a written commitment, re-checked every year;
• Sovereignty level 3 (In-house), on request, after a study: at your premises, on dedicated infrastructure, at your expense.

Any exception outside the European Union is written down, justified and approved by you. The Scoping Meeting and the audits do not process your data in a system: they are what determines the level needed for what follows. AI Assistant Setup sits outside these levels: your data is processed by the provider of the AI tool you choose; the selection note says where, and a European option is always included.

Not necessarily: for most companies, it is not a legal obligation, but a choice or a client’s requirement. The GDPR provides for the free movement of data within the European Union. Some sectors have stricter rules: in France, a provider hosting health data must be HDS certified and store that data within the European Economic Area; state administrations that entrust sensitive data to a cloud provider must choose a SecNumCloud-qualified offer. Processing in France is mainly useful for:

• a business bound by professional secrecy, such as a law firm;
• a company whose client requires it, in a security questionnaire or a call for tenders;
• any business leader who makes it their choice.

It is an option, added once per project and priced in your quote: its price depends on the offer and on the chain to check, from the tools to the backups. On top of this comes the annual sovereignty check, every year.

What you pay for is not the change of model, which is simple: it is the check of the whole chain and the written commitment. Europe, for its part, is included in every project.

From a page attached to your proposal or your contract: “Where your data goes”. It says where each processing operation takes place, which providers are involved, how long the data is kept and what never leaves. You know before signing, and you can check it afterwards. If a provider, whoever it is, cannot give you this document, that is a warning sign.

No. The model is only one link: logs, backups, monitoring tools and other providers may be located elsewhere. Guaranteeing that nothing leaves the country requires checking the whole chain, end to end, then committing to it in writing. That is what Sovereignty level 2 (France) includes, re-checked every year.

Yes, after a study, with Sovereignty level 3 (In-house): your data does not leave your premises. It relies on dedicated infrastructure, at your expense, priced after an architecture study, and comes with the annual sovereignty check. It is offered with the Process Agent, Business Agents and the Company Brain; for standalone tasks, it goes through a Process Agent or Business Agents.

To prove, every year, that your data stays where we committed to keeping it. On the anniversary date, we re-check the whole chain that processes it and give you a written, dated certificate of location. It is mandatory with Sovereignty level 2 (France) or level 3 (In-house) and priced in your quote. Monitoring, for its part, stays the same whatever the place of processing.