EU data residency by design
Private AI with EU data residency, by design
Sensitive data is routed to models hosted in the EU. Whatever travels to a provider abroad travels sanitised.
Updated
How routing works
Every request is classified before it leaves. If it contains personal data, tax identifiers, bank accounts or any other category you have flagged, the perimeter decides: mask and send, route to a model hosted in the European Union (today, Mistral), or block and warn. You define the policy, per team and per data type.
Why it matters
An international transfer of personal data needs a legal basis and safeguards. When someone pastes a contract into their personal account with a US provider, that transfer happens without anyone assessing it and without leaving a trace. What changes here is less the technology than the fact that the decision becomes deliberate and gets recorded.
Four places, four rules
- 01
On the device
Conversations, encrypted, and the real values that were masked.
- 02
On the server, in the EU
Accounts, policies and the log of each request, without the text.
- 03
Model hosted in the EU
Receives whatever the policy marks as delicate.
- 04
External provider
Only receives sanitised text, with labels instead of data.
Where we are
Still in pilots. The catalogue of European models, and the data processing agreements with each provider, are being closed with the first companies and will be published here once signed.
What each destination sees
A model hosted in the EU can receive the full request when the content must not leave the perimeter. A provider abroad receives text that is already masked: the contract of CLIENT_1 and the payment to IBAN_1, without the real name or account. The real values stay on the person's device and are restored there when the answer comes back.
A double check
Masking happens first on the device, before sending. Then the gateway detects again in case the client is out of date or tampered with, and applies the stricter of the two actions.
Where the data is kept
Accounts, policies and the usage log live on EU infrastructure. Chats are not stored on our servers: they are kept encrypted on each person's device, and the server keeps metadata only.
Official sources
General Data Protection Regulation (GDPR), Regulation (EU) 2016/679: official text on EUR-Lex.
Transfers of data outside the EU are governed by Chapter V (Articles 44 to 49) of the GDPR.
Frequently asked questions
What does it mean that data stays in the EU?
Sensitive data is sent to models hosted in the European Union, and our accounts, policies and usage log are hosted in the EU. What travels to a provider outside the EU does so masked.
Can I stop a team from using models outside the EU?
Yes. Whoever administers the platform chooses which models are enabled and what happens to each data category: allow, mask or block. The policy is applied at the perimeter and does not depend on what each person does.
Is this enough to comply with the GDPR?
No tool complies with the GDPR for you. Acotia reduces the risk of unassessed transfers and records every decision; the legal basis, supplier contracts and impact assessments remain the company's responsibility. We are closing data processing agreements with the first companies.