Data sovereignty
Your documents, indexes and vector representations live in the instance and jurisdiction you chose. They are never pooled with another client’s. This is the only line regional hosting guarantees.
Your data, your processing, your models. Under your law.
A private instance that is never shared, the jurisdiction you choose among more than 80 countries, and three deployment modes including on-premise with air-gap support. This page is written to be forwarded to your IT and security teams.
What is data sovereignty?
Data sovereignty means that data, its processing and the models that exploit it remain subject to the law chosen by their owner. Regional hosting is not enough: if the request is processed by a third-party service, the processing falls under another law.
Three layers
Storage is only the first of three questions
Most sovereignty commitments cover only the first line. This is the contrast to put in front of an IT department: where are the files, where does the computation happen, and who owns the model.
Processing sovereignty
Analysis, indexing and generation happen inside your environment. No request containing your content is sent to a third-party service to be processed elsewhere. This is the layer that separates a sovereign architecture from regional packaging.
Model sovereignty
Each client has its own model instance. Your documents do not train a shared model, and what yours learns from you benefits nobody else. Nothing you upload can resurface at a third party.
Deployment
Three modes, according to what your sector requires
Reversibility
The real proof of sovereignty: being able to leave cleanly
An experienced IT department judges a vendor on its exit clause before judging its features. Here is ours, in plain terms.
- 01
Return in a reusable format
Your documents, approved answers, their sources and the approval history, exported in open formats, not a proprietary dump nobody can read.
- 02
Dated and complete deletion
Documents, indexes, vector representations, logs, caches, backups and copies held by our subcontractors: deletion covers all of it, on an agreed date.
- 03
Auditable attestation
A written, enforceable attestation of deletion that your compliance team can file in its own audit records.
- 04
The model does not outlive the contract
Your model instance is deleted with your data. What it had learned from your material remains nowhere.
- 05
If you want to keep the instance
Your data and your answers are yours unconditionally, during the contract and after it. The trained instance is an asset: keeping it is a purchase option, priced in your contract, to be exercised within thirty days of a non-renewal. We write it here rather than let you discover it at the end of the contract: “your models” means they work under your law and for you alone, not that they are transferred to you free of charge on the way out.
Certifications
What is certified here, and what is certified at the host
Optivalue.ai is certified to ISO/IEC 27001
The certification covers our own information security management system: our processes, development, access and authorisations.
The host’s certifications are the host’s
Depending on the region chosen, the hosting infrastructure holds its own certifications, which we document in the pack for your IT team. We do not present them as ours.
You are controller, we are processor
We process your data on your instructions only, with no transfer outside the European Economic Area without adequate safeguards, and notification of any breach without undue delay.
Frequently asked
Sovereignty: eight questions an IT department asks
01
Is regional hosting enough?
No. It protects storage, not processing: if the request goes to a third-party service to be processed, the processing falls under another law. Sovereignty covers all three layers, data, processing, model.
02
Do our documents train a model?
No. Each client has its own model instance: what yours learns from your material benefits no other client, and your documents join no shared training corpus.
03
Where is our data hosted, and under which law?
In the jurisdiction you choose: hosting is available in more than 80 countries, and the applicable law is that of the country selected, written into the contract. In private cloud or on-premise, the location is your own infrastructure.
04
What happens if we leave?
Your data is returned in a reusable format, then deleted on an agreed date, indexes, vector representations, logs, caches, backups and subcontractor copies included, with an auditable attestation.
05
Is on-premise a genuine air-gap?
The on-premise mode is compatible with a physically isolated network: the platform runs with no outbound link. Updates then follow a controlled channel that your security team validates, according to your procedure.
06
Who at Optivalue.ai can access our data?
Nobody in routine operation. Support access is possible at your request, logged and time-limited, within our role as processor: we act only on your instructions and retain nothing after the contract ends.
07
Are you certified, or is it your host?
Both, and the distinction matters: Optivalue.ai, as a software vendor, is certified to ISO/IEC 27001 for its own security management system. The hosting infrastructure separately holds its own certifications, which we document without presenting them as ours.
08
Where is this marketing site hosted?
This marketing site is hosted in France, by OVH SAS, in the Gravelines data centre. It contains no client data. The platform itself is deployed in the jurisdiction you choose: private instance, on-premise, or air-gapped. We would rather write it here than let you discover it: this is exactly the kind of discrepancy a security questionnaire should surface.
Bring your security team to the demo.
It is the best hour you can give them: they will ask the hard questions, and you will know immediately whether the case holds.