Where your agents run.
Most “enterprise AI” deployments quietly stream corporate data through US-based APIs. We don't. Here's the stack we operate — what runs where, and what never leaves the perimeter you control.
Where your data goes — and where it doesn't.
Models
Open-weight and fine-tuned. Llama, Mistral, Qwen, and customer-specific variants. Frontier APIs (Claude, GPT) only when explicitly required for a narrow operation, with data scrubbing enforced before egress.
Hardware
GPU clusters we operate. Physically located in EU jurisdictions. No co-location with US hyperscalers. Capacity scales with deployment volume; we can also deploy on customer-owned hardware when required.
Data path
Your data flows model ↔ hardware inside infrastructure we operate. No cross-Atlantic transfer at inference time. Audit trails written to customer-controlled storage. GDPR-clean by construction, not by paperwork.
Everything that touches your data.
- ●Inference: prompts, completions, intermediate agent state
- ●Embeddings of customer documents and records
- ●Fine-tuning runs on customer-specific data
- ●Audit logs of every agent decision and human override
- ●Quality-gate checkpoints and human review queues
- ●Retrieval indexes and vector databases
Narrow, scrubbed, opt-in.
- ○Frontier model calls for tasks open-weight cannot handle (scrubbed inputs only)
- ○Anonymized telemetry for performance monitoring
- ○Customer-authorized external integrations (CRM, payment, etc.)
- ○Public web fetches when explicitly part of the agent workflow
Egress is logged, audited, and configurable per deployment. The default posture is “nothing leaves.”
The default architecture is unsafe.
Almost every “enterprise AI” integration we audit has the same shape: a polished frontend, careful prompts, a DPA on file, and somewhere in the stack the corporate data is being shipped to servers in US-East-1.
Under EU AI Act provider obligations, GDPR Article 44–49, and the EU's data-sovereignty trend through 2026, that default architecture is becoming the compliance gap regulators look for first.
We don't use it. The stack on this page is what we deploy by default. If your data is sensitive enough that you're reading this page, it's sensitive enough that it shouldn't be on someone else's API.
Deployment on our stack starts with intake.
The intake captures what your deployment requires — data residency, regulatory tier, hardware preference. We respond with a scoped quote.
Start your intake