How Soveryne secures and governs its own platform.
The due-diligence answers in one table, stated as they actually stand today. Where something is still in progress we say so rather than rounding up.
Soveryne builds and operates its own platform and orchestration, deployed on infrastructure from European cloud providers inside EU jurisdiction. We do not run our own datacenters.
| Area | Item | Status | Detail |
|---|---|---|---|
| Hosting and jurisdiction | Data location | In place | EU only, in the EU regions you select, in transit and at rest. |
| Key management | In place | Encryption keys held within EU jurisdiction. | |
| AI inference | In place | Runs on EU-sovereign infrastructure and does not leave the EU. | |
| Model training | In place | Customer content is never used to train models. | |
| Infrastructure providers | In place | European cloud providers. The current list is available under NDA during procurement. | |
| Data protection | Controller | In place | Soveryne B.V., Lange Groenendaal 110A, 2801 LV Gouda, KvK 42030650. |
| Data Processing Agreement | In place | A DPA is in place and is signed as part of onboarding. | |
| Sub-processors | In progress | Agreements are in place with every sub-processor. Disclosed during procurement, with notice of changes; a publicly published list is planned. | |
| Data subject requests | In place | Handled by privacy@soveryne.com within the GDPR timelines. | |
| Reporting a problem | Vulnerability reports | In place | security@soveryne.com, under our responsible disclosure policy. |
| security.txt | In place | Published at /.well-known/security.txt on both domains. | |
| Good-faith research | In place | Welcome. We do not pursue researchers who follow the policy. |
Common due-diligence questions
Where is our data stored?
On EU soil, in the EU regions you select, in transit and at rest, with encryption keys held within EU jurisdiction.
Do you run your own datacenters?
No. We build and operate our own platform and orchestration, deployed on infrastructure from European cloud providers. That is what gives us control over jurisdiction and key management.
Is our content used to train models?
No, on any plan. AI inference also runs on EU-sovereign infrastructure and does not leave the EU.
Can we get a DPA?
Yes. A data processing agreement is in place and is signed as part of onboarding.
How do we report a vulnerability?
Email security@soveryne.com. Our responsible disclosure policy sets out what we ask of researchers and what you can expect from us.