Scan the whole posture in a minute — every control, every vendor, and every limit we own.
One line per control, one chip per line. Live means in place today; in progress means being put in place; not yet means we do not have it.
On the self-assessment: we assess against the European Commission's Cloud Sovereignty Framework v1.2.1 with the Commission's own calculator. We publish no level and no score while the assessment is mid-remediation — the framework's overall level is the minimum across all 48 criteria, so one open gap decides the number and tells you nothing about the architecture. Evaluating us now? Ask for the working draft, red parts included.
scripts/check-retention.sh greps the gateway, control plane and
dashboard for anything that could write content, and fails the build on a hit.
== NativeKloud zero-retention check ==
Scanning: gateway/ control/ dashboard/
# store_prompts_in_spend_logs: true → hazard, build fails
# turn_off_message_logging missing/false → hazard, build fails
# success_callback / failure_callback set → hazard, build fails
# langfuse|datadog|sentry|helicone|... → hazard, build fails
# log(...messages|prompt|content...) → hazard, build fails
== PASSED: no zero-retention hazards found ==Stated with its limit: this is a static audit of our own source, not a third-party attestation. It proves the code cannot casually acquire a retention path and makes any attempt to add one visible in a diff — see what we do not claim.
Three hops, all inside the EU, all operated by us. The only thing that leaves the request path is a count.
The whole dependency list, not only the parts that see your data — ownership is what the CLOUD Act follows.
| Vendor | Role | Country | What it can see |
|---|---|---|---|
| Scaleway | Control node hosting (gateway, dashboard, usage database) and hourly GPU inference nodes | FR 🇫🇷 | Operates the physical machines. Prompt content is processed in memory on these machines and never stored; the hosted database holds accounts, keys and token counts. |
| Hetzner | Steady-state GPU nodes and the standby control node | DE 🇩🇪 · FI 🇫🇮 | Same as above — infrastructure operator for machines we run. No separate data access. |
| OVHcloud | Object storage for database backups and write-ahead logsPlanned | FR 🇫🇷 | Encrypted backups of the account and usage database. No prompt or completion content, because none exists to back up. |
| Gandi | Domain registrar and authoritative DNS | FR 🇫🇷 | DNS records and query traffic for our own domains. No account data, no request content. |
| RcodeZero | Second authoritative DNS operator, for DNS resiliencePlanned | AT 🇦🇹 | Same as above: our zone data and query traffic only. |
| Scaleway Transactional Email | Delivery of magic-link sign-in and account emails | FR 🇫🇷 | Your email address and the contents of the account emails we send you (sign-in links, billing notices). No request content. |
| mailbox.org | Our company mailboxes — human correspondence, support | DE 🇩🇪 | Whatever you choose to put in an email to us. Please do not email us prompts you care about; open a support thread describing the request instead. |
| Mollie | Payment service provider for credit top-ups and invoicesPlanned | NL 🇳🇱 | Billing identity, payment instrument and amounts. Card data goes to Mollie, never to us. No usage detail beyond the invoiced total. |
| Let's Encrypt (ISRG) | TLS certificate issuance for our public hostnamesUS-based | US 🇺🇸 | Domain names and public keys, and nothing else — no request content, no account data, no end-user data. Since Let's Encrypt stopped publishing OCSP responder URLs in May 2025, your client makes no revocation call to them either, so no end-user traffic reaches a US party. |
The one US-based name on this list, stated plainly. Let's Encrypt is operated by ISRG, a US non-profit, and it is our certificate authority at launch. A CA sees the names on a certificate and its public key; it never sees traffic, prompts or customer records. We treat the issuer as a configuration value, and we are migrating to Actalis 🇮🇹 as primary with Certum 🇵🇱 (Asseco, Gdańsk) as the negotiated fallback.
Not on this list, deliberately: no US cloud, CDN or DNS proxy; no analytics or error-tracking SaaS; no third-party identity provider or social login; no Stripe; no remote fonts. Billing runs on Lago, open-source software we host ourselves rather than a vendor with access to anything. Rows marked Planned are contracted design for launch, not yet in production. GDPR Article 28 data-processing agreements with audit rights are being put in place with every vendor above, and the current list ships in writing with the DPA. Our own source code and documentation sit on GitHub (US-owned) — no customer data touches it, so it is not a subprocessor, but it is a gap in our development chain and moving to an EU forge is committed work.
The fastest route to being trusted by someone whose job is scepticism is to hand over the counter-arguments first.
Everything on this page is self-declared and evidenced. We hold no ISO 27001, no SecNumCloud and no Common Criteria evaluation, and we say so in a tender document as readily as here.
Data processing agreement, technical and organisational measures, subprocessor list, retention per data type, audit rights.
Request itPer-million-token prices in euros, machine-readable, same numbers as the pricing page.
OpenThe check script above and the gateway configuration it inspects, in our source repository.
View sourceIf this page does not satisfy your review, we would rather hear it than lose the deal quietly. The reply comes from the person who built the thing.