“Hosted in Europe” is not the same as “processed in Europe”
You are considering handing your internal documentation to a conversational agent. Procedures, template contracts, product guides, sometimes HR material. Before signing, one question deserves a precise answer: where do those documents actually go?
Most vendors answer “we are hosted in Europe” or “we are GDPR compliant”. Both statements are true, and neither answers the question. They describe where the application runs. They say nothing about the route your documents take at the moment the AI reads them.
That nuance is what separates two seemingly identical offers.
The three moments your data travels
1. Import
You upload your files. They are stored somewhere. This is the step every vendor documents, and generally the least problematic.
2. Indexing
Your documents are split and converted into mathematical representations so they can be searched. That conversion is already processing by an AI model — so another place your content passes through.
3. Inference — the journey nobody looks at
This is the decisive step, and the one most often left unsaid. With every question a user asks, the system pulls the relevant passages from your documentation and sends them to a language model so it can write the answer.
In other words: excerpts of your internal documents travel to the model provider, with every question, all day long.
And this is where many “European” solutions stop being European. The application does run in Paris or Frankfurt, but the model it queries is operated in the United States. Your internal procedures cross the Atlantic on every request.
The question to ask any vendor
A single question settles it, and it tolerates no vague answer:
“Which provider operates the model that writes the answers, and in which country?”
If the answer mentions hosting without naming the model provider, the question has not been addressed. Ask for the named list of subprocessors, each with its role and country. Any serious vendor publishes it: under the GDPR that is an obligation, not a favour.
At SophiaDesk: the full list, no grey areas
Our subprocessors are published in our privacy policy. Here they are:
| Subprocessor | Role | Country |
|---|---|---|
| Scaleway | Infrastructure hosting and AI inference | France |
| OVHcloud | AI inference | France |
| Mistral AI | OCR, document analysis and AI inference | France / EU |
| Stripe | Payments and subscriptions | EU |
| Mailjet | Transactional emails | France / EU |
The key detail is the second column: inference runs with French providers too — Scaleway, OVHcloud, Mistral AI. It is not only storage that stays on national soil, it is the processing.
No data transfer outside the European Union. No standard contractual clauses to review, no dependency on an adequacy framework that might later be invalidated: the question simply does not arise.
What we do not do
Just as important as the list above:
- Your data is never used to train a model. Neither ours, nor anyone else’s.
- It is never sold or handed over, to anyone, for any commercial purpose.
- It is never pooled across customers. Your agent answers from your documentation, and from nothing else.
What stays under your control
Sovereignty is not only about geography. It is also about what you get to decide:
- Conversation retention — from 6 months to 10 years, 2 years by default. Beyond that, purging is automatic, every night.
- Allowed domains — your widget only works on the sites you have declared. Nobody can repurpose it elsewhere.
- Documentation scope — you add and remove sources whenever you want; the agent only answers on what you gave it.
- Deletion — removing a document, an agent or an account removes the associated data.
What it changes, depending on who is asking
For a DPO — the processing map fits on one page and requires no outside-EU transfer analysis.
For a CISO — the exposure surface is known and named, with an access scope you define yourself.
For a procurement team — the “hosted and processed in France” criterion is met outright, with no caveat buried in an appendix, which unlocks most public-sector and mid-market evaluation grids.
For an executive team — the topic stops being a risk to investigate and becomes an argument to put in front of your own customers.
Conclusion: ask for the full journey
AI in the enterprise is no longer decided on answer quality alone — that gap is closing. It is decided on what you can state, with evidence, when a customer, an auditor or a data protection officer asks where your documents went.
Ask about the full journey, all the way to inference. On our side, the answer fits in one word: France.
Want to check for yourself? Create your agent for free — no credit card, and no document leaving the country.