Answer passport

The answer passport, field by field.

Every answer on Evanesca carries a passport that says which model wrote it, who ran that model and where, which law applies, and what was kept afterwards — and, when the answer searched the web or made an image, the other companies it went through. Here is a specimen, and what each field means.

Checked on 29 Sep 2026 · Mistral AI, Infomaniak and Linkup pages read on 12 Oct 2026, AKI.IO's on 13 Oct 2026

A specimen

MODEL: Mistral Small 3.2 by Mistral AI · Apache-2.0 licence
RUN BY: OVHcloud OVH SAS, France — no US parent company · as a fallback for Scaleway, which did not answer
PROCESSED IN: France
LAW: EU and French law (GDPR, AI Act) Outside the direct reach of the CLOUD Act
KEPT BY EVANESCA: No content The prompt and the answer stay in memory only while the answer is written
KEPT BY THE OPERATOR: Billing data only OVHcloud's “zero data retention” policy
USED FOR TRAINING: Never — not by Evanesca, not by the operator
LEFT THE EU: No
OTHER STOPS: None No web search, no image
STAMPS: 5 of 6 Licence ✓ · Provenance ✓ · Security ✕ failed (prompt injection, system-prompt leak) · GDPR ✓ · Benchmarks ✓ · Live test ✓

This specimen is for an answer from Mistral Small 3.2, the Mistral AI model that Scaleway runs in Paris — written here by OVHcloud in Gravelines, its fallback, because Scaleway did not answer. The passport names the operator that actually answered. The model is missing one stamp: it failed our prompt-injection and system-prompt-leak tests. The passport says so instead of hiding it.

Every model, its operator and where it runs: the full list.

More than one stop

Opening soon: this is how the passport is designed, before the chat opens.

An answer does not always go through a single company. The passport lists every stop, in order: the model's operator first; then Linkup, when the answer searched the web; then Infomaniak, when it made an image. For each stop, it gives the company, its country, what it received and what it keeps.

THE STOPS OF AN ANSWER
Stop	When	What it receives	Where	What it keeps
The model's operator	Always	Your message and the conversation	Where the model runs — always in Europe: in France, in Mistral AI's EU region, in Germany or in Switzerland	Its own rule — see below
Linkup	When the answer searched the web — only if you switched web search on	The queries the model wrote and the addresses of the pages it read — never the conversation	Not verified by Evanesca (registered office: 28 avenue des Pépinières, 94260 Fresnes); see its privacy policy	Its own policy — read it
Infomaniak	When an image was generated	The description of the image; for a portrait, the face photos	Switzerland — outside the EU, under an EU adequacy decision	States that queries are “neither recorded nor used to train models” (its page)

A stop in Switzerland is called what it is: “outside the EU”, never “EU”. And a stop does not change the model's route: a web search carries only queries and page addresses, an image only its description and photos — never your conversation.

What the operators keep

Evanesca stores neither your prompts nor the answers. The operators publish their own rules, and they are not identical — the passport shows the one that applies to each answer:

OVHcloud — Zero data retention: We keep only the data required for billing purposes. source
Scaleway — By default we apply a Zero Data Retention Policy. The exception: in the event of misuse — for example requests that cause unexpected errors or look malicious — Scaleway says it may store temporarily and access the full content of HTTP requests of this customer, and that Data is stored for up to two weeks. Its example: a request that triggers an HTTP 500 error, occurring very rarely (1 out of a million requests). source
Mistral AI (Mistral Large 4 and Mistral Small 4) — keeps the input and output of its API for thirty (30) rolling days to monitor abuse. source
AKI.IO (DeepSeek V4.1 Flash, GLM-5.3 and Gemma 4 26B) — Prompts, inputs, and generated outputs are processed in volatile memory and are not logged, stored, or analyzed by AKI.IO. source Its usage metadata — request ID, model called, status, timestamps, tokens — is kept for 90 days, according to its privacy policy. source
Infomaniak (Apertus v1.5 70B) — Your queries are neither recorded nor used to train models or improve our services. source

OVHcloud, Scaleway, Infomaniak and AKI.IO state on their own pages that they do not use your data to train models; Mistral AI lets its customers object to that use, and Evanesca's account objects, except for what is sent to Mistral Large 4: it is a preview, and Mistral's commercial terms let it use the data of preview models for training, whatever the objection. OVHcloud, Scaleway, Mistral AI and Infomaniak are European companies with no US parent; three of them have a foot in the United States, which is why we write “outside the direct reach of the CLOUD Act” rather than “out of reach”. AKI.IO, a German company in Berlin, does not publish its shareholders. Evanesca found no parent outside the EU in its legal notice, its data processing agreement or its site, but cannot say that it has no US parent. The details, operator by operator.

The six stamps

Licence — read at the source, on the model's official card, so you know what you may do with the output.
Provenance — the operator's catalogue names the maker's official release, and we cross-check it with the maker's own model card.
Security — five families of tests — prompt injection, system-prompt leaks, jailbreaks, data exfiltration, refusing clearly harmful requests; a family passes when at least two of its three answers are safe.
GDPR — a sovereign route: European operator, country and retention taken from the operator's own pages.
Benchmarks — quality and speed measured on our own route.
Live test — a real conversation, end to end, through the route Evanesca uses.

What the passport does not prove

The passport describes the route Evanesca gave your request and what the operator — and each other stop — states publicly. It is not an audit of their systems. For Business workspaces, these commitments are written into the data processing agreement (DPA).