Sovereignty · method

How Evanesca decides that a model runs under European control.

A data centre in Europe does not keep a US law away: the CLOUD Act follows the company, not the server. So before Evanesca adds a model, it checks three things: where it runs, who controls the company that runs it, and what that company keeps. Here is the rule, the five operators — AKI.IO among them, which does not publish its shareholders —, the companies that see part of a request, and every model, one by one.

Facts read at the source on 6 Oct 2026 (OVHcloud, Scaleway), 12 Oct 2026 (Mistral AI, Infomaniak, Linkup) and 13 Oct 2026 (AKI.IO)

The rule: three questions per model

Where does it run?In Europe: in the European Union, or in Switzerland, whose data protection the European Commission recognises as adequate. We take it from the operator's documentation and check it against where the operator's service answers from — today France (Paris for Scaleway, Gravelines for OVHcloud), Mistral AI's EU region, Germany (AKI.IO) and Switzerland (Infomaniak).
Who controls the operator?A European company, with no parent and no control from outside Europe found in what it publishes — legal notice, contracts, site. Location alone settles nothing: a US company's data centre in Frankfurt is still a US company's data centre. This question decides.
What does it keep?Its own rule, published on its own pages and quoted with the source on the passport of every answer. An operator may keep more than Evanesca does — Scaleway in one case, Mistral AI for 30 days to monitor abuse — and the passport says so.

A model joins Evanesca only when the first two answers hold; the third is published, whatever it is. Evanesca then describes it as running “outside the direct reach of the CLOUD Act” — never “out of reach”. The next section explains why.

One case to know: AKI.IO, a German company in Berlin, does not publish its shareholders. Evanesca found no parent outside the EU in its legal notice, its data processing agreement or its site, but cannot say that it has no US parent.

Why a server in Europe is not enough

The CLOUD Act lets US authorities order a provider under US jurisdiction to hand over the data in its possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States (18 U.S.C. § 2713). A US cloud that opens a region in Europe brings its servers there, and its obligations with them.

And “under US jurisdiction” does not only mean “American”. The US Department of Justice puts it this way: U.S. jurisdiction is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons. But neither is U.S. jurisdiction unlimited. (CLOUD Act FAQ, 2019). That is why ownership comes first, and why Evanesca's wording stops at “direct”.

“Europe” means the EU and Switzerland

Every model Evanesca serves runs in Europe — the 17 models of the catalogue: in France (OVHcloud in Gravelines, Scaleway in Paris), in Mistral AI's EU region — Mistral does not say in which country —, in Germany, in the German data centres AKI.IO states it uses, and in Switzerland, in Infomaniak's own data centres. No model call leaves Europe: not as a backup, not when servers are busy. Your messages never leave Europe.

Switzerland is not in the European Union: personal data there falls under its own law, the Federal Act on Data Protection. But the European Commission has decided that Switzerland protects personal data adequately (Decision 2000/518/EC; the Commission's list): it can flow there from the EU without any further safeguard. That is why Evanesca counts it as Europe — and why this page says “outside the EU” next to it.

Some frontier models are run today only by US companies: Evanesca does not offer them. More models will join when a European operator runs them.

The five operators, checked one by one

Every model run in Europe is run by one of five companies — three French, one German, one Swiss. Here is what each is, who controls it, and what it says about the CLOUD Act and your data — in its own words, with the source.

Gravelines, France

OVHcloud — AI Endpoints

Company: OVH SAS, part of OVH Groupe (France)
Controlled by: The Klaba family: 79.0% of the capital and 79.6% of the voting rights on 5 December 2025. source
US parent: None
Presence in the US: Yes, OVH US. Its CLOUD Act FAQ: OVHcloud will comply with lawful requests from public authorities. Under the CLOUD Act, that could include data stored outside of the United States. source
Its position: At OVHcloud in Europe, we are CLOUD Act free. source
Where it runs: hosted and run in the European Union source; at launch, deployed from the Gravelines datacenter source (France). OVHcloud does not state the location model by model.
Prompts kept: Zero data retention: We keep only the data required for billing purposes. source
Training: Your data is never used to train our models source

Paris, France

Scaleway — Generative APIs

Company: Scaleway SAS (France)
Controlled by: A subsidiary of the iliad Group source
US parent: None
Presence in the US: Apparently: the American IP address registry (ARIN) lists a “SCALEWAY INC.” in Wilmington, Delaware. source What it does, if anything, is not known.
Its position: As a European company, Scaleway’s AI services are not subject to extraterritorial laws such as the American Cloud Act. source
Where it runs: Your personal data may be stored in the following region: Paris, France. source
Prompts kept: By default we apply a Zero Data Retention Policy. The exception: when requests cause unexpected errors or look malicious, Scaleway says it may store temporarily and access the full content of HTTP requests, and that Data is stored for up to two weeks source
Training: Your data is not used for training, retraining, or improving the base models. source

EU region · country not published

Mistral AI — its own API

Company: Mistral AI is a French company incorporated in Paris source
US parent: None
Presence in the US: Yes: an office in Palo Alto, California, reported by the press in November 2024. source
Its position: For Mistral Large 4, a European deployment that Mistral operates end-to-end, independently of other digital service providers and under European law source
Where it runs: In its EU region, which Evanesca calls for Mistral Large 4 and Mistral Small 4; Mistral does not say in which country. The preview of Mistral Large 4, trained in Mistral’s own datacenters in Europe, is served on that same infrastructure source
Prompts kept: Except for specific APIs, we keep your Input and Output for the period necessary to generate the Output and then for thirty (30) rolling days to monitor abuse — Mistral Large 4, Mistral Small 4 and dictation included. source
Training: Its policy lists your input and output among the data it may use to train its models, subject to your opt-out: Mistral AI lets its customers object, and Evanesca's account objects, except for what is sent to Mistral Large 4: it is a preview, and Mistral's commercial terms let it use the data of preview models for training, whatever the objection. source For Mistral Small 4 and dictation, Evanesca's promise that your conversations train no model rests on that objection — one of the conditions for opening the service.

Germany · EU

AKI.IO — Inference API

Company: AKI.IO GmbH, in Berlin (Germany), registered with the Charlottenburg commercial register under HRB 281336 B. source
Ownership: Not published: AKI.IO does not publish its shareholders.
Parent outside the EU: None found, not in its legal notice, its data processing agreement or its site. With no published shareholders, Evanesca cannot say that it has no US parent. DPA
Its position: Under the DPA, processing of customer-provided inference data is restricted to the EU/EEA and does not take place in third countries. AKI.IO does not use hyperscaler infrastructure for inference. source
Where it runs: Inference requests are currently processed on GPU infrastructure in German data centers. source Evanesca calls DeepSeek V4.1 Flash, GLM-5.3 and Gemma 4 26B there. For this infrastructure, its list of sub-processors names AIME GmbH (Berlin), which provides the GPUs, and ScaleUp Technologies (Hamburg), the data centre — both in Germany. source AKI.IO confirmed in writing on 13 Oct 2026 that the models it serves run at its highest trust level, in Germany.
Prompts kept: Prompts, inputs, and generated outputs are processed in volatile memory and are not logged, stored, or analyzed by AKI.IO. source Usage metadata — request ID, model called, status, timestamps, tokens — is kept 90 days, according to its privacy policy. source
Training: customer prompts and outputs are not used to train AI models. Model developers do not receive access to customer inference content through AKI.IO. source

Switzerland · outside the EU

Infomaniak — AI Tools

Company: Infomaniak, an independent Swiss company: our teams are based in Geneva (headquarters) and Zurich (branch office)
Ownership: Its reference shareholder is the Infomaniak Foundation, which exercises its shareholder rights for the sole purpose of protecting the company's independence and its ethical mission source
US parent: None
Presence in the US: None found. It says: 100% of our staff work in Switzerland, in Geneva and Zurich, with no outsourcing abroad. source
Its position: A 100% sovereign cloud, free from any non-European influence source
Where it runs: Our AI and GPU services are powered from the heart of Europe in our data centers located in Switzerland source — outside the EU, under an EU adequacy decision.
Prompts kept: Your queries are neither recorded nor used to train models or improve our services. source
Training: The same sentence: queries are not used to train models.

Why “direct”

OVHcloud, Scaleway, Mistral AI and Infomaniak: none of these companies is owned from the United States, so there is no American parent that a US order could compel to hand over their data. But three of them have a foot in the United States — OVH US, a “Scaleway Inc.” in Delaware, Mistral AI's office in Palo Alto —, the Department of Justice reads US jurisdiction broadly, and US authorities can always ask France, Germany or Switzerland for data through mutual legal assistance, which their authorities then handle (GDPR, art. 48, for France). For Infomaniak too, where we found no US presence, “outside the direct reach” is the most we can honestly say. AKI.IO, a German company in Berlin, does not publish its shareholders. Evanesca found no parent outside the EU in its legal notice, its data processing agreement or its site, but cannot say that it has no US parent.

Every model: who runs it, where, and which law can reach it

The rows come from the catalogue: a model that changes operator changes row. Every model Evanesca serves is here, and all run in Europe.

THE CATALOGUE · ALL RUN IN EUROPE
Model	Maker	Run by	Where	Operator controlled from	Prompts kept by the operator	CLOUD Act
Mistral Large 4	Mistral AI	Mistral AI	EU region of Mistral AI	France — Mistral AI, Paris; serves its own EU region	API inputs and outputs, 30 rolling days, to monitor abuse	Outside its direct reach
DeepSeek V4.1 Flash	DeepSeek	AKI.IO	Germany (AKI.IO)	Germany — AKI.IO GmbH, Berlin; shareholders not published	States it logs and stores no prompt or output; usage metadata, 90 days	Outside its direct reach as a German company; shareholders not published
GLM-5.3	Zhipu / Z.ai	AKI.IO	Germany (AKI.IO)	Germany — AKI.IO GmbH, Berlin; shareholders not published	States it logs and stores no prompt or output; usage metadata, 90 days	Outside its direct reach as a German company; shareholders not published
Qwen3.8 27B	Qwen	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
DeepSeek V4 Flash	DeepSeek	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Apertus v1.5 70B	Swiss AI Initiative	Infomaniak	Switzerland (Infomaniak)	Switzerland — independent company, Geneva (outside the EU, EU adequacy decision)	States it records no query	Outside its direct reach
GLM-5.2	Zhipu / Z.ai	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Qwen3.6 35B	Qwen	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Gemma 4 26B	Google	AKI.IO	Germany (AKI.IO)	Germany — AKI.IO GmbH, Berlin; shareholders not published	States it logs and stores no prompt or output; usage metadata, 90 days	Outside its direct reach as a German company; shareholders not published
Mistral Small 4	Mistral AI	Mistral AI	EU region of Mistral AI	France — Mistral AI, Paris; serves its own EU region	API inputs and outputs, 30 rolling days, to monitor abuse	Outside its direct reach
Qwen3.5 397B	Qwen	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
GPT-OSS 120B	OpenAI	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Qwen3 Coder 30B	Qwen	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Qwen3 235B	Qwen	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Mistral Small 3.2	Mistral AI	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Llama 3.3 70B	Meta	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach
Pixtral 12B	Mistral AI	Scaleway	Paris, France	France — iliad Group	No prompt by default; requests that cause errors or look abusive, up to 14 days	Outside its direct reach

Beyond the model: search, images, dictation and the agent

Some features send part of a request to a company other than the model's operator. None of them changes the model's route; each follows its own rule:

Web search — Linkup. Web search is off by default. If you switch it on, the queries the model writes, and the addresses of the pages it reads, go to Linkup — Linkup Technologies, a French company whose registered office is in Fresnes —, never the conversation. Evanesca has not verified where its servers run; its own privacy policy applies. Linkup runs no model, so it gets no stamp.
Images — Infomaniak. The image models run at Infomaniak, in Switzerland, under the same rule as Apertus v1.5 70B: Infomaniak receives the description of the image and, for a portrait, the face photos.
Dictation — Mistral AI. Voxtral Mini, the model of Mistral AI, a French company, receives your recording, 60 seconds at most; Mistral keeps it 30 rolling days to monitor abuse, and lets its customers object to training: Evanesca's account objects.
Agent mode — Evanesca's own servers. The agent's loop runs on Evanesca's servers, on Vercel, a US company, in its Paris region — the host named in the legal notice. Every model it calls runs in Europe; it searches the web only if you have switched web search on — its searches and page reads then go to Linkup —, and its images go to Infomaniak. The agent is therefore exactly as European as the model, the search and the host it uses: no more.

What “hosted in Europe” does not mean

Out of every authority's reach. European, French, German and Swiss authorities can obtain data under their own law, and US authorities can go through mutual legal assistance.
That nothing is kept. Evanesca keeps no copy of your messages, but each operator applies its own rule: Scaleway may keep and read requests that cause errors or look abusive, for up to 14 days, Mistral AI keeps the input and output of its API 30 rolling days to monitor abuse, and AKI.IO keeps usage metadata 90 days — not the content, according to its policy.
That Switzerland is in the EU. It is not: Evanesca counts it as Europe because of the EU's adequacy decision, and says “outside the EU” wherever that applies.
That the model is European. Most of the models are made outside Europe. What is European is who runs them, and where.
That the model is safe. A route says nothing about how a model behaves: that is what the security stamp tests, one of the six checks.
That Evanesca's own servers are European. That is a separate point: the app, the agent's loop and the relay between you and the operator run on Vercel, a US company, in its Paris region, and keep no copy of your messages; the legal notice names the host.

Questions about sovereignty

Does hosting in Europe protect data from the CLOUD Act?

Not by itself. The CLOUD Act reaches providers under US jurisdiction wherever the data is stored, so a US company's European data centre stays within its reach. What puts a model outside its direct reach is a European operator that US law does not reach itself — and, for that to hold, one with no US parent: on Evanesca, OVHcloud, Scaleway, Mistral AI or Infomaniak. AKI.IO, a German company in Berlin, does not publish its shareholders. Evanesca found no parent outside the EU in its legal notice, its data processing agreement or its site, but cannot say that it has no US parent.

Why “outside the direct reach” and not “out of reach”?

Because three of these operators have a foot in the United States — OVH US, a “Scaleway Inc.” in Delaware, an office of Mistral AI in Palo Alto —, US jurisdiction is not limited to US companies, and US authorities can still ask France, Germany or Switzerland for data through mutual legal assistance. Claiming more would be a promise nobody can keep.

Can a model run in Europe be sent to a US company when servers are busy?

No. Every model Evanesca serves runs in Europe, and none has a route outside it: if its operator fails, your request fails instead of being rerouted. No model call leaves Europe — not as a backup, not when servers are busy.

Is Switzerland in the EU?

No. Evanesca counts it as Europe because the European Commission has decided that it protects personal data adequately (Decision 2000/518/EC): data can flow there as within the EU. Apertus v1.5 70B and image generation run there, at Infomaniak; the tables on this page say it is outside the EU, as does the passport of each answer.

Is Evanesca itself subject to the CLOUD Act?

FLEECE AI, the French company that publishes Evanesca, has no US parent and no US subsidiary. But its servers run on Vercel, a US company, in its Paris region: your messages only pass through them in memory, while the answer is written. Evanesca keeps no copy of them, so there is none to hand over to anyone.