What is a sovereign AI platform for a company?

A sovereign AI platform is a platform about which the company knows, with proof in hand, where its data runs, who operates it and what it is used for. For AI agents, this is checked on five points: hosting, the operator, model training, access rights and the audit log. The word itself cannot be checked: any vendor can write it on their home page, and we write it on ours. So rather than defend it, we would rather replace it with five questions whose answers can be read on a quote, a contract or during a demonstration. We answer them along the way, so that you can judge us the same way.

A word everyone writes

“So where are your servers?” It is often the first question of a first meeting, before the price. According to Insee, 18% of companies with 10 or more employees based in France use at least one AI technology in 2025, and 58% of those with 250 employees or more. The preference for nearby providers can be measured too. In a Gartner survey run from May to July 2025 among 241 CIOs and IT leaders in Western Europe, 61% of respondents expect geopolitics to increase their reliance on local or regional cloud providers. Rene Buest, Senior Director Analyst at Gartner, gives the reason: “Many Western European organizations can’t run all of their workloads or core systems in a non-European cloud environment. This is either because they are subject to specific regulations, their customers demand it, or they are considered part of a country’s critical infrastructure.”

We write that word too, and here is the exact sentence from our website: Scalt is a French platform for governed, sovereign AI agents. It lets mid-sized and large companies deploy AI agents on their own data, with human approvals and an audit log. Data is hosted in a cloud in France and is never used to train models. Scalt is designed for GDPR and AI Act compliance. Read like that, this description is worth no more than any other vendor’s. What sets it apart, or not, is found in documents and in a few tests you can run yourself.

Where the platform, the documents and the backups run

An agent platform does not keep your data in one place: the application, the documents read, the index, the backups, the logs and, for every answer, a call to a model. Each of these can live in a different country, with a different subprocessor. “Our servers are in France” answers for the first and says nothing about the others.

The document that answers is the DPA, the data processing agreement, with the list of subprocessors and their location. If the vendor cannot hand it over before signature, or points you to a web page instead, the question stays open. At Scalt, the platform is hosted in a cloud in France, across two regions, and your documents and their backups are stored there with it. The DPA, the list of subprocessors and the security measures are shared under NDA.

Who operates it, and under which contract

Hosting and operating are two different things, and often two different companies. A platform can run in a data centre in France and be administered from elsewhere, by a team with access to the machines, the backups or the logs. So ask for the operator’s name, where the teams with technical access are located, the subprocessors to whom that access is delegated, and how it is limited and logged.

Here again, the answer is contractual: the DPA names the processor and its own subprocessors, the security policy describes access, and a certification attests that a third party has checked those rules. At Scalt, the platform is operated by Scalt, access to data is limited and logged, and our ISO 27001 certification is underway.

Your data and the models

An agent does not answer on its own: it calls a language model, most often supplied by a third party. This is where sovereignty is lost most quietly, because the call is invisible to the user, and nobody thinks to ask about it in a demo. Three questions are enough.

• Training: is your data used to train the models? The right answer is a written commitment in the contract, which also covers the model providers’ terms. A sentence on a product page is not one.
• Personal data: what does the model actually receive? Ask what happens between the user’s question and the call, and have them show you an example.
• Providers: who chooses them, you or the platform? You must be able to pick the ones you approve, and switch the day you decide to.

Our answers fit in three lines: your data is not used to train models, per our contractual commitment and our providers’ terms; personal data is anonymised before the model call; and model providers are chosen among those you approve.

Who sees what

A platform can be hosted in France and train no model, and still let an agent read a document it should not have read. Sovereignty is also played out inside the company: an agent connected to your email, your drive or your CRM must not see more than the person using it. Each source’s rights must therefore be kept by the platform, and applied when the agent searches, not only when it answers.

The evidence is a test rather than a document: two users with different rights ask the same question, and the answers have to differ. Also ask whether data access is logged. At Scalt, each agent reads only what it is allowed to read, following the access rights of your sources, and access to data is limited and logged. Our guide to choosing an agent platform goes into both criteria.

The log, reversibility and installing it on your side

Knowing where your data is and who sees it is not enough if you can neither reconstruct what was done nor leave. The audit log must contain, for every execution, the request, the sources read, the tools called, the approvals and the result, and export to your own tools. A trace you can only consult in the vendor’s interface belongs to them more than to you.

Reversibility is negotiated on the way in: what you get back, in which format and within what time, and when your data is deleted, written in the contract. Finally, a platform that only runs at its vendor’s limits your future choices; ask whether it can be installed on your side. At Scalt, the governance log is exportable, you get your documents and your case history back under terms and timelines written in the DPA, and Scalt can also be installed on your premises or in your own cloud.

The grid to send to the vendor

The five questions, and the evidence we would ask of any vendor, ourselves included. Copy it into your next tender; a spoken answer does not count.

Our answers appear, point by point, on our security page; the contractual detail comes with the DPA, for your legal and security teams.

Frequently asked questions