Data sovereignty check: who can access your AI data?
Four questions on platform, language model, operations and proof. Then you see your data path, how many of the four tests for sovereign AI you pass and what you can change: no vendor list, only the facts of your setup.
Not legal advice · as of 13 October 2026
Your data path and the four tests.
Answer the four questions above. Your data path, the result of the four tests and the next steps then appear here.
Email me the result
Optional: we send you the result. Otherwise your answers only stay in your browser.
What does data sovereignty mean for AI?
Data sovereignty means: you decide where your data sits, who can access it and which law it is subject to. With AI two questions are added: where do questions and passages go when the language model answers? And can you prove what happened to the data?
A data centre in the EU is a start, but not enough. If the provider is also subject to a third country’s law, authorities there may in some cases demand access, even to data in the EU.
Four tests for sovereign AI.
Data
Documents, search index and histories sit in an environment you own or fully control.
Model
You choose the language model yourself and can use one that never leaves your network.
Operations
Nobody but you accesses the running system, and it runs without telemetry.
Proof
An audit log records what happens, and every answer names its source.
How typical ways of running AI score.
| Test | Provider outside the EU, EU region | RAGSuite Engine | RAGSuite self-hosted |
|---|---|---|---|
| Data | partly | partly | ✓ |
| Model | partly | partly | ✓ |
| Operations | no | partly | ✓ |
| Proof | partly | ✓ | ✓ |
Categories, not specific providers. Scored as on the digital sovereignty page, as of 13 October 2026.
More control in three steps.
First: for every provider, check seat, parent company, data centre and sub-processors: the location check helps. Second: separate content by protection need and run confidential applications on your own servers. Third: choose a local language model for sensitive projects.
Document the result in your record of processing activities and repeat the check when providers, contracts or models change. That keeps your assessment current and verifiable.
Questions about the data sovereignty check.
What is data sovereignty?
Data sovereignty means a company decides for itself where its data sits, who can access it and which law it is subject to. With AI this also covers where questions and passages go for the language model, and whether it can be proven what happened to the data.
Is a data centre in the EU enough?
It is an important step, but often not enough. It also matters where the provider and its parent company are based. If a provider is subject to a third country’s law, authorities there may in some cases demand access, even to data in the EU. So always check the seat and sub-processors as well.
Why does the check not name providers?
Providers, regions and contracts change all the time, and every contract is different. So the check asks about the characteristics of your setup instead of names. That gives you a result that fits your actual setup. For individual providers, use the AI provider location check.
How sovereign is RAGSuite Engine?
In the RAGSuite Engine, platform and data sit in a data centre in Germany, run by RAGSuite, which is based in Germany. Audit log and sources make every answer checkable. Because we run it and no local model is possible, data, model and operations pass only partly. Running it yourself gives full control.
Are my answers stored?
No. The check runs in your browser and sends nothing to a server. Your answers disappear when you close the page. If you want to keep the result, you can have it emailed to you. For that we need your address and your consent, nothing else.
Pass all four tests, on your own servers.
Install the Community Edition or talk to us about Enterprise, local models and running without internet.