“Our data stays in the EU” answers one question. The one that increasingly matters is which legal system can compel access to it — and those two answers are not always the same.
Answering only the first and treating the other two as covered is a common gap in AI vendor assessments. They are separate questions with separate answers, and an AI system — which concentrates data from across the organisation — is precisely where the difference starts to matter.
| Criterion | Public API | Cloud region | Private DC | On-premise |
|---|---|---|---|---|
| You choose the country | No | Region | Yes | Yes |
| You choose the building | No | No | Yes | Yes |
| Single tenancy | No | No | Yes | Yes |
| Provider staff can reach it | Yes | Yes | Facility staff physically, under your access policy; logically only with your access | No |
| Third-country jurisdiction applies | Likely | Possibly | Only through any third-party operator you engage | Only through any third-party operator you engage |
| New sub-processor for your customers | Yes | Yes | No | No |
We start by asking which of the three questions your requirement is actually about, because the answer changes the architecture substantially and the requirement as written is often ambiguous. “Data must stay in the EU” is satisfiable by a regional endpoint; “no non-EU entity may be able to compel access” is not, and the two frequently appear in the same policy document.
Then we design so the constraint is structural rather than contractual. A model running on hardware you own, with no egress route, cannot transmit data anywhere — which is stronger than any contractual assurance and considerably easier to evidence. Where a hosted path is acceptable, we pin the region, document the provider's position and make the data flows explicit in the architecture record.
And we write down what leaves. For every system we build, a diagram showing which data crosses which boundary, to whom, under what agreement. That document is what a DPO, an auditor or an enterprise customer's security team actually needs, and producing it as part of the build is far cheaper than reconstructing it under time pressure.
It addresses the transfer question, which is often the hardest single obstacle, and it is not the whole of compliance. Lawful basis, purpose limitation, retention, subject rights and your record of processing remain yours to design. A region setting is one control, not a compliance posture.
They are designed to address the jurisdiction question specifically, with varying structures across providers. Whether a given offering satisfies your requirement is a legal assessment on the specific contract, and we would want your counsel to make it rather than infer it from marketing.
It solves residency, jurisdiction and provider access for the AI component, which is a large simplification. It does not solve the rest of your estate, and it introduces your own operational security as the thing to get right instead. That is a trade most regulated organisations are comfortable making, because it is a risk they already manage.
Residency, jurisdiction and access have different answers and different architectures. We will help you work out which one your policy means.
30-minute technical call · no deck
What we built, what stage it is at, and a link to the live thing wherever there is one.
yourOS is an operating system with an AI at its heart. You talk to it like a person, out loud or typed. It makes your calls, plans your days and works on your projects with a crew of agents, on your own private server. Our own product, built from the first commit; the waitlist is open.
Website, backend and app assets for Sonora, a free AI sound-therapy app on iOS and Android published by Cognitive AI.
Brand, website, prototype, apps on five platforms, the AI backend and the algorithm-intelligence pipeline for Podswap, a social growth engine that runs without a human in the loop.
In closed beta: Roxy, a private AI assistant with permanent memory running on infrastructure the user owns. Brand, site, product, backend and conversational design.
Live at coherence.com: brand identity generated with AI agents we directed, the motion system and website for the group behind Sonora, AboutAI, WakeUp and MudShadows. Agent work remains in build.
Live at domainbooth.com for DomainBooth, a premium domain brokerage: a new animated mark, every page redesigned and rebuilt with designed mobile layouts, and a custom CMS for its sales record, featured names, press and enquiries.
Apps, platforms and campaigns for these teams, long before the AI work. Every one is written up on the work page — what we did, and where our part ended.
