AI Processing Location & Operator Access
Why important?
Processing location and operator access determine operational control over AI workloads.
How measured?
Scale 0–5 + N/A:
- 0 = AI processing outside the EU, or operator/third country has access to AI workloads or data.
- 1 = Processing in the EU, but operation/support of the AI platform mainly non-EU.
- 2 = EU processing; operator access not fully excluded.
- 3 = EU processing and EU operation; operator access to AI workloads restricted contractually/technically.
- 4 = EU processing, EU operation and extensive technical exclusion of operator access.
- 5 = EU processing/operation with technical exclusion of operator access (e.g. confidential computing for AI workloads) + verifiable evidence.
- N/A = no reliable evidence
Sources / Evidence
Validation questions (RFP)
- Is operator access to inputs and outputs during inference technically excluded or only contractually restricted? Where does the TLS connection terminate, inside or outside an attested environment, and which attestation (CPU and GPU TEE) can the customer verify itself? Which software images are running, and are changes logged traceably?
Scores comparison
| Provider | Score | |
|---|---|---|
| AWS European Sovereign Cloud | 3.0 | EU processing in the ESC; Nitro/Enclaves reduce operator access; US parent (see legal axis). (stated) |
| IONOS Cloud | 3.0 | EU processing, operated by an EU company operationally separated from IONOS US; technical operator exclusion (confidential computing) not stated. (stated) |
| STACKIT | 3.0 | Processing in DE/AT on own K8s platform; no data disclosure to third parties; confidential computing-capable infrastructure (SEV-SNP/TDX). (stated) |
| OVHcloud Public Cloud (inkl. SecNumCloud) | 3.0 | EU processing; not used for training; technical operator exclusion for AI Endpoints not specifically stated (SGX/SEV on bare metal). (stated) |
| T Cloud Public | 3.0 | GDPR-compliant EU hosting with a data processing agreement; models operated in DE for open models. (evidenced) |
| Oracle EU Sovereign Cloud | 3.0 | Processing in the EU realm (operated in the EU). (stated) |
| pluscloud open | 3.0 | Private, dedicated GPU instance without data outflow; operated in DE. (evidenced) |
| Exoscale | 3.0 | Managed inference on dedicated NVIDIA GPUs in isolated capacity, operated in EU/CH. (evidenced) |
| Scaleway | 3.0 | EU GPU processing; stateless; inaccessible to third parties and model creators; private VPC access. (stated) |
| Delos Cloud | 3.0 | Processing within the DE boundary; Microsoft without general access (security-cleared staff). (stated) |
| noris Sovereign Cloud | 3.0 | Complete tenant separation for managed LLM, operated in DE; confidential computing and AIC4 planned. (evidenced) |
| Cloud Temple Trusted Cloud | 3.0 | SecNumCloud operator exclusion by design; processed data is neither stored nor exploited after processing. (evidenced) |
| Infomaniak Public Cloud | 3.0 | Processing exclusively in CH; ephemeral mode (not storable/retrievable, not even by Infomaniak); encrypted. (stated) |
| Microsoft Sovereign Cloud | 2.0 | Processing in an EU region, but global US hyperscaler control plane; confidential computing for AI not standard. (mixed) |
| UpCloud | N/A | No managed model serving; GPU servers for self-hosting, managed Kubernetes announced. Criterion not applicable. (N/A) |
| Hetzner Cloud | N/A | No managed AI or inference offering; GPU servers for self-hosting only. Criterion not applicable to this offering. (N/A) |
| SysEleven OpenStack Cloud | N/A | No managed model serving; AI via self-hosting on MetaKube / OpenStack GPU. Criterion not applicable. (N/A) |