EU-sovereign AI platform.

What 'EU sovereign' really means

EU sovereign AI is more than 'EU region' at US cloud providers. Real EU sovereignty requires four layers: first EU company as provider (legal entity under EU law, not US subsidiary); second EU hosting infrastructure (servers in EU member state, not US cloud region); third LLM processing in the EU (inference on EU servers, contractually guaranteed, no training on customer data); fourth a full DPA per GDPR Art. 28 with a transparent subprocessor list. With US hyperscalers point one is already difficult: the parent corporations are subject to US law, such as the CLOUD Act. 'EU region' just shifts the server location, not legal sovereignty.

Schrems II + GDPR Art. 28, the legal reality 2026

The Schrems II ruling of the European Court of Justice in 2020 struck down the Privacy Shield and requires an equivalent level of protection for transfers to third countries. In its Recommendations 01/2020, the European Data Protection Board described what supplementary measures can look like. Since July 2023, the adequacy decision on the EU-US Data Privacy Framework has applied to certified US providers, and the General Court of the EU upheld it in September 2025. Transfers to such providers are therefore permitted, but they depend on a decision that is politically and legally contested. If you process in the EU from the start, you don't need this basis: no third-country transfer, no transfer impact assessment for this part.

AI Act Art. 50, transparency obligation from 02 August 2026

Article 50 of the EU AI Regulation 2024/1689 obliges providers from 02 August 2026 to disclose AI interactions with end customers. People must be clearly told, at the latest at first contact, that they are interacting with an AI. The regulation leaves open how this is done; common practice is an announcement on the phone, a visible notice in chat and a notice in the text of an email. Violations can incur fines up to €15 million or 3% of global annual turnover. At rinqo the notice is set up by default: built into chat and email, and on the phone part of the preset greeting.

rinqo's full EU stack in detail

Hosting: servers in Germany with a German provider, DPA per GDPR Art. 28. App, API, database, vector database, queue and speech service all run there. Backups are stored encrypted in the EU. Telephony: a provider based in Ireland. Language model: AI models with contractually assured EU data processing (no training on customer data), plus a European fallback provider that takes over if there is an outage. Speech recognition: a provider processing in France, with a DPA. Speech output: a German provider, processing in the EU. The categories are listed on /security, and the list of sub-processors with names is in the dashboard.

When EU sovereign is mandatory, and when not

An EU provider is not required by law: the GDPR allows transfers to third countries under the conditions of Chapter V, for example with an adequacy decision or standard contractual clauses. Processing in the EU makes particular sense where data is especially protected: health data, client confidentiality, financial data, anything under professional secrecy. At rinqo, these areas also come with the following: for health data you sign a supplementary agreement before going live, and professional secrecy is covered by Section 10 of the DPA. Applications without personal data, such as anonymous FAQ bots on marketing pages, are less critical.

Digital sovereignty: why server location became a board-level issue

Digital sovereignty means you control who can access your company data, and under which jurisdiction. For years this sat with the IT department. The US CLOUD Act moved it to the boardroom: US authorities can compel US providers to hand over data, regardless of where the servers are located. A data centre in Frankfurt offers no protection if your contracting party is a US corporation. That is why server location is now decided by management, not just by IT. In practice, digital sovereignty comes down to three criteria. First, EU servers: your data is processed and stored on servers within the EU. Second, an EU contracting party: your DPA counterpart is subject to European law, not the CLOUD Act. Third, exit capability: you can export your data and switch providers without bringing your business to a standstill. If any one of the three is missing, your sovereignty has a gap, no matter how the marketing sounds. For AI systems this weighs twice as heavily, because phone calls, chats and emails containing customer data run through the system. So ask every provider about exactly these three points. At rinqo, the answers look like this: servers in Germany in data centres with ISO 27001 certification, a DPA under Art. 28 GDPR, language-model processing contractually assured within the EU. Your data is not used for model training. The entire stack is documented, every component listed with its provider and region.

• EU servers: processing and storage on servers within the EU
• EU contracting party: your DPA counterpart is subject to European law, not the CLOUD Act
• Exit capability: exportable data, provider switch without operational standstill

Local AI vs the European cloud: the realistic choice for SMEs

For most SMEs, the European cloud is the practical route to GDPR-compliant AI. Local AI, meaning your own language models on your own hardware, is the maximum form of control: no data leaves the building, no external contracting party, no third-country question. Honestly assessed, that control comes at a price. Capable language models need GPU servers, and you carry the purchase and electricity costs yourself. Add operations, monitoring, model updates, security patches and the staff who take permanent responsibility for all of it. A phone agent additionally demands real-time operation and telephony integration, which is continuous operations, not a weekend project. Local AI therefore pays off mainly for businesses with their own IT team and specialist requirements. The European cloud delivers the sovereignty benefits without that operational burden: EU servers, an EU contracting party, a DPA under Art. 28 GDPR, and the provider handles operations and updates. rinqo deliberately chose this route. The servers are in Germany, in data centres with ISO 27001 certification. Language-model processing runs contractually assured within the EU, with no training on your data. A European fallback provider takes over if there is an outage. We guide you through setup; in chat and by email the agents work in 17+ languages, on the phone in your main language and in English. The sober calculation is: full control versus predictable operations. For phone, chat and email in everyday SME work, the cloud wins almost every time.