Loading the catalogue…
Loading the catalogue…
Compliance posture
Sovereignty ladder · how the level was reached
Stav's assessment · serving-side
OVHcloud AI Endpoints is operated by a French-incorporated entity (OVH Groupe SA) serving inference from named EEA infrastructure (Gravelines, France), with no CLOUD Act exposure and French law/courts governing disputes. The strongest signal is a broad, current, sourced certification base (ISO 27001/27017/27018/27701, SOC 1/2/3, HDS, CSA STAR) combined with a stated zero-retention, no-training default for prompts and outputs. The weakest signal is that OVHcloud's flagship sovereignty credential, ANSSI SecNumCloud, does not yet extend to AI Endpoints/Public Cloud AI as of 2026, undercutting the 'protected against non-EU regulations' marketing claim for this specific product, and the operator's legal entity carries a documented resilience/governance track record (the 2021 Strasbourg fire and resulting court-confirmed data loss) that regulated customers should weigh. Contractual footing is solid — a public DPA and a clear French counterparty exist — though sub-processor disclosure specific to AI Endpoints is absent. On balance this supports sovereign serving for most use cases, but customers with strict extraterritorial-law requirements should treat the SecNumCloud gap as a live condition pending OVHcloud's targeted end-of-2026 qualification extension.
AI Endpoints is described as running on OVHcloud's own sovereign infrastructure at named EEA sites (e.g. Gravelines, France) with no documented non-EEA fallback, though no dedicated sub-processor disclosure specific to this product was found.
Certifications & legal documents
OVHcloud Groupe SA is a French entity under French law/courts with cloud_act_exposure=False, but the ANSSI SecNumCloud qualification that specifically substantiates 'protection against extraterritorial laws' does not yet cover AI Endpoints/Public Cloud AI, leaving the sovereignty claim for this exact product line unproven.
OVHcloud states a zero data retention default for AI Endpoints with no training on customer data, retaining only billing-related information, though this is a vendor claim rather than an independently audited attestation.
OVHcloud holds a broad set of current, sourced certifications (ISO 27001/27017/27018/27701, SOC 1/2/3, HDS, CSA STAR) covering Public Cloud/AI services, but the operator's legal entity has a documented serious incident history (2021 Strasbourg fire with court-confirmed co-located backup loss) relevant to overall operational trust.
A standard DPA is publicly available and the contracting entity (OVHcloud Groupe) and governing law (France) are clearly defined, but no public sub-processor list or explicit SCC/audit-rights documentation for AI Endpoints specifically was found.
Risk assessment
OVHcloud's Strasbourg data centre campus suffered a major fire in March 2021 that completely destroyed the SBG2 facility and damaged SBG1, taking down customer production and backup systems that were co-located in the same buildings. source ↗
RESILIENCEOVHcloud's ANSSI SecNumCloud qualification, which is the basis of its 'protected against non-EU regulations' sovereignty claims, is currently scoped to specific offerings (e.g. VMware Hosted Private Cloud in dedicated Trusted Zones) and, as of 2026, does not yet cover AI Endpoints or the wider Public Cloud AI portfolio — OVHcloud has stated AI services integration into the SecNumCloud stack is targeted for end of 2026. source ↗
GOVERNANCEA French court ordered OVHcloud to pay damages to two customers after the 2021 fire because backup copies were stored in the same building as production data, contrary to stated backup service terms; one case involved OVHcloud further corrupting a customer's recovered backup server via an automated purge script. source ↗
RESILIENCEOVHcloud's own SecNumCloud roadmap confirms qualification is being extended progressively product-by-product across its ~40 Public Cloud products, including 'the most recent AI Solutions', implying AI Endpoints was not qualified at the time of that announcement. source ↗
GOVERNANCEThird-party outage trackers report a large volume of historical OVHcloud incidents across its global component set, though these aggregate figures span OVHcloud's entire product portfolio (hosting, VPS, network, etc.) rather than AI Endpoints specifically. source ↗
RESILIENCESafeguards
OVHcloud states on the AI Endpoints product page that customer data is never used to train or improve its AI models, and that it operates a 'zero data retention' policy, keeping only data required for billing. source ↗
OVHcloud getting-started documentation for AI Endpoints states the platform does not store user data, framing data privacy as a top design priority. source ↗
OVHcloud's launch materials state AI Endpoints runs on OVHcloud's own sovereign cloud infrastructure with data hosted in Europe (Gravelines datacentre near Dunkirk, France) and 'protected against non-European regulations'. source ↗
AI Endpoints exposes only open-weight models (e.g. Llama, Qwen, DeepSeek, Mixtral) which can also be deployed on customer-owned infrastructure or other clouds, reducing lock-in and giving customers a fallback if they distrust the hosted endpoint. source ↗
OVHcloud states AI API traffic uses strong authentication (API keys/OAuth 2.0) and TLS/SSL encryption in transit as part of its AI Endpoints security guarantees. source ↗
OVHcloud has renewed its SecNumCloud 3.2 qualification (ANSSI) across specific datacentres/offerings, described as guaranteeing 'the highest data protection standards for organizations and citizens against extraterritorial laws.' source ↗
Privacy-policy issues
SecNumCloud scope does not (yet) cover AI Endpoints source ↗
Marketing language ties AI Endpoints to OVHcloud's 'sovereign cloud infrastructure' and protection from non-EU regulations, but the underlying ANSSI SecNumCloud qualification that substantiates this protection is currently limited to specific products/datacentres and reportedly excludes AI Endpoints as of 2026.
No public sub-processor list found for AI Endpoints source ↗
No dedicated sub-processor disclosure page specific to AI Endpoints was found during this review; the compute layer is described only generically as running on OVHcloud's own NVIDIA GPU-backed Public Cloud infrastructure in France.