Where your data lives, where your AI runs: providers, locations, options and commitments.
Last updated: 29 October 2026
Before an AI feature is switched on, technology, security, privacy and procurement teams ask two questions: where is our data stored, and where is it processed when AI is used? This document answers both, in detail. The principles that govern DiliTrust AI, including model training, human review, access control and audit, are set out in the DiliTrust AI Code of Conduct. This document describes how they are implemented: providers, locations, options and commitments. It applies to Contract Lifecycle Management, Board Portal, Legal Entity Management, Matter Management and Documentation Library.
On this page
Two layers, decided separately
Layer 1
Hosting
Where your data is stored and operated. It follows your region: the business modules, the database and your documents stay with the same hosting provider, in the same geographic zone.
Layer 2
AI processing
Where an AI request is processed when you use an AI feature. It follows the configuration recommended for your needs, independently of where you are hosted.
Our core commitment: Your data at rest, database and documents, stays in its hosting zone. When you use an AI feature, the content to be analysed is sent to the AI layer for the duration of the processing, and the response is returned to DiliTrust.
Two ways to run Lini
In both configurations the DiliTrust legal intelligence layer and its controls stay the same. What changes is the model, and who processes the request. Two more options, C and D, are available on request: see Layer 2.
Data storage
DiliTrust infrastructure, in your hosting region
In both configurations, customer documents remain stored here.
DiliTrust-managed frontier configuration
Model
Leading frontier model
Selected for quality and fit
e.g. GPT, Claude or Gemini families
AI processing
By Google Cloud
Under DiliTrust's contract
The response is returned to DiliTrust
Sovereign configuration (DiliTrust-managed, EU-based)
Model
Open-weight model
For sovereignty, residency or contract requirements
Operated within the DiliTrust perimeter
AI processing
By DiliTrust
Within the DiliTrust perimeter
On dedicated servers in France
Two ways to run Lini: frontier configuration by default, processed by Google Cloud; sovereign configuration on request, processed by DiliTrust in France. Data is stored on DiliTrust infrastructure in both.
Layer 1 · Hosting providers by region
Each region has a default hosting offer, and DiliTrust directs you to it. Modules, database and documents always stay with the same provider, in the same zone.
Offer
International cloud
Provider
Google Cloud
Data centres
United States, Canada, Europe, Saudi Arabia
Who it is for
Customers in the United States, Canada and Saudi Arabia, each hosted in their own region
Status
Offer
Sovereign Europe
Provider
OVHcloud
Data centres
France
Who it is for
European customers, whatever their country
Status
Offer
Sovereign high security
Provider
S3NS
Data centres
France
Who it is for
European customers requiring SecNumCloud-qualified infrastructure
Status
Offer
Sovereign UAE
Provider
Etisalat (e&)
Data centres
United Arab Emirates
Who it is for
Customers in the UAE
Status
Offer
Sovereign Morocco
Provider
DXC / Inwi
Data centres
Morocco
Who it is for
Customers in Morocco
Status
Stated upfront: Canada, UAE, Morocco and Saudi Arabia
Your data is hosted in the country. AI processing is not currently available locally. If you activate AI features, the content to be analysed is processed outside the country for the duration of the processing, then returned: in Europe or the United States, at your choice, for option A; in France for option B. Your data at rest stays in the country.
Certification scope
ISO 27001ISO 27701SOC 2GDPR
The DiliTrust solution as a whole is certified to ISO 27001, ISO 27701 and SOC 2. There is currently no certification specific to the AI solution. These certifications do not replace a customer-specific review of the provider, data path, region or contractual commitments. DiliTrust does not claim automatic compliance with the EU AI Act.
Activating an AI option can require adding the AI provider to the sub-processors listed in your contract. Your account team manages this update.
Layer 2 · AI processing
Layer 2 decides where an AI request is processed. It is chosen independently of hosting. Three types of processing are involved: the language model, which understands and generates text; OCR, which reads text in scanned documents; and embedding, which turns text into vectors for search. Orchestration, retrieval, playbooks and the controls around the output stay in the DiliTrust legal intelligence layer in every option.
Option in this document
A · Frontier models via Google Cloud
AI Code of Conduct configuration
DiliTrust-managed frontier configuration
Availability
Option in this document
B · Sovereign AI operated by DiliTrust
AI Code of Conduct configuration
Sovereign configuration
Availability
Option in this document
C · Specialised sovereign provider
AI Code of Conduct configuration
Variant of the sovereign configuration
Availability
Option in this document
D · Bring Your Own LLM
AI Code of Conduct configuration
Variant: customer-supplied model
Availability
Layer 2 · The four AI processing options
DiliTrust recommends one option and documents it for your environment. Commitments are stated per option, because they depend on who operates the model and who holds the contract.
A · Frontier models via Google Cloud
AI Code of Conduct: DiliTrust-managed frontier configuration
What it is
Leading frontier models accessed by DiliTrust under its own contract, on a pay-as-you-go basis. Examples may include GPT, Claude or Gemini families, subject to the customer environment.
Operated by
Google Cloud runs the model, through Model Garden, on Google's shared infrastructure. DiliTrust selects and configures the model and holds the contract.
Processing covered
Language model, OCR and embedding.
Location
Europe or the United States, at your choice. No local AI processing in Canada, the UAE, Morocco or Saudi Arabia.
Commitments
- The provider does not use customer data to train its model.
- Zero data retention: no customer content is kept once processing is complete.
- The response is returned to DiliTrust.
- Encryption in transit and at rest; logging limited or disabled at the AI provider layer.
To be aware of: Processing is operated by a non-European provider, in Europe or the United States.
B · Sovereign AI operated by DiliTrust
AI Code of Conduct: Sovereign configuration
What it is
Open-weight models, whose parameters are public, deployed and operated by DiliTrust teams. Model names are not published because the deployed models change as DiliTrust evaluates them.
Operated by
DiliTrust, on NVIDIA GPU servers rented from OVHcloud and Scaleway, two French providers. The servers are dedicated to DiliTrust and not shared with their other customers. Scaleway infrastructure is SecNumCloud-qualified.
Processing covered
Language model, OCR and embedding.
Location
France, for every hosting region, including customers hosted outside Europe.
Commitments
- Processing is carried out within the DiliTrust perimeter.
- Zero data retention: no customer content is kept once processing is complete.
- Encryption in transit and at rest; logging limited at the AI processing layer.
To be aware of: High quality, below the level of the best models on the market. Capacity is sized and validated against your volumes.
C · Specialised sovereign provider
AI Code of Conduct: Variant of the sovereign configuration
What it is
An AI service operated by a recognised European provider, for example Mistral AI for language or OCR.
Contract
Held by DiliTrust or by you, depending on the setup agreed.
Processing covered
Language model or OCR, depending on the service.
Location
European Union.
Commitments
- When DiliTrust holds the contract, retention, logging and training terms are those of DiliTrust's contract with the provider, confirmed for your environment.
- When you hold the contract, DiliTrust does not control the provider and cannot guarantee those terms: they are governed by your contract with the provider.
To be aware of: Assessed and set up case by case.
D · Bring Your Own LLM
AI Code of Conduct: Variant: customer-supplied model
What it is
DiliTrust uses a language model provider that you already contract or host. It must expose an API compatible with the OpenAI standard.
Scope
Language model only. OCR and embedding run on option A or B.
Contract and cost
Yours, directly with your provider.
Quality and capacity
Depend on your provider.
Commitments
- DiliTrust does not control your provider and cannot guarantee its retention, logging or training terms: these are governed by your contract with that provider.
- On the DiliTrust side, storage, access control and application controls continue to apply.
To be aware of: Compatibility is checked before activation.
The four options compared
A · Frontier
Model operated by
Google Cloud
AI quality
Maximum
Capacity and volumes
Very high
Processing location
Europe or United States*
Sovereignty
Non-European operator
Processing covered
Language model, OCR, embedding
Contract
DiliTrust
Retention, logging, training terms
Zero data retention, under DiliTrust's contract with Google Cloud
Setup
Standard
B · Sovereign
Model operated by
DiliTrust
AI quality
High, below the best market models
Capacity and volumes
Sized, validated against your volumes
Processing location
France, dedicated machines
Sovereignty
French, operated by DiliTrust
Processing covered
Language model, OCR, embedding
Contract
DiliTrust
Retention, logging, training terms
Zero data retention, operated by DiliTrust
Setup
Standard, on request
C · Specialised
Model operated by
The provider
AI quality
Depends on the service
Capacity and volumes
Depends on the provider
Processing location
European Union
Sovereignty
European
Processing covered
Specific service
Contract
DiliTrust or you
Retention, logging, training terms
Set by the contract holder
Setup
Case by case
D · Your LLM
Model operated by
Your provider
AI quality
Depends on your model
Capacity and volumes
Depends on the provider
Processing location
Depends on your provider
Sovereignty
Depends on your provider
Processing covered
Language model only
Contract
You
Retention, logging, training terms
Set by your contract
Setup
Case by case, subject to compatibility
* At your choice. No local AI processing in Canada, the UAE, Morocco or Saudi Arabia.
Combining options
Combining options, for example a frontier language model with sovereign OCR, is technically possible. By default a single option is recommended, and combinations are considered on request.
Which setup fits which priority
Two steps, and no catalogue to work through: you are directed to the hosting offer for your region, and your DiliTrust team recommends the AI processing that fits the needs you have stated.
If your priority is
AI quality and processing volumes
Hosting
Default offer for your region
AI processing
A · Frontier
If your priority is
Sovereign AI in Europe
Hosting
OVHcloud
AI processing
B · Sovereign
If your priority is
Very strong security requirements in Europe
Hosting
S3NS
AI processing
B · Sovereign, on SecNumCloud-qualified Scaleway infrastructure
If your priority is
A specialised sovereign AI service
Hosting
OVHcloud or S3NS
AI processing
C · Specialised sovereign provider
If your priority is
Using the model you already have
Hosting
Default offer for your region
AI processing
D · Bring Your Own LLM, with A or B for OCR and embedding
If your priority is
Hosting in Canada, UAE, Morocco, KSA
Hosting
Default offer for your region
AI processing
A, B or C, processed outside the country
For an S3NS customer, option B can run on SecNumCloud-qualified Scaleway infrastructure, from storage to AI processing.
Across all options
Model training
No model training is performed by DiliTrust without the customer's consent. Our model partners do not use customer data to train their models, and customer data is not shared across clients.
“Model partners” are the providers DiliTrust contracts (options A and C under a DiliTrust contract). Where you hold the contract with the AI provider (option C under your contract, or option D), DiliTrust does not control that provider and cannot guarantee its training or retention terms: they are governed by your contract.
- Customer documents remain stored on DiliTrust infrastructure, in your hosting region, whatever the option.
- AI features run inside the DiliTrust application and follow its authentication and authorisation mechanisms.
- Platform audit logging is unchanged: actions are logged across the platform and hosting infrastructure. The logging limits stated per option apply to the AI processing layer only.
Frequently asked questions
Can we be hosted on OVHcloud and still use frontier models?
Yes, if your needs justify it. Hosting and AI processing are independent. The content analysed by the AI is then processed by Google Cloud, in Europe or the United States, at your choice.
Why is sovereign AI below frontier quality?
The most advanced models are not published as open weights, so they cannot be deployed on DiliTrust-operated servers. Option B uses the best open-weight models available and offers high quality, below that of the leading frontier models.
Can we use our own AI model?
Yes, through Bring Your Own LLM, if your provider exposes an API compatible with the OpenAI standard. It covers the language model only. OCR and embedding run on option A or B.
Can customers in Canada, the UAE, Morocco or Saudi Arabia have local AI processing?
Not currently. Data at rest stays in the country, and AI requests are processed outside it for the duration of the processing: in Europe or the United States for option A, in France for option B.
Is AI usage subject to limits?
Usage is subject to the Limitations of Use set out in the DiliTrust General Terms and Conditions.
Which open-weight models are used in option B?
DiliTrust does not publish model names, because the deployed models change as they are evaluated. Your account team can describe the current setup during a security review.
Does the AI provider keep our content?
Not under options A and B: zero data retention applies, and no customer content is kept once processing is complete. Under options C and D, the terms of the contract holder apply; where you hold the contract, DiliTrust cannot guarantee them.
Glossary
Open-weight model
A model whose parameters are public, so it can be deployed on infrastructure DiliTrust operates.
OCR
Optical character recognition: reading text in scanned documents.
Embedding
Turning text into vectors so that documents can be searched by meaning.
SecNumCloud
ANSSI qualification for the most demanding cloud services in terms of security and sovereignty.
LLM
Large language model: understands, summarises, extracts and writes text.
Zero data retention
No customer content is kept by the AI layer once processing is complete.
Confirmed for your environment
Your account team confirms the applicable option, providers, processing locations and data path for your environment. For security, privacy, procurement or compliance reviews, contact your DiliTrust account manager or Customer Care at support@dilitrust.com.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article