AI hosted in France, sovereign AI: what these words guarantee.

Hosted in France: a question of location

A service “hosted in France” runs its servers in data centers located in France. That is useful information: it tells you where data is stored and which country the machines are in, which simplifies questions about transfers outside the European Union.

For an AI service, you also need to ask what exactly is hosted. The app (the interface, accounts, billing), the storage (conversations, files, backups) and the processing by the model can sit in different places. A service can host its app and storage in France, then send each message to a model that runs elsewhere, sometimes outside the European Union.

Sovereign: a question of law

Sovereignty does not depend only on where the servers are, but on the law the provider is subject to. The most cited example is American: passed in March 2018, the CLOUD Act wrote into federal law (18 U.S.C. § 2713) that US obligations to preserve and disclose communications and customer records apply to data a provider possesses, holds or controls, whether it is stored in the United States or elsewhere.

As a result, a service hosted in France by a company subject to US law can be required to hand data over to US authorities. The CNIL considers this risk limited for data that is not sensitive, since the United States is considered an adequate country; but for the most sensitive data, it recommends a provider subject exclusively to EU law. It notes that the SecNumCloud qualification from ANSSI, France’s national cybersecurity agency, includes this criterion and so protects data against access by foreign authorities.

What French law says

For the French State, the rule is written down. Article 31 of the law of May 21, 2024 on securing and regulating the digital space, known as the SREN law, requires State administrations and their operators, when they entrust data of particular sensitivity to a private provider, to apply security criteria that protect this data against any access by public authorities of non-EU countries that EU law does not authorize.

It covers data protected by a secret under the law and data needed for the State’s essential missions. For a private company, it depends on the sector and the data: the GDPR governs transfers of personal data outside the EU, and some sectors, such as health, have their own hosting rules.

The three layers of an AI service

Six questions to ask a provider

1. Which company publishes the service, and which law are it and its parent company subject to?
2. Where are the app, the conversations, the files and the backups hosted?
3. Which model processes my messages, at which provider, and in which country?
4. Are my conversations used to train models? How long are they kept?
5. What does the service do with sensitive data before sending it to the model?
6. Does my data call for a SecNumCloud-qualified offer, and does the service have one?

Moon AI: what is sovereign and what is not

Moon AI is a platform built in Normandy by Stellarr Studio, a French company based in Pont-Audemer, and hosted in France at OVHcloud. The company, the app, the storage and the contracts are therefore under French law. It brings Claude, GPT, Gemini, Mistral and other models into one subscription.

The model layer is not sovereign: each message goes to the provider of the model you pick, often an American company. To reduce what goes out, Moon Blur masks the sensitive data it detects before sending to the model (IBANs, social security numbers, emails, phone numbers…), then puts the real values back in the answer you read. Detection can miss a value written in an unusual way, names of people are not detected on their own (from Constellation, you add them to your list of terms to mask), and images and voice are sent as they are.

So Moon AI is not the right answer for data that requires a SecNumCloud-qualified offer. For everything else, it lets you choose the model message by message, Mistral included, and know what goes out. The details are on the Moon AI, French AI page, the commitments on the Security page and the plans on the pricing page.