SECURITY AND TRUST
Английский текст ниже является обязательной версией этого документа.
1. In one paragraph
Sovereign AI Cloud is built so that the content of your requests never has to be trusted to anyone: it is not stored, it does not leave the European Union, and no external AI supplier is in the request path. What we do keep — account data and request metadata — is kept in the EU, encrypted, scoped to your organisation and visible to you. Every measure below carries its status; a measure labelled PLANNED is a commitment, not a claim.
2. EU residency statement by data class
| Data class | Where it is processed and stored | Notes |
|---|---|---|
| Request and response content | Processed in memory on the inference plane in the EU; not stored | Zero retention by default |
| Request metadata (ids, model, token counts, status, timing) | Control-plane database, EU | 13-month retention |
| Account and organisation data | Control-plane database, EU | Life of the account + 30 days |
| Billing and tax data | Control-plane database (EU) and Stripe (Ireland / United States) | Card data is held by Stripe only |
| Transactional email | Resend — sent from an EU region; account data stored in the United States | Confirmation, invoices, security notices |
| Backups | Encrypted, EU | Rotated within 35 days |
| DNS, TLS termination, edge delivery | Cloudflare — global edge with EU points of presence | TLS is terminated at the edge; no contractual EU-only commitment exists for edge logs |
| Source code and CI | GitHub (United States) | No customer data by design |
Hosting provider for the control plane and the inference plane: [HOSTING PROVIDER] (planned: Hetzner Online GmbH, Germany / Finland).
3. Zero retention
The inference gateway writes one audit line per request: request identifier, model, HTTP status, prompt tokens, completion tokens and duration. It never writes the prompt or the completion. The control plane adds the organisation, project and key-prefix identifiers to that line. The platform setting that governs this (SOVCLOUD_RETENTION_CONTENT) is none by default; any retention option we may offer is activated only by the customer's own explicit configuration and is documented.
4. Technical and organisational measures and their status
| Measure | Status |
|---|---|
| TLS 1.2+ on every public endpoint | PLANNED (cloud) |
| Private network between control plane and inference plane; inference never reachable from the internet | PLANNED (cloud); BUILT (loopback-only in development) |
| Zero retention of request content; metadata-only audit lines | BUILT (inference gateway) |
| API-key secrets stored only as a keyed one-way hash (HMAC-SHA-256); secret shown once | BUILT (control plane, tested in isolation) |
| Platform secrets read from files or masked prompts only; never in command lines, code or logs | BUILT (standard of the ecosystem) |
| Error messages free of URLs, tokens, paths and upstream exception text | PLANNED (control plane) |
| Tenant isolation by organisation / project / key-prefix identifiers set only by the control plane | PLANNED (control plane) |
| Separate administrative surface with role-based access | PLANNED (control plane) |
| Per-project rate limits and budgets | PLANNED (control plane); BUILT (global 120 requests/min at the gateway) |
| Protection against server-side request forgery; no external AI supplier in the path | BUILT (no external supplier in the cloud Machine copy); PLANNED (control plane) |
| Audit log of administrative and key events | PLANNED (control plane) |
| Encrypted backups with tested restore | PLANNED (cloud) |
| Health monitoring and a public status page | BUILT (status page); PLANNED (probe against the cloud) |
| Dependency and runtime updates | BUILT (process) |
| Written incident procedure with 48-hour customer notification | BUILT (DPA Section 4.6) |
| Deletion of account data and metadata on termination | PLANNED (control plane) |
The labels follow the claim discipline of the platform: MEASURED — measured on a stated date by a stated method; BUILT — exists and works, not measured under load; PLANNED — designed, not yet built. This table is updated as the control plane and the cloud deployment pass their acceptance tests.
5. Incident contact
Security incidents, suspected key compromise and personal data breaches: [CONTACT EMAIL] (subject line beginning with "SECURITY"). We acknowledge within one business day and, for a confirmed personal data breach affecting customer data, notify affected customers within 48 hours as set out in the Data Processing Agreement.
6. Responsible disclosure
We welcome reports of vulnerabilities in the site, the API, the cabinet and the documentation.
- Report to [CONTACT EMAIL] with the steps to reproduce, the affected address and your contact details. Encrypted reports: a PGP key will be published here [PGP KEY FINGERPRINT].
- Scope: sovereignai.mediaholding.tech and the services it serves. Out of scope: the other products of Media Holding (report to their own channels), third-party services (Stripe, Cloudflare, Resend, GitHub), denial-of-service testing, social engineering, physical attacks.
- Rules: do not access, modify or delete data that is not yours; stop as soon as you have demonstrated the issue; do not use automated scanners against production without written permission; give us 90 days before public disclosure, or longer if we ask with a reason.
- Our commitment: acknowledgement within two business days; a status update at least every 14 days; no legal action against good-faith research that follows these rules; credit by name on this page if you wish. We do not currently pay bounties.
7. Compliance and audits
Customers under a Data Processing Agreement may audit us as set out in its Section 7. Independent certifications (for example ISO/IEC 27001) are not yet held; the roadmap towards them is published when a date is fixed.
Последняя редакция 2026-10-13