Security and compliance
Your data is hosted in France or elsewhere in Europe, kept apart from other clients' data, and encrypted at rest and in transit. The AI models are chosen to match your requirements, and none of them is trained on your data.
Hosting
By default, your solution runs on infrastructure that Erudi operates end to end, in France or elsewhere in Europe depending on your needs. Since every solution is built to measure, hosting can also adapt to your context.
In France or elsewhere in Europe, depending on your needs. We run it end to end.
If your company has an IT team able to run the solution, we deploy it in your own cloud account.
For data that must not leave your infrastructure, with open-weight models hosted on your premises.
For extremely sensitive data, when your context requires it: government data, sensitive personal data or banking data.
Does your context call for another kind of hosting? Write to us
Isolation
Yes. When we host and run your solution, the application and the storage are dedicated to your company, and the database is reserved for you, with its own credentials.
AI models
The choice of models is made for each solution. We pick what suits you, based on the need, the budget and how much sovereignty you require over your data.
The most capable models on the market, when processing inside the EU is not required.
Examples
Recent models, run by a major cloud provider or a European company in data centers located in the European Union: your requests never leave the EU.
Examples
Models whose weights are published by their developer, hosted by us or on your own AI infrastructure. No data goes to a third-party provider.
Examples
In every case, your data is not used to train the models, and our contracts with AI providers give us strong guarantees.
GDPR
For each project, we draft a data processing agreement (DPA), the processor contract the GDPR requires. The DPA sets out what we do with your data, and what we do not do with it.
AI Act
Our solutions are designed to comply with the AI Act. On your side, the main task is training your teams to use AI.
FAQ
Yes. The GDPR bans no technology: it regulates the processing of personal data, including processing by AI. In practice, each processing activity needs a legal basis, must use only the data it needs, and the people concerned must be informed of it. Every provider that processes this data must also sign a processor agreement (DPA). For each project, Erudi drafts this DPA, lists its subprocessors in it and sets the retention periods. How we apply the GDPR
Their business plans can be used in compliance with the GDPR, under contract, but no tool is compliant in itself: it also depends on how you use it. OpenAI signs a DPA for ChatGPT Business, ChatGPT Enterprise and its API, but not for its individual plans (Free, Plus, Pro). Microsoft covers Copilot under its GDPR commitments and its EU Data Boundary for business customers. Either way, putting personal data about customers or employees into these tools requires a legal basis and informing the people concerned.
It depends on the plan. On the individual plans (Free, Plus, Pro), OpenAI may use conversations to train its models unless the user turns this off in the data controls; even after opting out, rating an answer (thumbs up or down) can bring the whole conversation into training. Conversations in ChatGPT Business, ChatGPT Enterprise and the API are not used for training by default, and Anthropic draws the same line between the individual and business plans of Claude. In Erudi solutions, your data trains no model, and this commitment is written into our contracts with the providers. The models we use
With a personal account, share nothing you wouldn't send to an outside provider without a contract: personal data about customers or employees, health data, passwords and access keys, contracts, unpublished figures, documents under a non-disclosure agreement. With a business plan under a DPA, the company's AI usage policy sets the rule, according to how sensitive each type of data is. For data that must not leave your infrastructure, a solution can run on your servers with open-weight models. Hosting options
An AI usage policy should say which tools are allowed (under a business contract), which data can go into them and what review is expected before a result is used. Banning or blocking ChatGPT without offering an approved tool does not make the need go away: usage tends to move to personal accounts the company cannot see. Training your teams is part of the framework too, and the AI Act requires it (see the next question). A dedicated solution can build some of these rules into the software itself: human approval of sensitive actions, hosting and models chosen by the company.
Yes. Since 2 February 2025, Article 4 of the AI Act has required every company that uses AI systems to take measures so that its staff know how to use them. No certificate or training format is imposed, and national authorities have been enforcing this obligation since 2 August 2026. For an internal assistant or a writing tool, the main additional rules are about transparency: users must know they are talking to an AI. The heavy obligations target high-risk uses, such as screening CVs for recruitment or assessing creditworthiness for a loan. They will apply from 2 December 2027. The AI Act in our solutions
By deploying an open-weight model, that is a model whose developer publishes its weights (Mistral, Qwen or Gemma, for example), on its own servers or in its cloud account, with GPUs sized for that model. The model then has to be connected to your documents and tools, secured, monitored and updated, which takes a team able to run it. Erudi deploys its solutions on your servers or in your cloud, or hosts them for you in France or elsewhere in Europe. For individual offline use, there is also Erudi Desktop, our open-source local AI app.
Sovereign AI usually means AI whose data and processing stay under European law, out of reach of other countries' extraterritorial laws. There are several levels: models run only in data centers in the European Union, open-weight models hosted on infrastructure you control, or hosting with a provider qualified SecNumCloud by ANSSI, the French national cybersecurity agency. That qualification is designed precisely to protect sensitive data from extraterritorial laws. We choose the level with you, based on how sensitive the data is and on the budget. The models · Hosting
Regulated sector, sensitive data, requirements from your IT department: describe them, and we'll tell you how we handle them.