Hosting and AI processing
Where your data lives, where your AI runs: providers, locations, options and commitments.
Before an AI feature is switched on, technology, security, privacy and procurement teams ask two questions: where is our data stored, and where is it processed when AI is used? This document answers both, in detail. The principles that govern DiliTrust AI, including model training, human review, access control and audit, are set out in the DiliTrust AI Code of Conduct. This document describes how they are implemented: providers, locations, options and commitments. It applies to Contract Lifecycle Management, Board Portal, Legal Entity Management, Matter Management and Documentation Library.
Two layers, decided separately
Layer 1
Hosting
Where your data is stored and operated. It follows your region: the business modules, the database and your documents stay with the same hosting provider, in the same geographic zone.
Layer 2
AI processing
Where an AI request is processed when you use an AI feature. It follows the configuration recommended for your needs, independently of where you are hosted.
Our core commitment: Your data at rest, database and documents, stays in its hosting zone. When you use an AI feature, the content to be analysed is sent to the AI layer for the duration of the processing, and the response is returned to DiliTrust.
Two ways to run Lini
In both configurations the DiliTrust legal intelligence layer and its controls stay the same. What changes is the model, and who processes the request. Two more options, C and D, are available on request: see Layer 2.
| DefaultDiliTrust-managed frontier configuration | On requestSovereign configuration (DiliTrust-managed, EU-based) | |
|---|---|---|
| Data storage | DiliTrust infrastructure, in your hosting regionIn both configurations, customer documents remain stored here. | |
| Model | Leading frontier modelSelected for quality and fite.g. GPT, Claude or Gemini families | Open-weight modelFor sovereignty, residency or contract requirementsOperated within the DiliTrust perimeter |
| AI processing | By Google CloudUnder DiliTrust’s contractThe response is returned to DiliTrust | By DiliTrustWithin the DiliTrust perimeterOn dedicated servers in France |
Layer 1 · Hosting providers by region
Each region has a default hosting offer, and DiliTrust directs you to it. Modules, database and documents always stay with the same provider, in the same zone.
| Offer | Provider | Data centres | Who it is for | Status |
|---|---|---|---|---|
| International cloud | Google Cloud | United States, Canada, Europe, Saudi Arabia | Customers in the United States, Canada and Saudi Arabia, each hosted in their own region | Default |
| Sovereign Europe | OVHcloud | France | European customers, whatever their country | Default |
| Sovereign high security | S3NS | France | European customers requiring SecNumCloud-qualified infrastructure | Alternative |
| Sovereign UAE | Etisalat (e&) | United Arab Emirates | Customers in the UAE | Default |
| Sovereign Morocco | DXC / Inwi | Morocco | Customers in Morocco | Default |
Stated upfront: Canada, UAE, Morocco and Saudi Arabia
Your data is hosted in the country. AI processing is not currently available locally. If you activate AI features, the content to be analysed is processed outside the country for the duration of the processing, then returned: in Europe or the United States, at your choice, for option A; in France for option B. Your data at rest stays in the country.
Certification scope
- ISO 27001
- ISO 27701
- SOC 2
- GDPR
The DiliTrust solution as a whole is certified to ISO 27001, ISO 27701 and SOC 2. There is currently no certification specific to the AI solution. These certifications do not replace a customer-specific review of the provider, data path, region or contractual commitments. DiliTrust does not claim automatic compliance with the EU AI Act.
Activating an AI option can require adding the AI provider to the sub-processors listed in your contract. Your account team manages this update.
Layer 2 · AI processing
Layer 2 decides where an AI request is processed. It is chosen independently of hosting. Three types of processing are involved: the language model, which understands and generates text; OCR, which reads text in scanned documents; and embedding, which turns text into vectors for search. Orchestration, retrieval, playbooks and the controls around the output stay in the DiliTrust legal intelligence layer in every option.
| AI Code of Conduct configuration | Option in this document | Availability |
|---|---|---|
| DiliTrust-managed frontier configuration | A · Frontier models via Google Cloud | Default |
| Sovereign configuration | B · Sovereign AI operated by DiliTrust | On request |
| Variant of the sovereign configuration | C · Specialised sovereign provider | On request, case by case |
| Variant: customer-supplied model | D · Bring Your Own LLM | On request, subject to compatibility |
Layer 2 · The four AI processing options
DiliTrust recommends one option and documents it for your environment. Commitments are stated per option, because they depend on who operates the model and who holds the contract.
A · Frontier models via Google Cloud
DefaultAI Code of Conduct: DiliTrust-managed frontier configuration
- What it is
- Leading frontier models accessed by DiliTrust under its own contract, on a pay-as-you-go basis. Examples may include GPT, Claude or Gemini families, subject to the customer environment.
- Operated by
- Google Cloud runs the model, through Model Garden, on Google’s shared infrastructure. DiliTrust selects and configures the model and holds the contract.
- Processing covered
- Language model, OCR and embedding.
- Location
- Europe or the United States, at your choice. No local AI processing in Canada, the UAE, Morocco or Saudi Arabia.
Commitments
- The provider does not use customer data to train its model.
- Zero data retention: no customer content is kept once processing is complete.
- The response is returned to DiliTrust.
- Encryption in transit and at rest; logging limited or disabled at the AI provider layer.
To be aware of: Processing is operated by a non-European provider, in Europe or the United States.
B · Sovereign AI operated by DiliTrust
On requestAI Code of Conduct: Sovereign configuration
- What it is
- Open-weight models, whose parameters are public, deployed and operated by DiliTrust teams. Model names are not published because the deployed models change as DiliTrust evaluates them.
- Operated by
- DiliTrust, on NVIDIA GPU servers rented from OVHcloud and Scaleway, two French providers. The servers are dedicated to DiliTrust and not shared with their other customers. Scaleway infrastructure is SecNumCloud-qualified.
- Processing covered
- Language model, OCR and embedding.
- Location
- France, for every hosting region, including customers hosted outside Europe.
Commitments
- Processing is carried out within the DiliTrust perimeter.
- Zero data retention: no customer content is kept once processing is complete.
- Encryption in transit and at rest; logging limited at the AI processing layer.
To be aware of: High quality, below the level of the best models on the market. Capacity is sized and validated against your volumes.
C · Specialised sovereign provider
On requestAI Code of Conduct: Variant of the sovereign configuration
- What it is
- An AI service operated by a recognised European provider, for example Mistral AI for language or OCR.
- Contract
- Held by DiliTrust or by you, depending on the setup agreed.
- Processing covered
- Language model or OCR, depending on the service.
- Location
- European Union.
Commitments
- When DiliTrust holds the contract, retention, logging and training terms are those of DiliTrust’s contract with the provider, confirmed for your environment.
- When you hold the contract, DiliTrust does not control the provider and cannot guarantee those terms: they are governed by your contract with the provider.
To be aware of: Assessed and set up case by case.
D · Bring Your Own LLM
On requestAI Code of Conduct: Variant: customer-supplied model
- What it is
- DiliTrust uses a language model provider that you already contract or host. It must expose an API compatible with the OpenAI standard.
- Scope
- Language model only. OCR and embedding run on option A or B.
- Contract and cost
- Yours, directly with your provider.
- Quality and capacity
- Depend on your provider.
Commitments
- DiliTrust does not control your provider and cannot guarantee its retention, logging or training terms: these are governed by your contract with that provider.
- On the DiliTrust side, storage, access control and application controls continue to apply.
To be aware of: Compatibility is checked before activation.
The four options compared
| A · Frontier | B · Sovereign | C · Specialised | D · Your LLM | |
|---|---|---|---|---|
| Model operated by | Google Cloud | DiliTrust | The provider | Your provider |
| AI quality | Maximum | High, below the best market models | Depends on the service | Depends on your model |
| Capacity and volumes | Very high | Sized, validated against your volumes | Depends on the provider | Depends on the provider |
| Processing location | Europe or United States* | France, dedicated machines | European Union | Depends on your provider |
| Sovereignty | Non-European operator | French, operated by DiliTrust | European | Depends on your provider |
| Processing covered | Language model, OCR, embedding | Language model, OCR, embedding | Specific service | Language model only |
| Contract | DiliTrust | DiliTrust | DiliTrust or you | You |
| Retention, logging, training terms | Zero data retention, under DiliTrust’s contract with Google Cloud | Zero data retention, operated by DiliTrust | Set by the contract holder | Set by your contract |
| Setup | Standard | Standard, on request | Case by case | Case by case, subject to compatibility |
* At your choice. No local AI processing in Canada, the UAE, Morocco or Saudi Arabia.
Combining options
Combining options, for example a frontier language model with sovereign OCR, is technically possible. By default a single option is recommended, and combinations are considered on request.
Which setup fits which priority
Two steps, and no catalogue to work through: you are directed to the hosting offer for your region, and your DiliTrust team recommends the AI processing that fits the needs you have stated.
| If your priority is | Hosting | AI processing |
|---|---|---|
| AI quality and processing volumes | Default offer for your region | A · Frontier |
| Sovereign AI in Europe | OVHcloud | B · Sovereign |
| Very strong security requirements in Europe | S3NS | B · Sovereign, on SecNumCloud-qualified Scaleway infrastructure |
| A specialised sovereign AI service | OVHcloud or S3NS | C · Specialised sovereign provider |
| Using the model you already have | Default offer for your region | D · Bring Your Own LLM, with A or B for OCR and embedding |
| Hosting in Canada, UAE, Morocco, KSA | Default offer for your region | A, B or C, processed outside the country |
For an S3NS customer, option B can run on SecNumCloud-qualified Scaleway infrastructure, from storage to AI processing.
Across all options
Model training
No model training is performed by DiliTrust without the customer’s consent. Our model partners do not use customer data to train their models, and customer data is not shared across clients.
“Model partners” are the providers DiliTrust contracts (options A and C under a DiliTrust contract). Where you hold the contract with the AI provider (option C under your contract, or option D), DiliTrust does not control that provider and cannot guarantee its training or retention terms: they are governed by your contract.
- Customer documents remain stored on DiliTrust infrastructure, in your hosting region, whatever the option.
- AI features run inside the DiliTrust application and follow its authentication and authorisation mechanisms.
- Platform audit logging is unchanged: actions are logged across the platform and hosting infrastructure. The logging limits stated per option apply to the AI processing layer only.
Frequently asked questions
Can we be hosted on OVHcloud and still use frontier models?
Yes, if your needs justify it. Hosting and AI processing are independent. The content analysed by the AI is then processed by Google Cloud, in Europe or the United States, at your choice.
Why is sovereign AI below frontier quality?
The most advanced models are not published as open weights, so they cannot be deployed on DiliTrust-operated servers. Option B uses the best open-weight models available and offers high quality, below that of the leading frontier models.
Can we use our own AI model?
Yes, through Bring Your Own LLM, if your provider exposes an API compatible with the OpenAI standard. It covers the language model only. OCR and embedding run on option A or B.
Can customers in Canada, the UAE, Morocco or Saudi Arabia have local AI processing?
Not currently. Data at rest stays in the country, and AI requests are processed outside it for the duration of the processing: in Europe or the United States for option A, in France for option B.
Is AI usage subject to limits?
Usage is subject to the Limitations of Use set out in the DiliTrust General Terms and Conditions.
Which open-weight models are used in option B?
DiliTrust does not publish model names, because the deployed models change as they are evaluated. Your account team can describe the current setup during a security review.
Does the AI provider keep our content?
Not under options A and B: zero data retention applies, and no customer content is kept once processing is complete. Under options C and D, the terms of the contract holder apply; where you hold the contract, DiliTrust cannot guarantee them.
Glossary
- Open-weight model
- A model whose parameters are public, so it can be deployed on infrastructure DiliTrust operates.
- OCR
- Optical character recognition: reading text in scanned documents.
- Embedding
- Turning text into vectors so that documents can be searched by meaning.
- SecNumCloud
- ANSSI qualification for the most demanding cloud services in terms of security and sovereignty.
- LLM
- Large language model: understands, summarises, extracts and writes text.
- Zero data retention
- No customer content is kept by the AI layer once processing is complete.
Confirmed for your environment
Your account team confirms the applicable option, providers, processing locations and data path for your environment. For security, privacy, procurement or compliance reviews, contact your DiliTrust account manager or Customer Care at [email protected].