An EU region of a US cloud
The data sits in Frankfurt or Dublin.
Under the US CLOUD Act the provider remains obliged to hand over what it holds. The location does not help; the owner does.
European AI governance software
European AI governance software: not where the company sits, but where your data stays.
European AI governance software is software for governing AI use that is built and hosted in Europe. That is a start, not an answer. The questions that matter: where is data processed and by whom, what is stored, are prompts kept, are individual employees tracked, how is AI use measured, and how does policy reach people. BeeSensible answers them like this: processing on its own servers at Scaleway in Amsterdam and Hetzner in Germany, European companies with no US parent, text held in memory and discarded at once, figures without a user id, and a decision per tool that is shown, not enforced.
app.beesensible.eu/analytics
Detections over timeLast 30 days
12,438+18% vs the previous period
Detections by platform
78% adjusted
8,124
81% adjusted
3,210
74% adjusted
812
Most encountered data types
4,212
2,930
1,486
1,104
612
SensitiveHighly sensitive
The problem
Every vendor says "in the EU". The difference sits one layer down.
A European region of a US cloud is also "in the EU". Anyone choosing AI governance software to keep data in Europe therefore has to ask further: who owns the machines, which law applies, and what is actually kept.
An EU region is not a European company
The US CLOUD Act obliges providers under US jurisdiction to hand over data, including data in European data centres. A European region changes nothing about that; a European owner does.
Governance software builds its own file
Many tools in this category reason from visibility and intervention, and store what employees type to do so. That creates a second copy of exactly the data you wanted to protect.
Measuring becomes tracking
A view per employee is a works council question in many European countries and always a GDPR question. Yet in many tools that view is the starting point.
Procurement questions
What to ask every European vendor.
Not whether the company is European, but what happens to the data. Each row is a requirement you can put to a vendor, with what BeeSensible answers and where the limit lies.
| Requirement | Why you ask | BeeSensible |
|---|---|---|
| Servers owned by European companies | A European region of a US cloud falls under the US CLOUD Act. A European company with no US parent does not. | Yes Own servers at Scaleway in Amsterdam (96 percent owned by the French Iliad group) and Hetzner in Germany (a German company). No US parent. |
| ISO 27001 certified hosting | Says something about how the infrastructure is managed and secured. Ask whose certificate it is: the host's or the vendor's own. | Partly Scaleway and Hetzner are ISO/IEC 27001:2022 certified. BeeSensible itself holds no certification. |
| Prompts are not stored | A copy of what people type is a second place where sensitive data can leak, and a second processing to justify. | Yes Text is processed in memory and discarded at once. Never written to disk. |
| No external AI service in the chain | If the detection itself calls a US model, the European hosting is a detour. | Yes Detection runs with its own models on an own server at Hetzner. No external AI service is involved. |
| Clear about what is kept | "We store nothing" is never entirely true. Ask for the fields and the retention period. | Yes Counts, types, apps, timestamps and choices. Detection, document and notice events for at most 24 months. |
| No user id in the measurement | A view per employee is a GDPR question and, in many countries, a works council question. | Yes The figures on AI use reach the servers without a user id. No drill-down per person; department insight from 5 people and 7 days. |
| AI use measured at organisation level | You want to know which tools are in use and how much use goes through allowed tools, not who did what. | Yes Only the tool's domain, at most once a day per device. The share through allowed tools has a trend. |
| Policy shown, not enforced | Blocking moves use to personal phones and removes the view. | Yes The decision per tool appears in the browser with the alternative first. People can always continue. |
| Processing on the device itself | For organisations that do not want typed text sent to any server at all. | Partly Through the desktop app, detection can run locally; the text then does not leave the device. A per-organisation setting we switch on at request, not a toggle in the dashboard. |
| Processing agreement and DPIA | The responsibility stays with you; the vendor has to supply the documents. | Yes A processing agreement with every customer, a product DPIA on request. The DPIA for your deployment remains the organisation's work. |
| Block and enforce | Some buyers expect it from governance software. | No Deliberately not. The employee keeps their hands on the keyboard; the decision is shown. |
What it does not do
European is no guarantee. This is what BeeSensible does not do.
Anyone looking for European software mostly wants no surprises afterwards. So here is the limit, up front.
- No compliance guarantee. European hosting does not replace your GDPR assessment; the figures substantiate measures, they certify nothing.
- No certification of BeeSensible itself. The hosting is ISO 27001 certified, we are not, and we say only what is true.
- No storage of prompts, not temporarily and not in Europe either.
- No per-employee view and no user id in the figures on AI use.
- No blocking, no rerouting of traffic, no proxy.
- No decision on the organisation's behalf. Everything starts at "no decision yet".
- No languages other than Dutch and English in the detection.
The approach
The same cycle, with the data where it belongs.
See, decide, help, substantiate. Each step processes as little as possible, and what is processed stays on servers owned by European companies.
1 See
See, with only the domain
The extension counts which AI tools are opened, without a user id and without content. Those counts sit at Scaleway in Amsterdam.
2 Decide
Decide, with the catalogue as advice
865 tools with vendor, country of processing, training policy and a risk score over six dimensions. The organisation chooses the status; nothing is pre-selected.
3 Help
Help, in memory
A national identifier, IBAN or name gets a highlight while someone types. The text goes to own servers at European providers, is checked in memory and discarded at once. Or it stays on the device, through the desktop app.
4 Substantiate
Substantiate, without who
Counts, types, apps and choices, mapped to measures under the GDPR or NIS2. Never content, never per person.
and again How the cycle works
Why this approach
Against the other ways to keep data in Europe.
Four choices organisations make when they want data to stay in Europe, and what each misses.
Hosting everything yourself
Your own server, your own operations.
Possible, but then the detection, the models and the maintenance are yours too. And it does not answer what is recorded per employee.
Blocking AI at the firewall
No traffic to AI domains.
Moves the use to personal phones. The data goes along, only the view does not.
Doing nothing
Trusting that people put no sensitive data into AI.
Works until the first question from a customer, regulator or auditor.
Frequently asked questions
What people ask before they choose.
What makes AI governance software European?
Not the flag on the website. Look at who owns the servers, which law applies to them, what is stored and whether the detection calls an external AI service. BeeSensible processes on its own servers at Scaleway and Hetzner, European companies, keeps no typed text and uses no external AI service.
Does the US CLOUD Act reach BeeSensible?
The CLOUD Act addresses providers under US jurisdiction. Scaleway is 96 percent owned by the French Iliad group, Hetzner is a German company, and BeeSensible has no US parent either. So there is no party in the chain that has to follow a US order. Besides, there is no typed text to hand over: it is processed in memory and discarded at once.
Is BeeSensible ISO 27001 certified?
The hosting is: Scaleway and Hetzner are both ISO/IEC 27001:2022 certified. BeeSensible itself holds no certification. We name only what exists.
Can detection run locally on the device?
Yes, through the desktop app for macOS and Windows. The text then does not leave the device; only a detection event without the detected value goes to the dashboard, and only when the organisation has that switched on. It is a per-organisation setting we switch on at request. Cloud and local use the same detection and feel identical to the employee.
So what is kept?
Counts, types, apps, timestamps and the organisation's choices. Detection, document and notice events are kept for at most 24 months. No prompts, no documents, no user id in the streams on AI use.
Does it work outside the Netherlands?
Yes. The detection handles Dutch and English text, the interface is available in both languages and the processing is the same for every customer. Other languages are not supported.
Further reading
Where data stays, and what you may ask about it.
See within a day which AI is running, without handing over your data.
Fourteen days free, every module, no credit card. Processing at European providers from the first minute, during the trial as well.
14 days free, no credit card. Rolled out across your organisation within the hour.
