HMS Sovereign enables EU-hosted voice AI calls with strong data residency guarantees, ensuring your data is processed and stored exclusively within the European Union. For organizations with the highest compliance requirements, we also offer fully on-premise deployment options.
🇪EU Data Residency - When configured with Gladia, Mistral, and Local TTS, your voice AI data never leaves EU soil. All processing occurs within EU data centers.
HMS Sovereign's platform infrastructure runs on dedicated virtual servers located in Frankfurt, Germany. While the data center and all data processing are physically located within the EU and subject to EU data protection law, the underlying cloud infrastructure provider is a US-headquartered company. This means:
Data residency: All data is stored and processed exclusively within the EU (Frankfurt, Germany)
Physical security: The data center is located in the EU and subject to EU regulations
Corporate jurisdiction: The infrastructure provider's parent company is incorporated in the United States, which means it could theoretically be subject to US legal requests (e.g., under the US CLOUD Act)
For most use cases, this setup provides strong data residency and GDPR compliance. For organizations that require full corporate sovereignty (i.e., no involvement of any non-EU parent company at any level of the stack), we offer dedicated on-premise solutions -- see Enterprise On-Premise Solutions below.
The virtual servers hosting HMS Sovereign are provided by a US-headquartered cloud provider, but are physically located in Frankfurt, Germany. Data at rest and in transit remains within the EU at all times.
All AI providers (Gladia, Mistral) are EU companies subject to EU data protection laws from the ground up. HMS Sovereign (Flireo B.V.) is a Dutch company. Data is processed and stored exclusively within the EU.
The AI providers (Gladia, Mistral) and HMS Sovereign itself are EU-incorporated and not subject to the US CLOUD Act. However, the underlying infrastructure provider is a US-headquartered company, which could theoretically be compelled under US law to provide access to data on its servers. In practice, all data is encrypted and the infrastructure provider does not have application-level access to your data. For organizations where this theoretical risk is unacceptable, we offer fully on-premise solutions.
*The AI providers and HMS Sovereign are EU-incorporated. Only the underlying infrastructure provider has a US parent company. Data is encrypted and the provider has no application-level access.
Important for Regulated Industries
Organizations in healthcare, finance, government, and legal sectors often have strict data residency requirements. Our standard EU stack provides strong data residency within the EU. For the highest level of sovereignty -- where no non-EU entity is involved at any level -- see our Enterprise On-Premise Solutions.
Legal Name: Flireo B.V.Entity Type: Dutch Besloten Vennootschap (BV)Jurisdiction: NetherlandsRole: Platform provider, application logic, and Local TTSData Processing: All platform data processed on EU-located servers in Frankfurt, Germany
Legal Name: Gladia SASEntity Type: French Societe par Actions SimplifieeJurisdiction: FranceRole: Speech-to-Text processingData Processing: Audio transcription in EU-West region (France)
Legal Name: Mistral AI SASEntity Type: French Societe par Actions SimplifieeJurisdiction: FranceRole: Language Model inferenceData Processing: LLM inference on European infrastructure
Entity Type: US CorporationJurisdiction: United StatesRole: Virtual server hosting (compute and storage)Server Location: Frankfurt, Germany (EU)Data Access: No application-level access. Provides compute resources only. All data is encrypted at rest and in transit.
Is my data ever processed outside the EU?No. When using Gladia + Mistral + Local TTS, all data processing occurs exclusively within the European Union. Servers are located in Frankfurt, Germany and France.Do I need Standard Contractual Clauses (SCCs)?No. Data never leaves the EU, so SCCs for transatlantic data transfers are not required. This simplifies your legal compliance significantly.What about the US CLOUD Act?The AI providers (Gladia, Mistral) and HMS Sovereign (Flireo B.V.) are EU-incorporated and not subject to the US CLOUD Act. The underlying infrastructure provider is a US-headquartered company, which could theoretically be subject to US legal requests. However, all data is encrypted and the infrastructure provider has no application-level access. For organizations where this theoretical risk is unacceptable, we offer fully on-premise deployment -- see Enterprise On-Premise Solutions.Can I mix EU and non-EU providers?Yes, but you would reduce your data sovereignty posture. For maximum compliance, use all three EU providers together.Is there a latency difference?EU users typically experience lower latency with the EU stack since all processing happens geographically closer (Frankfurt and France). For users outside Europe, latency may be slightly higher.What if I need full corporate sovereignty with no US-affiliated companies at any level?We offer dedicated on-premise and blackbox deployment options for enterprise clients with the highest compliance requirements. In this model, all hardware and software runs on infrastructure you own or control, with no involvement of any non-EU entity. Contact us for details.
For enterprise clients in highly regulated industries -- such as government, defense, healthcare, finance, and critical infrastructure -- where absolute data sovereignty is required, HMS Sovereign offers fully on-premise and blackbox deployment options.
A self-contained, turnkey appliance that runs the entire HMS Sovereign stack on your own hardware or in your own data center:
Complete isolation: No external network dependencies. The entire voice AI pipeline (platform, STT, LLM, TTS) runs on infrastructure you own and control.
No third-party involvement: No US-affiliated (or any foreign) cloud provider at any level of the stack. Full corporate sovereignty.
Air-gapped capable: Can operate in fully air-gapped environments with no internet connectivity.
Your security perimeter: Fits within your existing physical security, network policies, and access controls.
Zero data egress: No data ever leaves your physical premises
Full CLOUD Act immunity: No US or non-EU entity is involved at any level
Schrems II irrelevant: No cross-border data transfers of any kind
Audit-ready: Full control over logging, monitoring, and access trails
Custom DPA: Tailored Data Processing Agreement to meet your specific regulatory requirements
Anything is possible. Whether you need a single rack in your own data center, a fully air-gapped deployment, or a custom hybrid architecture, we work with your security and compliance teams to deliver a solution that meets your exact requirements. No compromise.
For more information about our EU data sovereignty offering, contact us at support@flireo.com or consult with your legal team regarding specific compliance requirements.
