Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  2. Glean (Assistant, Agents, Enterprise Search)
G(

Glean (Assistant, Agents, Enterprise Search)

Sovereignty grade C+ (59/100). EU region selectable; no training on your data; self-hostable. Glean Technologies, United States.

Category
saas-embedded
EU AI Act role
Deployer
Certifications
HIPAAISO 27001ISO 42001SOC 2 Type II
Deployments
Hosted API
Categories
SaaS-embedded
Government access exposure
US CLOUD Act
Countries
United States

Details

Deployment
hosted
Hq Country
United States
Hq City
Palo Alto
Ownership
private
Founded
2019
Trust Center Url
trust.glean.com
Training Default
never
Residency Options
United States (us-central1, default), Netherlands (europe-west4), Taiwan (asia-east1), Brazil (southamerica-northeast1), Canada (northamerica-northeast1), Customer's own GCP or AWS account (Customer Hosted)
Gov Access Exposure
us-cloud-act
Eu Ai Act Role
deployer
Certs
ISO 42001, ISO 27001, SOC 2 Type II, HIPAA
DPA available
yes
Zero Retention Available
Yes
Self Host Option
Yes
Retention Default
Glean builds and holds a persistent index and knowledge graph of connected content inside a single-tenant environment for the life of the subscription — retention is the product, not an incident of it. Glean's published retention policy is generic ('only as long as necessary'); the specific window is contractual.
Retention Exceptions
Zero-retention agreements are in place with every model provider, so the LLM layer stores nothing. Customer Hosted deployments keep the index inside the customer's own GCP or AWS account. A wholly-owned Indian affiliate, Glean Search Technologies India Private Limited, holds remote access to customer environments for support, security and debugging.
Subprocessors
Amazon Web Services, Inc., Google LLC, Microsoft Corporation, OpenAI OpCo, LLC, Anthropic PBC, Groq, Inc., Fireworks.ai, Inc., Baseten Labs, Inc., Modal Labs, Inc., Snowflake, Inc., Palo Alto Networks, Inc., Brave Software, Inc., Deepgram, Inc., Exa Labs, Inc., Intercom, Inc., Twilio Inc., Salesforce Inc., Slack Technologies, LLC, Zendesk, Inc., SendGrid, Inc.
Subprocessor Count
20
Transfer Mechanism
sccs+dpf
Eu Procurement Ready
conditional
Eu Procurement Reason
Glean publishes the most complete sub-processor disclosure in this category — 20 named entities with purpose and location, plus a named Indian support affiliate with remote access — and every single location is the United States. It offers a real Customer Hosted deployment inside the customer's own GCP or AWS account with full data-residency guarantees, and an EMEA region (Netherlands, europe-west4) for the SaaS product. But the documented default region for Glean-hosted tenants is us-central1 in North America; EU hosting is something you have to ask for.
Last Policy Change
2026-07-28T00:00:00.000Z
Change Summary
Sub-processor list updated to add Deepgram, Inc. (speech-to-text, United States), following earlier additions of Baseten Labs and Modal Labs as LLM providers. All 20 disclosed sub-processors are located in the United States.
Prior Value
Sub-processor list without Deepgram, Baseten or Modal.
Training Evidence Url
www.glean.com/security
Training Claim Basis
stated
Training Confidence
high
Residency Evidence Url
docs.glean.com/get-started/build/gcp/supported-gcp-regions
Residency Claim Basis
stated
Residency Confidence
high
Retention Evidence Url
www.glean.com/privacy
Retention Claim Basis
stated
Retention Confidence
medium
Subprocessors Evidence Url
www.glean.com/legal/subprocessors
Subprocessors Claim Basis
stated
Subprocessors Confidence
high
Residency Class
eu-selectable
Portability / Exit Path
proprietary-only
Subprocessor Jurisdiction
non-eu
Underlying model providers
OpenAI, Google, Anthropic, Amazon, Glean, Groq, Fireworks AI, Baseten, Modal
At a glance
Governance Grade
C+
Governance Score
59
EC SOV-2 Legal & Jurisdictional (0-4)
1
EC SOV-3 Data & AI (0-4)
2
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Certifications

  • SOC 2 Type II46
  • ISO 2700136
  • ISO 4200113
  • ISO 270177
  • ISO 277017
  • ISO 270186
  • HDS5
  • HIPAA4
  • CSA STAR4
  • C54
  • ISO 90013
  • PCI DSS3
  • FedRAMP High3
  • ISO 27001:20223
  • SOC 2 (type unverified)2
  • ISO 500012
  • BSI C52
  • SOC 32
  • FedRAMP2
  • GDPR2
  • CSA STAR Level 12

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Countries

  • United States45
  • Germany9
  • France7
  • Switzerland5
  • Singapore3
  • Israel2
  • United Kingdom2
  • China2
  • Netherlands2