Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  2. Inference Providers
IP

Inference Providers

Sovereignty grade C (52/100). EU region selectable; no training on your data. Hugging Face, United States.

Category
inference-host
EU AI Act role
Deployer
Deployments
Hosted API
Categories
Inference host
Certifications
SOC 2 Type II
Government access exposure
US CLOUD Act
Countries
United States

Details

Deployment
hosted
Hq Country
United States
Hq City
New York
Ownership
private
Founded
2016
Trust Center Url
huggingface.co/docs/inference-providers/security
Training Default
never
Residency Options
routed provider's own region, EU providers selectable (OVHcloud FR, Scaleway FR, Nscale), Hugging Face routing layer: United States
Gov Access Exposure
us-cloud-act
Eu Ai Act Role
deployer
Certs
SOC 2 Type II
DPA available
no
Zero Retention Available
Yes
Retention Default
No request body or response is stored when routing through Hugging Face. Debug logs are kept up to 30 days and contain no user data or tokens.
Retention Exceptions
The 17 routed providers set their own retention. Hugging Face states that external providers are responsible for their own security measures and directs users to each provider's data policy — so retention past the routing layer is whatever that provider offers, and Z.ai (Zhipu AI, PRC) is one of them.
Subprocessors
Discourse, AWS SES, Amazon Web Services, Metronome, Stripe, MongoDB Atlas, Google Cloud Platform, GitHub, OVHcloud, Slack Technologies, Hugging Face SAS
Subprocessor Count
11
Transfer Mechanism
none-stated
Eu Procurement Ready
fail
Eu Procurement Reason
The routing layer is genuinely clean — Hugging Face stores neither request nor response — and an EU provider can be selected inside the product. But the privacy policy names no Article 46 transfer mechanism, relying on user consent for transfers out of the EEA, and no DPA is published. The 17 routed providers are not on the subprocessor list, so the chain a buyer actually needs to assess is not the chain that is documented.
Training Evidence Url
huggingface.co/docs/inference-providers/security
Training Claim Basis
stated
Training Confidence
high
Residency Evidence Url
huggingface.co/docs/inference-providers/index
Residency Claim Basis
inferred
Residency Confidence
medium
Retention Evidence Url
huggingface.co/docs/inference-providers/security
Retention Claim Basis
stated
Retention Confidence
high
Subprocessors Evidence Url
huggingface.co/privacy
Subprocessors Claim Basis
stated
Subprocessors Confidence
high
Residency Class
eu-selectable
Portability / Exit Path
serves-open-models
Subprocessor Jurisdiction
mixed
Underlying model providers
Cerebras, Cohere, DeepInfra, Fal AI, Featherless AI, Fireworks AI, Groq, HF Inference, Novita, Nscale, OVHcloud AI Endpoints, Public AI, Replicate, Scaleway, Together AI, WaveSpeedAI, Z.ai
At a glance
Governance Grade
C
Governance Score
52
EC SOV-2 Legal & Jurisdictional (0-4)
0
EC SOV-3 Data & AI (0-4)
2
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7

More Certifications

  • SOC 2 Type II46
  • ISO 2700136
  • ISO 4200113
  • ISO 270177
  • ISO 277017
  • ISO 270186
  • HDS5
  • HIPAA4
  • CSA STAR4
  • C54
  • ISO 90013
  • PCI DSS3
  • FedRAMP High3
  • ISO 27001:20223
  • SOC 2 (type unverified)2
  • ISO 500012
  • BSI C52
  • SOC 32
  • FedRAMP2
  • GDPR2
  • CSA STAR Level 12

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Countries

  • United States45
  • Germany9
  • France7
  • Switzerland5
  • Singapore3
  • Israel2
  • United Kingdom2
  • China2
  • Netherlands2