Every field is source-linked and dated.See the rubric behind the grades.

How we grade
Sovereign AI Registry
ExploreBlogGov accessCertsCountries

Footer

Sovereign AI Registry

The compliance registry for AI vendors. Data residency, training defaults, retention, subprocessors and EU AI Act posture — one row per vendor, product and deployment, every claim linked to its source.

Registry

  • Explore vendors
  • Deployment models
  • Categories
  • Countries

Compliance

  • Gov access exposure
  • EU AI Act roles
  • Certifications

Resources

  • FAQ
  • Methodology
Built with ShipMore·Build yours →

© 2026 Sovereign AI Registry. All rights reserved.

  1. Explore
  2. Sherlock (Managed Generative AI)
S(

Sherlock (Managed Generative AI)

Sovereignty grade A- (84/100). EU-only residency; no training on your data. CloudFerro, Poland.

Category
sovereign-host
EU AI Act role
Deployer
Deployments
Hosted API
Certifications
ISO 27001ISO 9001
Government access exposure
No non-EU government access
Categories
Sovereign host

Details

Deployment
hosted
Hq Country
Poland
Hq City
Warsaw
Ownership
private-eu-owned
Founded
2015
Trust Center Url
cloudferro.com/privacy-policy
Training Default
never
Residency Options
WAW3-1 (Netia, Poland), WAW3-2 (Netia, Poland), WAW4-1 (Orange Łazy, Poland), LCJ1-1 (CloudFerro Łódź, Poland), FRA1-2 (NTT/e-shelter, Germany)
Gov Access Exposure
none-eu
Eu Ai Act Role
deployer
Certs
ISO 27001, ISO 9001
DPA available
yes
Zero Retention Available
Yes
Retention Default
"It adheres to a strict no-training policy, meaning user data is not stored or used for model training." The models run in a Polish data centre.
Retention Exceptions
The no-training and no-storage commitment appears in CloudFerro's own product documentation and blog rather than in the privacy policy, which covers website and contract data only.
Subprocessors
Netia S.A. (PL) — colocation, Orange Polska (PL, Łazy) — colocation, NTT / e-shelter (DE, Frankfurt) — colocation
Subprocessor Count
3
Transfer Mechanism
intra-eu
Eu Procurement Ready
pass
Eu Procurement Reason
The only registry row that serves a state-backed national model: PLLuM, built by a consortium of Polish scientific institutions with the Ministry of Digital Affairs, sits in the catalogue next to Llama, DeepSeek and MiniMax. Four Polish regions plus Frankfurt, all colocation named on the site and all inside the Union, ISO 27001 and ISO 9001, a strict no-training policy and OpenAI-compatible endpoints. The gap is where the commitments live: the no-training and no-storage promise is made in product documentation and a how-to blog post, not in the privacy policy or a service-specific DPA annex, which is a weaker place for a buyer's counsel to have to find it.
Training Evidence Url
cloudferro.com/blog/how-to-use-cloudferro-ai-hub-sherlock
Training Claim Basis
stated
Training Confidence
medium
Residency Evidence Url
cloudferro.com
Residency Claim Basis
stated
Residency Confidence
high
Retention Evidence Url
cloudferro.com/blog/how-to-use-cloudferro-ai-hub-sherlock
Retention Claim Basis
stated
Retention Confidence
medium
Subprocessors Evidence Url
cloudferro.com
Subprocessors Claim Basis
stated
Subprocessors Confidence
medium
Residency Class
eu-only
Portability / Exit Path
serves-open-models
Subprocessor Jurisdiction
eu-only
Underlying model providers
PLLuM (Polish scientific consortium, Ministry of Digital Affairs), Meta (Llama 3.1 / 3.3), DeepSeek, MiniMax
At a glance
Governance Grade
A-
Governance Score
84
EC SOV-2 Legal & Jurisdictional (0-4)
3
EC SOV-3 Data & AI (0-4)
2
Website

Similar

Read AI · Sep 2026

RARead AI meeting assistant

Sovereignty grade F (24/100). No EU residency. Read AI, United States.

meeting-ai
Governance Grade
F
Fathom · Aug 2026

FAFathom AI notetaker

Sovereignty grade D (35/100). No EU residency. Fathom, United States.

meeting-ai
Governance Grade
D
Granola · Sep 2026

GAGranola AI notepad

Sovereignty grade D (30/100). No EU residency. Granola, United States.

meeting-ai
Governance Grade
D

More EU AI Act role

  • Deployer59
  • General-purpose AI (GPAI)10
  • provider9
  • GPAI with systemic risk5

More Deployments

  • Hosted API68
  • Self-hosted weights6
  • On-premise6
  • Private VPC2

More Certifications

  • SOC 2 Type II46
  • ISO 2700136
  • ISO 4200113
  • ISO 270177
  • ISO 277017
  • ISO 270186
  • HDS5
  • HIPAA4
  • CSA STAR4
  • C54
  • ISO 90013
  • PCI DSS3
  • FedRAMP High3
  • ISO 27001:20223
  • SOC 2 (type unverified)2
  • ISO 500012
  • BSI C52
  • SOC 32
  • FedRAMP2
  • GDPR2
  • CSA STAR Level 12

More Government access exposure

  • US CLOUD Act44
  • No non-EU government access27
  • Mixed jurisdiction9
  • PRC National Intelligence Law2

More Categories

  • Coding assistant15
  • meeting-ai13
  • Sovereign host13
  • Inference host13
  • SaaS-embedded11
  • Foundation model11
  • Cloud platform7