CitadeaCitadea
Trust & compliance

Sovereignty you can verify

EU jurisdiction, no Cloud Act exposure, and an honest compliance roadmap. We never claim a certification we do not hold.

What is true today

  • Data hosted exclusively in the EU
  • EU company (Yggdrasil Digital SASU, France)
  • No US parent — no Cloud Act exposure
  • EU AI Act-aligned architecture (deployer/provider docs)
  • GDPR — DPA available on request
  • SecNumCloud — qualification in progress (target 2027)

Certifications & frameworks

GDPR

Active

Data hosted exclusively in the EU. DPA and processing register available on request.

EU AI Act

Active

Native compliance architecture — deployer and provider documentation available.

SecNumCloud

In progress · 2027

Qualification in progress — documented J0/J1 path for sensitive workloads.

ISO 27001

Planned · 2028

ISO 27001 certification planned — ISMS being deployed.

SecNumCloud roadmap

2026 Q2

Phase 1 — Architecture

  • Firecracker isolation
  • Encryption at rest
  • Customer sovereign keys
2026 Q4

Phase 2 — Qualification

  • Preparatory ANSSI audit
  • J0/J1 documentation
  • Penetration testing
2027

Phase 3 — Certification

  • SecNumCloud submission
  • Sensitive-data hosting
  • Dedicated enterprise support

EU AI Act

Deployer documentation for AI systems hosted on Citadea — available before enterprise GA.

EU AI Act deployer checklist

  • AI system register and documented risk classification
  • Traceability of inference logs and automated decisions
  • Human oversight for high-risk systems
  • Training and inference data hosted in the EU
  • DPA and up-to-date subprocessor list on /trust
  • Incident notification procedure (< 72 h)

Subprocessors

NamePurposeLocationUpdated
CloudflareCDN / DDoS edge protectionEU2026-06-01
StripePayments (EU entity)EU2026-06-01
ResendTransactional emailEU2026-06-01
EDFPower supplyFrance2026-06-01
Contact salesStart free