Sovereign RAG: France Hosting and European Data

For many French and European companies, data sovereignty is not an option but an obligation. This guide explains how to deploy a RAG system compliant with data localization requirements and European regulations.

Why Sovereignty Matters

Stakes for Businesses

Regulatory Framework

GDPR (since 2018):

• Transfers outside EU highly regulated
• Schrems II ruling invalidated Privacy Shield
• Standard Contractual Clauses required for transfers

AI Act (2024-2027):

• Transparency obligations
• AI system documentation
• Potential restrictions on non-European models

NIS2 (2024):

• Information systems security
• Applies to essential entities
• Localization requirements for certain sectors

Sovereign Architecture

100% European Infrastructure

┌─────────────────────────────────────────────────────────────┐
│                    USERS                                     │
│                 (France / Europe)                           │
└───────────────────────┬─────────────────────────────────────┘
                        │
                        ▼
┌─────────────────────────────────────────────────────────────┐
│                 FRANCE HOSTING                               │
│  ┌─────────────────────────────────────────────────────┐    │
│  │                    Frontend                          │    │
│  │              (FR Servers - OVH/Scaleway)            │    │
│  └──────────────────────┬──────────────────────────────┘    │
│                         │                                    │
│  ┌──────────────────────▼──────────────────────────────┐    │
│  │                   Backend API                        │    │
│  │              (FR Servers - OVH/Scaleway)            │    │
│  └──────────────────────┬──────────────────────────────┘    │
│                         │                                    │
│        ┌────────────────┼────────────────┐                  │
│        ▼                ▼                ▼                  │
│  ┌───────────┐  ┌───────────────┐  ┌───────────────────┐   │
│  │ PostgreSQL│  │ Qdrant Vector │  │ Object Storage    │   │
│  │   (FR)    │  │    DB (FR)    │  │    (FR - S3)      │   │
│  └───────────┘  └───────────────┘  └───────────────────┘   │
│                                                              │
└─────────────────────────────────────────────────────────────┘
                        │
                        ▼
┌─────────────────────────────────────────────────────────────┐
│                 LLM PROVIDER                                 │
│  Option 1: Self-hosted (Mistral, Llama on FR GPUs)          │
│  Option 2: European API (Mistral API from Paris)            │
│  Option 3: Regulated API (OpenAI with signed DPA)           │
└─────────────────────────────────────────────────────────────┘

French Hosting Providers

OVH Cloud Configuration

DEVELOPERpython
# Configuration for OVH deployment
import os

# Managed database
DATABASE_CONFIG = {
    "host": os.getenv("OVH_DB_HOST"),  # xxx.db.ovh.net
    "port": 5432,
    "database": "rag_production",
    "user": os.getenv("OVH_DB_USER"),
    "password": os.getenv("OVH_DB_PASSWORD"),
    "sslmode": "require"  # Mandatory encryption
}

# S3-compatible Object Storage
S3_CONFIG = {
    "endpoint_url": "https://s3.gra.io.cloud.ovh.net",  # Gravelines, FR
    "region_name": "gra",
    "aws_access_key_id": os.getenv("OVH_S3_ACCESS_KEY"),
    "aws_secret_access_key": os.getenv("OVH_S3_SECRET_KEY")
}

# Qdrant on private instance
QDRANT_CONFIG = {
    "host": os.getenv("QDRANT_HOST"),  # Private IP
    "port": 6333,
    "grpc_port": 6334,
    "api_key": os.getenv("QDRANT_API_KEY")
}

Sovereign LLMs

European Models

Mistral AI (France):

• Mistral Small 4, Mistral Large 3: open-source (Apache 2.0)
• Mistral Large: API from Paris
• Native GDPR compliance

DEVELOPERpython
from mistralai.client import MistralClient

client = MistralClient(api_key=os.getenv("MISTRAL_API_KEY"))

async def generate_with_mistral(prompt: str, context: str) -> str:
    """
    Generation with Mistral - servers in France
    """
    messages = [
        {
            "role": "system",
            "content": "You are a RAG assistant. Base your answers on the provided context."
        },
        {
            "role": "user",
            "content": f"Context:\n{context}\n\nQuestion: {prompt}"
        }
    ]

    response = client.chat(
        model="mistral-large-latest",
        messages=messages,
        temperature=0.3,
        max_tokens=1000
    )

    return response.choices[0].message.content

European Alternatives:

• Aleph Alpha (Germany): PhariaAI
• LightOn (France): Paradigm
• Hugging Face (France): Hub and Inference API

Self-hosting on French GPUs

DEVELOPERpython
# Mistral deployment on OVH/Scaleway GPU
from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

class LocalMistralLLM:
    def __init__(self, model_name: str = "mistralai/Mistral-7B-Instruct-v0.2"):
        self.tokenizer = AutoTokenizer.from_pretrained(model_name)
        self.model = AutoModelForCausalLM.from_pretrained(
            model_name,
            torch_dtype=torch.float16,
            device_map="auto"
        )

    async def generate(self, prompt: str, max_tokens: int = 500) -> str:
        inputs = self.tokenizer(prompt, return_tensors="pt").to("cuda")

        with torch.no_grad():
            outputs = self.model.generate(
                **inputs,
                max_new_tokens=max_tokens,
                temperature=0.3,
                do_sample=True,
                pad_token_id=self.tokenizer.eos_token_id
            )

        return self.tokenizer.decode(outputs[0], skip_special_tokens=True)

# Scaleway GPU Configuration
# GPU-3070-S instance: ~0.8 EUR/h
# L4 instance: ~0.79 EUR/h (best value)

Sovereign Embeddings

DEVELOPERpython
from sentence_transformers import SentenceTransformer

class SovereignEmbedder:
    def __init__(self):
        # Multilingual models performing well in French
        # Self-hosted, no external API call
        self.model = SentenceTransformer('intfloat/multilingual-e5-large')

    def embed(self, texts: list[str]) -> list[list[float]]:
        # Prefix for E5
        prefixed = [f"passage: {t}" for t in texts]
        return self.model.encode(prefixed).tolist()

    def embed_query(self, query: str) -> list[float]:
        return self.model.encode(f"query: {query}").tolist()

Technical GDPR Compliance

End-to-End Encryption

DEVELOPERpython
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
import base64
import os

class GDPRCompliantStorage:
    def __init__(self, master_key: bytes):
        # Key derivation with random salt
        salt = os.urandom(16)
        kdf = PBKDF2HMAC(
            algorithm=hashes.SHA256(),
            length=32,
            salt=salt,
            iterations=480000,
        )
        key = base64.urlsafe_b64encode(kdf.derive(master_key))
        self.cipher = Fernet(key)

    def encrypt_pii(self, data: str) -> bytes:
        """Encrypt personal data"""
        return self.cipher.encrypt(data.encode())

    def decrypt_pii(self, encrypted: bytes) -> str:
        """Decrypt personal data"""
        return self.cipher.decrypt(encrypted).decode()

    def pseudonymize(self, user_id: str) -> str:
        """Pseudonymize a user identifier"""
        import hashlib
        return hashlib.sha256(user_id.encode() + self.salt).hexdigest()[:16]

Compliant Logging

DEVELOPERpython
import logging
from datetime import datetime
import json

class GDPRLogger:
    def __init__(self, log_file: str):
        self.logger = logging.getLogger("gdpr_audit")
        handler = logging.FileHandler(log_file)
        handler.setFormatter(logging.Formatter('%(message)s'))
        self.logger.addHandler(handler)
        self.logger.setLevel(logging.INFO)

    def log_access(
        self,
        user_id: str,
        action: str,
        data_category: str,
        purpose: str,
        legal_basis: str
    ):
        """
        Log personal data access
        """
        entry = {
            "timestamp": datetime.now().isoformat(),
            "user_id_hash": self._hash_id(user_id),  # Don't log ID in clear
            "action": action,
            "data_category": data_category,
            "purpose": purpose,
            "legal_basis": legal_basis,
            "retention_days": self._get_retention(data_category)
        }

        self.logger.info(json.dumps(entry))

    def log_deletion(self, user_id: str, data_deleted: list):
        """
        Log deletion (right to erasure)
        """
        entry = {
            "timestamp": datetime.now().isoformat(),
            "action": "RIGHT_TO_ERASURE",
            "user_id_hash": self._hash_id(user_id),
            "data_categories_deleted": data_deleted,
            "confirmation": True
        }

        self.logger.info(json.dumps(entry))

Consent Management

DEVELOPERpython
from datetime import datetime, timedelta
from enum import Enum

class ConsentPurpose(Enum):
    RAG_INDEXING = "rag_indexing"
    CONVERSATION_HISTORY = "conversation_history"
    ANALYTICS = "analytics"
    PERSONALIZATION = "personalization"

class ConsentManager:
    def __init__(self, db):
        self.db = db

    async def request_consent(
        self,
        user_id: str,
        purpose: ConsentPurpose,
        data_description: str
    ) -> dict:
        """
        Prepare a consent request
        """
        return {
            "consent_id": self._generate_id(),
            "purpose": purpose.value,
            "data_description": data_description,
            "legal_text": self._get_legal_text(purpose),
            "revocable": True,
            "valid_until": (datetime.now() + timedelta(days=365)).isoformat()
        }

    async def record_consent(
        self,
        user_id: str,
        consent_id: str,
        granted: bool,
        method: str  # "explicit_click", "api", etc.
    ):
        """
        Record user consent
        """
        await self.db.insert("consents", {
            "user_id": user_id,
            "consent_id": consent_id,
            "granted": granted,
            "method": method,
            "timestamp": datetime.now(),
            "ip_address_hash": self._hash_ip(),
            "user_agent_hash": self._hash_ua()
        })

    async def verify_consent(
        self,
        user_id: str,
        purpose: ConsentPurpose
    ) -> bool:
        """
        Verify if user has given consent
        """
        consent = await self.db.find_one("consents", {
            "user_id": user_id,
            "purpose": purpose.value,
            "granted": True,
            "revoked": False,
            "valid_until": {"$gte": datetime.now()}
        })

        return consent is not None

Regulated Data Transfers

Using US APIs with Precautions

If using OpenAI or other US API is necessary:

DEVELOPERpython
class SecureAPIWrapper:
    def __init__(self, api_key: str):
        self.client = OpenAI(api_key=api_key)

    async def generate_safe(
        self,
        prompt: str,
        context: str,
        pii_filter: bool = True
    ) -> str:
        """
        API call with data protection
        """
        # 1. Detect and mask PII
        if pii_filter:
            context = self._mask_pii(context)
            prompt = self._mask_pii(prompt)

        # 2. API call
        response = await self.client.chat.completions.create(
            model="gpt-4",
            messages=[
                {"role": "system", "content": "..."},
                {"role": "user", "content": f"{context}\n\n{prompt}"}
            ]
        )

        answer = response.choices[0].message.content

        return answer

    def _mask_pii(self, text: str) -> str:
        """
        Mask personal data before sending
        """
        import re

        # Emails
        text = re.sub(
            r'\b[\w.-]+@[\w.-]+\.\w+\b',
            '[EMAIL]',
            text
        )

        # Phone numbers
        text = re.sub(
            r'\b(?:\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b',
            '[PHONE]',
            text
        )

        return text

Transfer Documentation

DEVELOPERpython
class TransferRegistry:
    """
    Registry of transfers outside EU (GDPR obligation)
    """

    def __init__(self, db):
        self.db = db

    async def register_transfer(
        self,
        destination_country: str,
        recipient: str,
        data_categories: list,
        legal_basis: str,
        safeguards: list
    ):
        """
        Register a transfer outside EU
        """
        await self.db.insert("transfer_registry", {
            "timestamp": datetime.now(),
            "destination": destination_country,
            "recipient": recipient,
            "data_categories": data_categories,
            "legal_basis": legal_basis,  # "SCC", "adequacy_decision", etc.
            "safeguards": safeguards,
            "documented_by": "system",
            "review_date": datetime.now() + timedelta(days=365)
        })

    async def generate_report(self) -> dict:
        """
        Generate report for DPO
        """
        transfers = await self.db.find("transfer_registry")

        return {
            "report_date": datetime.now().isoformat(),
            "total_transfers": len(transfers),
            "by_country": self._group_by_country(transfers),
            "by_legal_basis": self._group_by_basis(transfers),
            "pending_reviews": self._get_pending_reviews(transfers)
        }

Sovereignty Checklist

Infrastructure

• French/European host with certifications (ISO 27001, HDS if healthcare)
• Data stored exclusively in France/EU
• Backups on European territory
• Encryption at rest and in transit (TLS 1.3)
• Restricted access with strong authentication

LLM and AI

• European model (Mistral) or self-hosted
• If US API: DPA signed, PII masked
• AI processing documentation

GDPR

• Records of processing up to date
• Consents tracked
• Rights exercise mechanisms
• Retention policy defined
• Audit logs preserved

Contractual

• DPA with all processors
• Standard Contractual Clauses if transfer outside EU
• Impact assessment (DPIA) if sensitive data

Learn More

• RAG Security and Compliance - Complete security guide
• GDPR and Chatbots - Chatbot compliance
• AI Act and RAG - AI Act implications

---

Turnkey Sovereign RAG with Ailog

Building a sovereign RAG infrastructure requires varied expertise. With Ailog, benefit from a 100% French solution:

• OVH Cloud hosting in Gravelines and Roubaix
• Data never transferred outside EU
• Mistral models for generation
• Self-hosted embeddings without external API calls
• Native GDPR compliance with DPA provided
• French support and French documentation

Try Ailog for free and deploy a sovereign RAG with peace of mind.