Data sovereignty refers to an organization’s ability to retain control over its data — where it is hosted, who can access it, and under which legal jurisdiction it falls.

In practical terms, this means:

• your data is hosted in a defined country or legal area (typically within Europe)
• it cannot be accessed by foreign authorities without an appropriate legal framework
• you maintain control over how the data is accessed and processed

Data sovereignty goes beyond hosting alone. It also includes the providers involved, the applicable laws, and how data flows are managed.

‍

‍

‍

Contracts contain some of the company’s most sensitive information: intellectual property, commercial terms, strategic commitments, and confidential business data. Protecting them is therefore essential.

With regulations such as the US Cloud Act and the strengthening of European frameworks (GDPR, Data Act), questions around data access, jurisdiction, and hosting location have become strategic concerns.

Today, sovereignty is a key decision criterion in CLM projects and is often raised early in the selection process by IT and security teams (CIOs and CISOs).

‍

‍

By default, your contracts are hosted in France on Microsoft Azure infrastructure.

For organizations with stronger sovereignty requirements, Gino also offers a fully sovereign hosting option in France via OVHcloud, certified SecNumCloud by ANSSI.

‍

‍

Gino gives you full control over your hosting architecture.

You can choose between Azure or a fully sovereign infrastructure hosted in France via OVHcloud, helping reduce exposure to extraterritorial regulations and data access risks.

‍

‍

Security is built into the platform by design.

Your data is fully isolated, access is strictly controlled, and every action is tracked through detailed audit logs to ensure complete transparency.

‍

You control access rights according to your organization’s structure: by role, team, or entity.

Each user only has access to the data relevant to them, and every action is fully tracked through detailed audit logs.

‍

‍

No. Your contracts are never used to train AI models.

With Gino, you choose your AI provider (Mistral, OpenAI, or Microsoft), and AI features can be disabled at any time.

AI remains an assistance tool designed to support analysis, always under human supervision and control.

‍

‍

Yes, for any professional use involving sensitive or company data.

With most free versions, submitted data may be used to train the underlying models. From a legal and confidentiality standpoint, this creates a built-in risk by design.

Organizations should instead rely on:

• Enterprise versions
• Private AI environments
• Solutions that contractually guarantee data isolation and no training on customer data (“opt-out” policies)

For legal teams handling sensitive contractual information, these guarantees are essential.

‍

‍

Start by asking the provider for clear technical and transparency documentation.

A trustworthy vendor should be able to explain:

• how the model was evaluated for bias and reliability
• how training data was sourced
• what safeguards are in place for security and compliance

If a provider refuses to share this information under the pretext of “trade secrets,” it should be considered a warning sign.

‍