What is sovereignty?

Sovereignty is not just a slogan; it is the ability to:

• Comply with European best practices and requirements regarding data protection and integrity.
• Minimise the risks associated with suppliers subject to foreign legislation with extraterritorial reach.
• Ensure compliance with the GDPR.

For a CLM, this concretely means knowing where the data is hosted, who can access it, and under what rules.

Why it is critical in a CLM project

Contracts hold an organisation's most sensitive information: intellectual property, patents, strategic commitments, commercial terms.

• The Cloud Act is based on a principle of extraterritoriality: under certain conditions, it allows US authorities to request access to data hosted by US providers, even when that data is physically located outside the United States.
• The requirements of the GDPR and the European Data Act are getting stricter: European regulatory convergence has been accelerating for the past 18 months.

In CLM projects, IT departments and CISOs now treat sovereignty as a prerequisite, even a blocking criterion, before any purchase decision. Legal departments need clear, defensible arguments to meet IT requirements.

Gino's 3 pillars

Activatable sovereignty: where the organisation requires it, Gino can be deployed in a 100% sovereign hosting environment in France through OVHcloud. It is not a constraint by default: it is a capability activated according to the client's context.

Two-layer security: security at Gino goes beyond hosting. It combines a robust infrastructure with a security-by-design approach in the product, with data segregation, advanced permission management and traceability. Security is built into every stage of development, not added at the end of the chain.

Controlled, configurable AI: Gino's AI offering is configurable (choice of provider), can be switched off, and is designed to prevent any use of client data for training purposes, with perimeters segregated by client.

Infrastructure

• OVHcloud private cloud: dedicated hosting, operated by a French provider, meeting European data protection requirements (notably the GDPR).
• BCP/DRP in France: business continuity and disaster recovery plan with two French sites: Gravelines (primary) and Paris (secondary).
• France-to-France redundancy: the two sites are geographically distinct, with business continuity provided for without leaving French territory.

Product

1. Audit log: you can prove who did what, and when.
2. Security by design: security is not an audit at the end of a project; it is built into the design of the product, continuously.
3. Data segregation: not everyone has access to everything; data is segmented by business unit, entity and scope.
4. Advanced permission management: each user accesses only what they need, and this segmentation evolves with the organisation (acquisitions, new business units, new roles).

In practice for a legal department

Thanks to clearly defined architecture and design choices (activatable hosting in France, business continuity, data segregation, traceability), the legal department can:

• Move forward in a CLM benchmark without being stopped by a security or sovereignty question.
• Answer first-level IT requirements with factual, verifiable elements.
• Rely on an infrastructure and a product able to meet IT requirements when the level of scrutiny increases.

‍