Hosting and routing
Route selected AI traffic through France without overclaiming sovereignty
Where a request is processed matters, but location alone does not settle security, confidentiality, GDPR or EU AI Act obligations. The route, contract, data and access model all matter.
Current DUBSAR status
A product direction with explicit limits
The current private portal is hosted on Scaleway infrastructure in France. Customer Gateway routing through Scaleway Generative APIs remains a target capability being proven, not a generally available service. Exact regions, services and contractual conditions must be verified for each deployment.
Hosting and routing
Minimise before you route
The first protection is not a country label. It is deciding whether personal data, credentials, client references or confidential content need to leave the organisation at all.
A connected Gateway can apply deterministic rules to remove, mask or refuse selected content before forwarding an approved request.
- Detect prohibited secrets and data classes
- Redact only when a verifiable transformation is allowed
- Refuse unknown providers or routes
- Record the decision without retaining unnecessary payloads
Hosting and routing
Offer a France-hosted route when it fits the policy
The target journey would let an organisation retain approved providers or choose a Scaleway Generative API route for selected use cases. DUBSAR would remain the policy layer rather than the model provider. This customer-routing option is not yet generally available.
Provider, model, endpoint and deployment region must remain visible in the evidence rather than being hidden behind a generic 'sovereign AI' label.
Hosting and routing
Hosting in France reduces some complexity, not every obligation
French or European processing may simplify certain procurement questions, but server location alone does not settle international-transfer risk. The controller must verify the provider, recipient, subprocessor and remote-access chain as well as contracts and applicable law.
It also does not remove the need for a lawful basis, purpose limitation, security controls, retention rules, transparency or human oversight. DUBSAR therefore treats hosting as one control among several, never an automatic compliance certificate or immunity from extraterritorial law.
External sources
Check the official sources and current product claims.
Frequently asked questions
What to know before going further.
Does France-hosted infrastructure automatically make an AI workflow GDPR-compliant?
No. Location can reduce some transfer risks, but compliance also depends on purpose, data, contracts, access, retention and the organisation's legal basis.
Must a customer replace its existing AI provider with Scaleway?
No. The target architecture is provider-aware and keeps Scaleway as an optional route. Every provider route must be implemented, approved and proven before DUBSAR can claim to govern it.
Read next
Continue with another DUBSAR guide.
The portal remains in private testing. These guides explain what DUBSAR is proving — and what it does not yet claim.