Decision guide

Choosing a sovereign workplace:
seven questions for every supplier.

A sovereign workplace is a digital workplace (email, files, documents, messages, AI) where not only the data is in Europe, but the supplier also falls under European law and you can take your data with you. That is digital sovereignty in practice. You ask these seven questions of every supplier, including us. Per question you see why it counts and how Noveu answers it, with the measures you can use.

Seven questions,
and the answer from Noveu per question.

Per question you see the available functions, measures and their substantiation.

1. 1

   Where is my data stored, and who is the processor?

   Data location is the first question, not the last. Ask about the data centre, the backup location and who the controller is dealing with.

   At Noveu

   Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein. Cloudflare, Inc. (US) sits at the edge for DNS, CDN and DDoS protection, under the EU-US Data Privacy Framework and standard contractual clauses.

2. 2

   Which law does the supplier fall under?

   An EU data centre of a US provider remains subject to US law, including the CLOUD Act. Jurisdiction is about the company, not about the location of the servers.

   At Noveu

   Noveu Solutions is a Dutch company under Dutch law, without a US parent company. The AI generation layer runs at Mistral AI, a French entity under EU law.

3. 3

   Which sub-processors are there, and are they public?

   Every service relies on others. A supplier that does not publish its sub-processors asks for trust without insight.

   At Noveu

   The full list is public at noveu.eu/en/legal/sub-processors, with each party's establishment, processing location, purpose and safeguard.

4. 4

   Can I leave again, with my data?

   Sovereignty without an exit is a golden cage. Ask per service about the export path and the format.

   At Noveu

   Email via IMAP, calendar as ICS, documents as PDF and DOCX, cancellable monthly with monthly payment.

5. 5

   Which frameworks are demonstrably covered by measures: NIS2, BIO, NTA 7516, GDPR?

   Government and healthcare have their own frameworks. Do not ask whether a supplier "complies", but which measures are in place, which exist only on paper and where that is documented.

   At Noveu

   TLS for mail traffic, an audit log per organisation with CSV export and a public list of sub-processors.

6. 6

   Where does the AI run, and what goes to the language model?

   AI has two layers: search and generation. Ask per layer where it runs and which data goes to the model.

   At Noveu

   When AI is used, we engage Mistral AI, a French company; according to Mistral, that data is stored in the EU by default. The role and the country of the parties involved are on our public list of sub-processors.

7. 7

   What does it really cost, without add-ons?

   Compare the total: base licence, email with your own domain, AI assistant and support. A low entry price with paid add-ons is not a low price.

   At Noveu

   One rate per month, email and calendar included. The current amounts are only on noveu.eu/en/pricing.

The same questions,
a different weight per sector.

What digital sovereignty means exactly, and what an EU region of a hyperscaler does and does not solve, is set out in detail on the page about sovereign cloud. Background for directors can be found in digital sovereignty in three questions.

Questions about choosing a sovereign workplace

Ask us
the seven questions.

We answer them per organisation, with the documents. The current rates are on the pricing page.