France-hosted RAG: what sovereignty really changes
Hosting a RAG in France settles one point: where your documents and their index live. Sovereignty depends on three other questions. Under which law does each provider in the chain operate? Where do model calls run? Who holds the keys? This guide takes them one by one, with official sources and a decision grid.
Transparency note: this guide is published by IgnitionAI, the company behind IgnitionRAG. Regulatory and technical claims link to primary sources consulted on 22 October 2026. Facts about IgnitionRAG come from its public pages. It contains no IgnitionAI estimate. Sources are listed in the "Methodology and sources" section.
What "hosted in France" guarantees, factually
A RAG (Retrieval-Augmented Generation) system stores three things: your documents, the extracted text and a vector index. Saying it is hosted in France means this data resides on servers located in France. That is useful information. It answers the question "where?".
It does not answer the question "under whose control?". The RAG guide published by the French Directorate General for Enterprise (DGE) makes the point: with cloud hosting, data travels between the client company and the provider's servers. On data isolation, the guide favours self-hosting on internal servers, on one condition: that the information system's cybersecurity is properly handled.
| Question | Settled by hosting in France | Not settled by it |
|---|---|---|
| Where are documents and index stored? | Yes | |
| Under which law does the host operate? | Depends on the company running the service | |
| Where do model calls run? | Depends on the provider's architecture | |
| Who pays for and holds the model keys? | Depends on the contract (SaaS or licence) | |
| Which ancillary services process data? | Authentication, payment, email, logs |
Sources: DGE, RAG guide, November 2024, pp. 14-15. Column split is IgnitionAI's reading.
The trap nobody reads: the law that applies to the provider
US law contains a provision every RAG buyer should read in full. Section 2713 of Title 18 of the US Code was introduced by the 2018 CLOUD Act. It requires a provider of electronic communication service or remote computing service to preserve or disclose the data it holds. The obligation applies "regardless of whether such communication, record, or other information is located within or outside of the United States".
The consequence is simple. What counts is the provider's legal attachment, and the city of the data centre does not settle it. A service hosted in Paris by a company subject to this provision stays within its scope.
ANSSI, the French national cybersecurity agency, built an answer to this risk. Its SecNumCloud qualification recognises cloud offers that aim to protect sensitive data "against cybercriminal threats and the application of extraterritorial laws" (our translation). The agency also states a limit: the qualification does not prejudge the security level of the customer services built on the qualified offer. A RAG installed on a qualified infrastructure therefore does not inherit the qualification automatically.
Three questions to ask every provider in the chain:
- Which company runs the service, and in which country is it established?
- Is the offer in use SecNumCloud-qualified, and for which exact scope?
- Which subprocessors handle data, where, and with which transfer safeguards?
The four layers of a RAG to locate separately
A RAG is made of several components, and each one can live somewhere else. The DGE guide says so explicitly: hosting can differ by component. One of the cases it presents combines vector search on in-house servers with a model call in the cloud.
| Layer | What it holds | Question to ask |
|---|---|---|
| Storage and index | Files, extracted text, vectors | Where, with whom, with which encryption? |
| Language model | Question, retrieved passages, answer | Where does inference run, under which contract? |
| Ancillary services | Accounts, payments, transactional email | Which providers, in which countries? |
| Logs and traces | Queries, cited passages, errors | Where are they kept, and for how long? |
The model layer is the one most often forgotten. For every question, the passages retrieved from your documents are sent to the model to write the answer. An index hosted in France paired with a model called elsewhere therefore sends excerpts of your documents out with every request.
SaaS, customer cloud or self-hosted on internal servers: the three modes compared
The DGE guide compares hosting modes for a RAG. Its conclusions fit in one table.
| Mode | Strengths (DGE) | Weaknesses (DGE) |
|---|---|---|
| Internal servers (self-hosted) | Full control over data and infrastructure | Buying and maintaining equipment, GPUs in particular |
| Private cloud | Balance between control and flexibility, high security guarantees | |
| Public cloud | Service flexibility | Data travels between the company and the provider |
| SaaS | No skills needed to maintain a cloud or GPUs | Little control over data; SecNumCloud-qualified services offer guarantees |
Source: DGE, RAG guide, November 2024, p. 14.
The same guide gives an order of magnitude for lead time, flagged as "indicative": the same project may take 6 months to deploy on internal infrastructure against 2 months in the cloud. This figure is the DGE's. It does not describe any particular project.
The choice therefore depends less on principle than on three parameters: document sensitivity, the internal skills available to run the infrastructure over time, and the acceptable lead time.
What IgnitionRAG does, layer by layer
IgnitionRAG is an enterprise RAG that answers from your documents and cites its sources. Here is where it stands on each of the four layers, according to its public pages.
Storage and index. The infrastructure (database, servers) is hosted in France with OVH.
Language model. On SaaS (Solo and Team plans), AI is managed by the platform, with credits included: you provide no key. The privacy policy states that model calls then go through the platform's infrastructure. With a licence, BYOK ("bring your own keys") is available: model calls can then use the customer's keys. The policy does not specify the model provider or where the model runs on SaaS: if this matters to you, ask before ingesting sensitive documents.
Ancillary services. Authentication, payments and transactional email go through providers listed in the privacy policy. Some are established in the United States. The policy describes the standard contractual clauses in place for these transfers.
Logs and traces. The privacy policy sets technical log retention at 12 months.
Deployment. The Agency/ESN licence, quoted on request, deploys on the customer's infrastructure (Azure, AWS or Google Cloud) or with IgnitionAI, with BYOK available.
| Offer | Price | Model | Data hosting |
|---|---|---|---|
| Solo | €59 excl. VAT/month | Managed AI, credits included | IgnitionRAG infrastructure, OVH France |
| Team | €249 excl. VAT/month | Managed AI, credits included | IgnitionRAG infrastructure, OVH France |
| Agency/ESN licence | On quote | BYOK available | Customer cloud (Azure, AWS, GCP) or IgnitionAI |
This guide does not present IgnitionRAG as a SecNumCloud-qualified offer. The licence currently deploys on the customer's Azure, AWS or Google Cloud, or with IgnitionAI. If your use case requires SecNumCloud qualification, check it layer by layer, with the limit ANSSI points out above.
Decision grid
| Your situation | Approach to study |
|---|---|
| Everyday internal documents, no specific regulatory requirement, small IT team | SaaS hosted in France; check the subprocessor list and where model calls run |
| Sensitive documents, requirement to avoid exposure to extraterritorial laws | SecNumCloud-qualified offer for each layer concerned, or self-hosting on internal servers |
| Azure, AWS or Google Cloud already contracted and audited by your CISO | Licensed deployment in your cloud, with your own model keys |
| ESN or agency deploying for several clients | Agency/ESN licence, deployed at each client or with IgnitionAI; see our white-label guide |
| Team able to run GPUs over time, high query volume | Self-hosting on internal servers, following the DGE criteria |
Grid basis: DGE, RAG guide, November 2024, pp. 9 and 14-15; ANSSI, SecNumCloud page. Mapping situations to approaches is our reading and is not legal advice.
Methodology and sources
Regulatory and institutional sources
- 18 U.S.C. § 2713, Required preservation and disclosure of communications and records, official text published by the Office of the Law Revision Counsel of the US House of Representatives; Legal Information Institute (Cornell) version: law.cornell.edu. Added by Pub. L. 115-141 of 23 March 2018. Consulted on 22 October 2026.
- ANSSI, Cloud: SecNumCloud qualification and security visa (in French). Consulted on 22 October 2026.
- DGE, Guide de la génération augmentée par récupération (RAG) (RAG guide, in French), November 2024, pp. 9, 14 and 15. Consulted on 22 October 2026.
Technical sources
- OVHcloud, regions and availability zones: location of French regions. Consulted on 22 October 2026.
- IgnitionRAG privacy policy and pricing page: hosting, subprocessors, AI configuration per offer. Consulted on 22 October 2026.
IgnitionAI estimates
None. The only lead-time figures are the DGE's, quoted with its "indicative" label.
Limits
This guide lists questions to ask and selection criteria. It does not legally qualify your situation. Transfer and subprocessing decisions must be validated with your DPO and CISO.
Last source review
22 October 2026.
Get started
The Solo (€59 excl. VAT/month) and Team (€249 excl. VAT/month) plans include AI credits. The trial includes 14 days and 100 credits, without a payment card. For a licensed deployment in your cloud, contact us from the pricing page.
FAQ
Is a RAG hosted in France out of reach of the CLOUD Act?
Not automatically. Section 2713 of Title 18 of the US Code applies to data held by a provider subject to it, wherever the data is stored. You need to check the legal attachment of every provider in the chain, in addition to server location.
What does the SecNumCloud qualification bring?
According to ANSSI, it recognises cloud offers that aim to protect sensitive data against cybercriminal threats and the application of extraterritorial laws. It does not prejudge the security of the services the customer builds on the qualified offer.
Where is IgnitionRAG data hosted?
The infrastructure (database, servers) is hosted in France with OVH. Authentication, payments and transactional email go through providers listed in the privacy policy.
Do I need to provide a model key on SaaS?
No. The Solo and Team plans include platform-managed AI with credits included. BYOK is reserved for licences.
Can we deploy IgnitionRAG in our own cloud?
Yes, under the Agency/ESN licence, quoted on request: deployment on Azure, AWS or Google Cloud, or with IgnitionAI, with BYOK available.
Deploy AI agents that work for your company.
Connect authorized knowledge and tools, then put an agent to work where your team needs it.