Residency is a hard constraint in the policy engine, not a scoring preference. A cheaper model in the wrong jurisdiction is not a trade-off to weigh — it is not a candidate.
Allowed and denied regions and providers filter the candidate set. Ranking only ever orders what survived that filter, so nothing downstream — not cost, not a learned preference, not a semantic match — can reintroduce an endpoint outside the permitted region.
A data classification can require endpoints to carry specific tags: EU processing, no-training. All listed tags must be present. An endpoint missing one is infeasible rather than deprioritised.
For data that must not leave your estate at all, a self-hosted endpoint speaking the same shape drops in with no code change — the embedding and semantic layers are provider-neutral by construction.
When policy declines a model, the manifest records which candidates were refused and under which reason code. A residency rule you cannot evidence after the fact is one you cannot defend in an audit.
Four things, stated plainly, because a residency page that lists only strengths is exactly the document a buyer cannot rely on.
The software runs in the EU. Planverity the company is established in the United Kingdom. Those are different facts and we will not blur them — if your requirement is an EU-established processor rather than EU-hosted processing, that distinction is the one that matters, and it is worth raising with us before you build on it.
Planverity enforces the residency metadata recorded in your registry. It does not independently audit where a provider actually processes data — that assurance comes from your contract with them, and the registry is where you record what they promised.
We hold no SOC 2, ISO 27001 or equivalent certification, and make no certification claim. “SOC 2 ready” without an audit behind it is precisely the sort of claim this product exists to argue against.
Under bring-your-own-key the provider bills you directly and processes under your agreement with them. Planverity decides what is permitted and records what happened; it does not change who your data processors are.
Publish a policy that permits only EU endpoints, and watch what it refuses.
Get an API key