AI providers in France for strict data privacy (2026): model hosting, gateways, observability

You are building something with language models, and your data cannot leave Europe, or cannot end up within reach of US authorities. So you need an AI provider in France for hosting models with strict data privacy, and probably a gateway, an orchestration layer and some way to track usage that obey the same rules. This guide lists the French and European options that actually exist in late 2026, what each one really promises (with links to their own documentation), and where the gaps are.

The short answer

For strict data privacy in France, the safest AI providers are French companies that run inference in France and retain nothing. For model APIs, that means Mistral AI (EU hosting by default, zero data retention on request), Scaleway Generative APIs (Paris, zero retention by default) and OVHcloud AI Endpoints. If you need SecNumCloud, look at Cloud Temple or OUTSCALE.

Everything below explains how to check those claims yourself, and covers the layers around the model: gateways, agent platforms and observability.

How to evaluate an AI provider for data privacy

"Hosted in Europe" is the most common claim and the least useful one. Four questions matter more. Our guide to sovereign AI agents, GDPR and the CLOUD Act covers the legal background in detail; here is the practical version.

1. Company nationality, not just data location

The US CLOUD Act lets US authorities compel a US provider to hand over data in its "possession, custody or control", wherever it is stored (US Department of Justice). A Paris region run by a US company, or by a European subsidiary of one, stays exposed. If you want AI without CLOUD Act exposure, the company that runs inference, and every company in the request path (gateway, logging, hosting), must be outside US jurisdiction.

2. Where inference actually runs

Storage and inference are different things. A provider can keep your files in France and still send each prompt to a model in the US. Ask, for every model and every fallback: in which country is this request processed, and can it ever be routed elsewhere?

3. Data retention and training

Even a European provider may keep prompts for abuse monitoring or use them to improve models. Look for three things in writing: how long inputs and outputs are kept, whether they are used for training, and who can read them. Zero data retention (ZDR) means the provider keeps nothing once the response is returned. Some offer it by default, others only on request.

4. Certifications

• SecNumCloud is the French cybersecurity agency ANSSI's qualification for cloud providers. Version 3.2 adds protection against non-EU laws: EU registered office, limits on non-EU shareholders, no access from outside the EU (ANSSI). It is the strongest French benchmark for "no CLOUD Act exposure".
• HDS (Hébergeur de Données de Santé) is the French certification required to host health data.
• GDPR compliance and SOC 2 are useful but say nothing about foreign jurisdiction.

A rule of thumb: the qualification has to cover the specific service you use, not just one of the provider's other platforms.

Model makers and inference APIs in France

These are the providers that actually run the model and see your prompts. They are the most important choice.

• Mistral AI (Paris) makes its own models and serves them through its API. Its help centre states: "By default, your data is hosted in the European Union", and in the US only if you explicitly use the US endpoint. It adds that some features may temporarily send data outside the EU (Mistral help centre). Zero data retention is available to eligible paid organisations, on request and after review, for stateless calls such as chat completions, embeddings and OCR; stateful products like Agents, Conversations and files are excluded (Mistral docs). Its data processing addendum also allows training on customer data unless you opt out, so check that setting (Mistral DPA).
• Scaleway Generative APIs (French cloud provider) serves open-weight models through an OpenAI-compatible API (Scaleway). Its data privacy page states that it applies "a Zero Data Retention Policy" by default, that prompts are not used for training, and that data may be stored in Paris. Content can be kept for up to two weeks only when a request errors or looks malicious (Scaleway docs).
• OVHcloud AI Endpoints (French cloud provider) offers LLMs, embeddings, audio and vision models behind an OpenAI-compatible API. Its documentation says the infrastructure is in Gravelines, France, and that data is not stored or shared during or after model use (OVHcloud docs). OVHcloud holds a SecNumCloud qualification for a separate platform (OVHcloud); we found nothing saying AI Endpoints is covered.

SecNumCloud inference

If your data falls under the SREN law or you work for the public sector, you need a qualified offer:

• Cloud Temple LLMaaS: an OpenAI-compatible API that, according to its documentation, runs on infrastructure holding the SecNumCloud 3.2 qualification, hosted in Cloud Temple's French data centres (Cloud Temple docs). The product page also mentions HDS-certified infrastructure and says data is "neither used nor stored after processing" (Cloud Temple).
• OUTSCALE (Dassault Systèmes): LLM as a Service with Mistral AI models on its SecNumCloud infrastructure (Dassault Systèmes). The French State's "Assistant IA" for civil servants runs on Mistral models hosted by Outscale, as we noted in our French AI alternatives guide.

Check the current model catalogue with each provider: SecNumCloud offers usually carry fewer and smaller models than the public APIs.

AI gateways and routers in France

An AI gateway sits between your code and the model providers: one API key, routing, fallbacks, budgets. It also sees every prompt, so it counts as a sub-processor with the same weight as the model provider.

• Eden AI (Lyon) is a French AI gateway with an OpenAI-compatible API over many models and providers. It advertises a dedicated EU endpoint where non-EU models are refused, and zero data retention by default (Eden AI). That makes it the most direct answer to "AI gateway in France" we found.
• Self-hosted gateways are the other route. LiteLLM is an open-source gateway (MIT licence for the core, a separate licence for enterprise features) that you run on your own European server; it records each request's cost and supports per-key and per-team budgets (LiteLLM docs). Since it runs on your infrastructure, the jurisdiction is that of your host and your model providers.

What to check on any gateway: where it runs, whether it logs prompts (and for how long), and whether it can be forced to route only to providers you approve. Zero-data-retention routing, a gateway setting that only sends requests to providers that retain nothing, is useful, but it only helps if the gateway itself is outside US jurisdiction.

LLM orchestration and agent platforms in France

"Orchestration" covers two different needs: a platform where agents are configured and run, or a framework in your own code.

• Mistral AI Agents API: agents with built-in tools (code execution, web search, document library), MCP connectors and handoffs between agents (Mistral docs). Note that Agents and Conversations are stateful and are not covered by Mistral's zero data retention.
• Dust (Paris): a platform for company agents connected to internal tools. Its security page says you can "host in the EU or US" and that it is SOC 2 Type II certified (Dust). The models you pick may still be run by US providers, so choose the models as carefully as the region.
• LightOn (Paris, listed on Euronext Growth): its Paradigm platform is a generative AI platform designed for on-premise or private cloud deployment (Wikipedia).
• Open-source frameworks run inside your own code. They do not move data by themselves: what matters is where you run them and which model API they call.

LLM observability and AI usage tracking in France

This is the thinnest category. We found no French company whose main product is LLM tracing or AI usage tracking with a hosted EU service we could verify. The realistic options:

• Self-host an open-source tool. Langfuse (tracing, prompt management, evaluations, cost tracking) is MIT-licensed except for its ee folders (GitHub). It was founded in Berlin and was acquired by the US company ClickHouse in January 2026; the team says it stays open source and self-hostable (Langfuse). Self-hosted on a French server, your traces stay with you. Its hosted cloud is a different matter under the CLOUD Act.
• Use your gateway's logs. A self-hosted LiteLLM already records cost per request, key and team, which covers most usage tracking needs.
• Test and evaluate with Giskard (Paris): an open-source library (Apache 2.0) for testing LLM and agent systems for security, bias and quality issues (GitHub). It is evaluation, not live tracing.

If you only need numbers (tokens, cost, latency per user), you may not need a separate tool at all: most model APIs return token counts, and a table in your own database is the most private observability you can get.

Where Baguette Bot fits

Baguette Bot is not a model provider. It gives AI agents their own cloud computer (Linux desktop, Chrome, terminal, files), hosted in Paris, and a developer API to create those agents from your own product, billed from a prepaid euro balance, with the computer at €2 per hour billed per second (API docs).

• Each bot can use one of 400+ models. In sovereign mode, bots use Mistral AI models only, with no data retention, and services hosted outside Europe are switched off. During the beta, those requests still pass through OpenRouter, a US model router, configured to send them only to Mistral AI with data collection refused: if you need zero US exposure, that hop matters. A direct connection to Mistral is supported but not switched on yet.
• Outside sovereign mode, prompts go to the provider of the model you choose, often in the US.
• Our team administers the service partly from outside the EU, as our privacy policy states.
• We are not SecNumCloud-qualified, and do not hold HDS. If you need either, use Cloud Temple or OUTSCALE for inference.

If you want the whole picture of running an agent in France, see how to run an AI agent hosted in France.

Comparison table

"Not stated" means we found no claim either way in the provider's documentation. Ask before you rely on it.

FAQ

How do I find an AI provider in France for hosting models with strict data privacy?

Pick a French company that runs inference in France and offers zero data retention: Scaleway Generative APIs and OVHcloud AI Endpoints for open-weight models, Mistral AI for Mistral models. If you need SecNumCloud, use Cloud Temple or OUTSCALE. Then check the retention and training terms of your exact plan in writing.

Is there an AI gateway in France?

Yes. Eden AI, based in Lyon, offers an OpenAI-compatible gateway with an EU endpoint that refuses non-EU models. Alternatively, you can self-host an open-source gateway such as LiteLLM on a French server.

What are the LLM orchestration tools in France?

Mistral AI's Agents API, Dust for company agents and LightOn's Paradigm for on-premise deployments are French. Open-source frameworks also work, as long as they run on a European server and call European model APIs.

What LLM observability or AI usage tracking tools exist in France?

Few French ones. The practical answer is to self-host an open-source tool like Langfuse (MIT core) on a French server, or use the cost logs of a self-hosted gateway. Giskard, from Paris, covers testing and evaluation.

Can I use AI without CLOUD Act exposure?

Yes, if every company in the request path is outside US jurisdiction: the model provider, the gateway, the logging tool and the host. A US company's European region is not enough. SecNumCloud 3.2 is the French qualification designed to guarantee this.

Is Mistral AI GDPR-compliant and hosted in Europe?

Mistral AI is a French company and hosts data in the EU by default, unless you use its US endpoint. Zero data retention is available on request for stateless API calls. As with any provider, check its DPA and your organisation's training settings.

Does Baguette Bot offer SecNumCloud?

No. Baguette Bot hosts agents' computers in Paris and offers a Mistral-only sovereign mode, but it is not SecNumCloud-qualified. For regulated data, use a qualified provider.