SovergateThe Sovereign AI Audit Log for Compliant Enterprises
Add two lines to your app and keep calling your LLM directly. The Sovergate SDK scrubs PII inside your infrastructure, sends an async copy of every call, and builds your Article 12 compliance logs. Hosted entirely on EU soil.
Generated Artifact:
✓ PII Masked: Name, Email
✓ Article 12 log entry stored in Germany (Hetzner)
Added latency: 0 ms | Hash chain: intact
Your legal team blocked LangSmith.
Now what?
If your company deploys AI in infrastructure, human resources, credit assessment, or medical diagnostics, you are legally bound by **Article 12** to capture automated logs of every system execution for a minimum of 6 months. You need deep observation—but it must remain inside the EEA boundary.
The law is already in force
The EU AI Act came into force in August 2024. Annex III obligations for high-risk AI systems take effect December 2027. That integration window is closing fast.
LangSmith is stored in US-East-1
LangSmith, Helicone, and Weights & Biases store telemetry on US infrastructure. Under the US CLOUD Act, federal authorities can legally demand access to those data streams.
Your legal team already said no
European legal departments are aggressively blocking US-hosted log setups. Standard Contractual Clauses (SCCs) do not mitigate CLOUD Act exposure, and your compliance officers know it.
The Cost of Non-Compliance
Violating Article 12 logging requirements carries statutory administrative fines of up to €15 million or 3% of total global annual turnover—whichever is higher. For an enterprise generating €50M in revenue, that represents an unmitigated €1.5 million risk exposure.
Three steps to automated Article 12 compliance
From unmonitored shadow AI pipelines to an audit-proof corporate posture in under 10 minutes.
Install the SDK
Add two lines to your existing code. No architecture changes, no reverse proxies, and no complex routing. Works with OpenAI, Anthropic, Azure OpenAI and any OpenAI-compatible API.
pip install --pre sovergate
import sovergate
sovergate.init(api_key="sov_prod_xxxx")
sovergate.instrument(openai_client)Local PII scrubbing, async logging
Your runtime queries the LLM directly. Once the execution cycle completes, the SDK intercepts the trace payload, performs local token-level scrubbing inside your environment, and dispatches a sanitized mirror asynchronously to our servers in Germany. Zero latency penalty.
In-memory PII extraction · Non-blocking event loop · TLS 1.3 edge encryption
Export your Article 12 audit pack
Sovergate automatically structures your historical telemetry into compliance documentation matching Annex III guidelines. Generate cryptographic verification chains, data residency receipts, and PII omission logs instantly for your legal auditors.
Unified Compliance Artifact
Cryptographic ledger hash · Model parameters metadata · PII scrubbing metrics · System version lineage
Immutable storage receipt · Generated monthly
Everything Article 12 requires.
Nothing you don't need.
Engineered exclusively for European engineering groups managing high-risk deployment models under strict data governance frameworks.
PII scrubbing before logging
Names, emails, phone numbers, IBANs, and private keys are targeted and redacted locally within your infrastructure container before dispatch. We never see the original payload.
Immutable audit trail
Every captured stream is sequentially bound with a cryptographic block hash. Any data manipulation completely invalidates the chain hierarchy, offering native tamper-evident proof for auditors.
Article 12 compliance packs
Auto-generated documentation summaries containing execution volumes, parsing token counters, processing omission metrics, and strict EEA hosting data residency receipts.
Live execution telemetry
Observe live LLM connectivity events passing through your system. Sort streams by model weights, compute costs, network overhead speed metrics, or specific flagged safety counts.
Zero added latency
The SDK instrumentation operates asynchronously. Outbound system calls run decoupled on background threads after the core prompt cycle completes. Application performance remains untouched.
Universal interface integration
Works with OpenAI and Anthropic today, including Azure OpenAI and OpenAI-compatible endpoints such as EU-hosted open-weight models. One audit log, whichever provider you call.
Built for European operations.
Committed exclusively to Europe.
Every layer of our infrastructure architecture is optimized for complete, verifiable EU digital sovereignty.
Bare-Metal Sovereignty: Hetzner Germany
Your telemetry never touches hyper-scaler clouds subject to foreign data interception requests. Every trace log, report slice, and cryptographic hash is committed to bare-metal infrastructure inside Germany (EEA). No US routing paths exist.
No US Parent, No CLOUD Act
Sovergate is a European company with no US parent, so US authorities cannot compel us under the CLOUD Act. Customer logs are stored in Germany and processed under GDPR. We handle data points solely to satisfy Article 12 logic and issue standard GDPR-compliant DPAs.
Cryptographic Tamper Evidence
We implement absolute data immutability patterns. Records are chained via sequential secure hashes. Any unauthorized manipulation instantly invalidates the structural registry, creating a robust audit record for review.
Regulator-Ready Audit Packages
Our outputs are structured precisely around the guidelines of Annex III and Article 12 compliance. Avoid legal confusion: provide your national market surveillance authorities with exactly the data documentation they request.
Predictable pricing. Clear compliance terms.
All tiers include standard 14-day integration coverage. No payment method required upfront.
Starter
For teams initializing automated compliance workflows.
- ✓1 Registered AI System
- ✓100,000 requests / month
- ✓Statutory 6-month log retention
- ✓Annual Article 12 audit pack (PDF)
- ✓Standard support tier
Growth
For scaling platforms running high-risk production AI.
- ✓5 Registered AI Systems
- ✓1,000,000 requests / month
- ✓Statutory 6-month log retention
- ✓Monthly Article 12 audit packs (PDF)
- ✓Local PII scrubbing dashboard
- ✓Priority response SLA
Enterprise
For heavily regulated enterprise groups with strict audit terms.
- ✓Unlimited AI infrastructure pipelines
- ✓Custom high-throughput request limits
- ✓Configurable long-term log retention
- ✓On-demand cryptographic compliance exports
- ✓Custom service-level agreement (SLA)
- ✓Standard EEA DPA execution included
- ✓Dedicated legal engineer assignment
All calculated pricing parameters exclude applicable statutory VAT. Fully custom terms can be adjusted upon direct enterprise consultation.
Regulatory & Technical FAQ
Everything your engineering leads and data compliance officers need to know about our data architecture.
It doesn't. The Sovergate SDK does not sit inline as a reverse proxy or blocking interceptor. When your application makes an LLM call, it communicates directly with the provider (e.g., OpenAI or Anthropic). The SDK reads the completion stream token-by-token and dispatches the logging payload asynchronously using a background thread pool after the client cycle finishes. Outbound request paths remain completely unaffected.
Our local processing layer scans telemetry blocks for sensitive entities before they leave your infrastructure boundary. It strips names, emails, physical addresses, phone numbers, IBANs, credit card numbers, national identification numbers, and cryptographic private keys. The raw strings are replaced with standardized token identifiers (e.g., [REDACTED_EMAIL]) so that your log schemas retain architectural context for debugging without exposing data payloads.
Because your legal team knows that SCCs do not override the US CLOUD Act. If data is stored on US-managed infrastructure (even within European regions like eu-central-1 under US hyper-scalers), American federal authorities can legally demand access to those data pipelines under statutory warrants. For companies managing high-risk AI models under Article 12, this exposure breaks strict EU data sovereignty rules. Sovergate runs entirely on independent bare-metal hardware inside Germany.
Article 12 of the EU AI Act requires high-risk systems to automatically generate logs tracking system lifecycle events, execution states, and runtime conditions for at least 6 months. Our compliance pack is an audit-ready PDF exported monthly or on-demand. It includes system activity metrics, processing metadata, an immutable cryptographic verification hash chain proving the logs haven't been tampered with, and localized data residency receipts to hand straight to regulators.
Yes. Sovergate is a European company with no US parent, so the US CLOUD Act does not apply to us. We provide a standardized, pre-vetted DPA that explicitly documents our local scrubbing architecture, our zero-retention policy for raw sensitive entities, and our exclusive dependency on German bare-metal hosting provider Hetzner. Enterprise groups can request custom data terms through legal engineering review.
Our Python and TypeScript SDKs instrument the official OpenAI and Anthropic clients, including Azure OpenAI and any OpenAI-compatible endpoint you call through the OpenAI client. Sync and async clients are supported in Python. LangChain, LlamaIndex and native clients for other providers are not supported yet.
The December 2027 enforcement deadline
is closer than it looks.
Initializing the Sovergate SDK takes less than 10 minutes. Securing explicit governance sign-off from your corporate internal audit team takes weeks. Install the SDK in staging today, export your first verification ledger, and clear compliance blockers early.