Sovereign AI.
On infrastructure you choose.

This comparison assumes Enterprise controls are enabled where required. Internal mirrors, encryption, and your identity provider still need configuring.

1. SOV-1

   Strategic

   15% of the score

   4 of 6 answered

   Who owns and controls the provider, and whether you can keep running if it pulls out.

   Set by
   Your cloud provider and each software vendor

   • Answered: Runs on infrastructure you operate.
   • Answered: The desktop app is open source, under the MIT licence.
   • Answered: Each release of the control plane and gateway becomes MIT-licensed after two years. That is written into the licence.
   • Answered: A licence change never applies to a version you already run.
   • Open on our side: A vendor owned and controlled in the EU.Still open. OpenWork is made by Different AI, Inc., a US company.
   • Open on our side: Written terms for what happens if the vendor stops.Still open. Our standard terms do not cover this yet.

2. SOV-2

   Legal and jurisdictional

   10% of the score

   4 of 5 answered

   Which law governs the provider, and whether an authority outside the EU could compel access to your data.

   Set by
   Where the service is operated, and by whom

   • Answered: The vendor operates no part of your deployment.
   • Answered: Usage logs stay in a database you run.
   • Answered: Files stay on the employee's computer.
   • Answered: Product analytics are optional and can be switched off.
   • Open on our side: A vendor that answers to EU law only.Still open. Different AI is a US company, so US law applies to us.

3. SOV-3

   Data and AI

   10% of the score

   5 of 6 answered

   Who holds the keys, who can see data access and model use, where data is processed, and who controls the models.

   Set by
   Mostly your model and where it runs

   • Answered: You choose the model and the provider.
   • Answered: The gateway's request log records who used which model, not prompt or response bodies.
   • Answered: Organization audit history is available with Enterprise or a self-hosted entitlement, with recording enabled.
   • Answered: Provider keys and sign-in settings are encrypted with a key you hold.
   • Answered: Prompts are processed in the EU.
   • Not in this setup: The model runs on hardware you control.Needs a model you serve yourself.

4. SOV-4

   Operational

   15% of the score

   7 of 9 answered

   Whether teams in the EU can run, support, and move the technology without a vendor outside the EU.

   Set by
   Who operates and supports each layer

   • Answered: Your own team installs and upgrades it, from a Helm chart with pinned versions.
   • Answered: You choose which desktop versions employees can install.
   • Answered: Deployment guides and source code are public.
   • Answered: Your configuration exports as one file and moves between OpenWork Cloud and self-hosted.
   • Answered: Teams, providers, and connections can be set up from a repeatable script.
   • Answered: Works behind your own certificate authority and proxy.
   • Answered: A diagnostics page shows whether desktops, AI providers, and connectors are working.
   • Open on our side: Support from a team based in the EU.Still open. Support comes from the OpenWork team. There is no EU support partner yet.
   • Open on our side: A long-term support release line.Still open. Fixes ship on the latest release. There is no long-term support line yet.

5. SOV-5

   Supply chain

   20% of the score

   7 of 10 answered

   Where hardware and software come from, how software is packaged and updated, and how visible the suppliers are.

   Set by
   Your hardware, plus every piece of software on it

   • Answered: Every outbound host is published, per component.
   • Answered: A new enterprise install contacts no outside host until you link it to your organization.
   • Answered: Enterprise installs update from their own release channel, never the public one.
   • Answered: Application dependency manifests and lockfiles are public in the source repository.
   • Answered: The model catalog and helper package can come from your own mirror.
   • Answered: The chart and images can be mirrored into your own registry.
   • Answered: Desktop installers are served from inside your network.
   • Open on our side: A software bill of materials for each release.Still open. Not published yet.
   • Open on our side: Built and distributed on EU-controlled infrastructure.Still open. Releases are built and distributed through GitHub and npm.
   • Open on our side: A documented mirror for desktop updates.Still open. Without internet access you handle desktop updates through your own release process.

6. SOV-6

   Technology

   15% of the score

   5 of 6 answered

   Open standards and APIs, licences that let you audit and change the software, and a visible architecture.

   Set by
   Each layer's standards and licence

   • Answered: Open protocols: MCP for tools, SAML and OIDC for sign-in, SCIM for provisioning.
   • Answered: Works with any OpenAI-compatible model endpoint.
   • Answered: All source code is public to read and audit.
   • Answered: The agent engine underneath, OpenCode, is open source.
   • Answered: The architecture and data flows are documented.
   • Open on our side: Every component under an open-source licence.Still open. The control plane and gateway are source-available under a commercial licence until each release turns MIT.

7. SOV-7

   Security and compliance

   10% of the score

   5 of 6 answered

   Certifications, EU rules such as GDPR and NIS2, where security operations sit, and whether you can patch and audit on your own.

   Set by
   Your security operations and each vendor's audits

   • Answered: SOC 2 Type II and ISO 27001, with reports in the trust center.
   • Answered: Sign-in goes through your identity provider, so your own multi-factor and access rules apply.
   • Answered: A public security policy, with a private reporting address and stated response times.
   • Answered: Logs and monitoring stay in your own tools, through OpenTelemetry.
   • Answered: You can read the code and apply a patch yourself.
   • Open on our side: European cloud assurance evidence, such as a C5 attestation.Still open. Not held yet.

8. SOV-8

   Environmental

   5% of the score

   2 of 2 answered

   Energy efficiency, hardware reuse, and emissions reporting.

   Set by
   The data centre you run on

   • Answered: Agents run on computers employees already have.
   • Answered: OpenWork adds no hosting of its own.

Workspace

EU residency on a large cloudOpenWork on your own Kubernetes cluster

Fully in-houseOpenWork on your own Kubernetes cluster

Models

EU residency on a large cloudAn EU region of a US cloud provider

Fully in-houseOpen-weight models on your own hardware

Sign-in

EU residency on a large cloudA cloud identity provider over SAML

Fully in-houseA self-hosted identity provider over OIDC

Agents run

EU residency on a large cloudOn employee computers

Fully in-houseOn employee computers

What sets the level

EU residency on a large cloudThe cloud provider: its owner and its law

Fully in-houseYour own operations and hardware supply