What is sovereign AI?
Sovereign AI is artificial intelligence whose data, models, infrastructure and encryption keys stay under the control of the organization using it, or of a jurisdiction it chooses. For a Canadian company, that means knowing where information is hosted, who can reach it and how to get it back out. iYan is a platform built on that principle, hosted in Canada or on your own servers.
Key points
- Data, models and encryption keys stay under the organization's control.
- It is judged on hosting, access, traceability and reversibility.
- It does not ban external models; it sets the rules for using them.
- It helps document Québec Law 25 obligations on personal information.
How is sovereign AI different from a public AI chatbot?
A public chatbot is a shared service. Your prompts are processed on the provider's infrastructure, often outside Canada, under terms you did not negotiate. Sovereign AI reverses that arrangement: the organization decides where data lives, which models may be used and who holds the keys.
Sovereignty does not mean isolation. An organization can still use strong models while controlling what enters and leaves its systems.
- A chosen hosting location that you can verify
- An audit journal the organization can inspect
- The option to switch models without rebuilding the project
- Exports in open formats
Why does sovereignty matter for a Québec organization?
Law 25 governs how personal information is collected, used and disclosed in Québec. It asks organizations to know their processing activities, to name a person in charge of personal information, and to answer access and erasure requests.
A contract or a client file pasted into a public assistant can leave the company's perimeter without any record. A mid-sized firm may not have the means to check, and a regulated institution has to be able to prove what happened to an auditor.
The risk is not only legal. Relying on one foreign vendor also sets your prices, your terms and the pace of your roadmap.
Cloud, hybrid or on-premise: what is the difference?
Three deployment models exist side by side. The right one depends on how sensitive your data is, what your team can operate and what you can budget to run it, not on what is fashionable.
The table below summarizes general trade-offs. It is a starting point, not a substitute for an assessment of your own situation.
| Criterion | Public cloud | Hybrid | On-premise |
|---|---|---|---|
| Where data sits | With the provider, in its chosen regions | Split: sensitive data on site, the rest in the cloud | On your own servers |
| Who runs the infrastructure | The provider | Shared between you and the provider | Your team or your partner |
| Control of encryption keys | Varies by offer | Full control of the local part | Full control |
| Time to start | Fastest | Moderate | Longest |
| Evidence for an auditor | Depends on the provider's documents | Documented for each part | Entirely your responsibility |
Which criteria should you use to evaluate a sovereign AI platform?
Ask about architecture and commitments before comparing features. A serious vendor answers in writing and provides a security file.
Six questions will sort most options quickly:
- Where are data, knowledge and conversations hosted, and can you choose?
- Is any of your data used to train a model, for you or for other customers?
- Who holds the encryption keys, and can they be rotated without downtime?
- Which models are allowed, and can local models handle sensitive work?
- Is the audit journal tamper-evident and exportable to an auditor or a SIEM?
- Can you leave with your data in open formats?
How does iYan meet these criteria?
iYan is an AI workspace designed to be installed in your own infrastructure or hosted in Canada. The list below covers what is in place today, as described on our security and enterprise pages.
Conversations, documents and the knowledge base stay inside the perimeter you choose. Requests are anonymised before they reach a model, and the answer is restored afterwards.
- Hosting in Canada or on your servers, with a hybrid mode where only the model gateway is managed
- Local or private models for sensitive work, plus cloud models you have approved
- Names, emails, identifiers and internal referentials replaced by tokens before the model reads them
- Bring your own keys (BYOK) and AES-256-GCM encryption of the vault at rest
- A hash-chained audit journal: one altered line breaks the chain
- No customer data used to train a model
Is iYan SOC 2 or ISO 27001 certified?
Not yet. SOC 2 and ISO 27001 are on our roadmap. Our controls are documented against those frameworks, but we do not present the certifications as held.
A full security questionnaire, whether SIG, CAIQ or your own, can be requested, and we answer within five business days.
Frequently asked questions
Does sovereign AI always mean servers on site?
No. Sovereign AI can be hosted in a jurisdiction you choose, such as Canada, on your organization's own servers, or in a hybrid setup. What matters is knowing where the data is, who processes it and who holds the encryption keys, and being able to show that to an auditor.
Is sovereign AI more expensive than a public chatbot?
It usually takes more preparation than an individual subscription: an infrastructure review, configuration and ongoing operation. Running costs depend on usage volume and the models you choose. iYan starts with an assessment before discussing numbers, so the proposal fits your context.
Is data sent to a model used to train it?
Not on iYan. No customer data is used to train a model. For cloud models you approve, also read their own terms, because those are set by the model provider and not by iYan. Ask for them in writing and include the answer in your evaluation.
What is the difference between sovereign AI and local AI?
Local AI means a model that runs on your own hardware. Sovereign AI is broader: it covers control of data, keys, access and traceability. A sovereign setup can use local models for sensitive tasks and approved cloud models for everything else.
Where should a sovereign AI project start?
Start with an inventory of current uses, including public tools that people use without any framework. Then classify your data by sensitivity and define which models are allowed and what hosting you require. An initial assessment helps you choose the right path before committing a budget.