French AI pentest: why where the model runs changes everything

Introduction

"French AI pentest", "sovereign AI", "hosted in France": these mentions are multiplying on brochures, often placed as a trust argument without explaining what they actually cover. We are writing this article because, in the specific case of an AI-driven pentest, the hosting question is not cosmetic. It touches what the tool does with data that is, by nature, sensitive.

The idea fits in one sentence: an AI pentest agent reasons on your production's responses, and those responses go through a language model. Knowing where that model runs means knowing where that data goes.

What actually goes through the model

To understand the stakes, you have to see what an agent reads. We described its mechanism in detail in the article on how an AI pentest agent works: it observes, hypothesizes, tests, proves. On each turn it sends requests to your system and reads the responses.

A production HTTP response is not neutral. It can contain:

• fragments of personal data (a name in an error message, an address in an API response),
• session tokens or keys accidentally exposed,
• database excerpts returned by a query that says too much,
• internal paths, server names, architecture details.

These are precisely the responses the agent gives the model to read, so it can reason on them. The model thus becomes a recipient of data from your production. The question is not theoretical: it is the heart of compliance.

The question to ask: where, how long, to train what

Three sub-questions, and a serious vendor has a precise answer to each.

Where does the model run? In a data centre in France, in Europe, or at a US provider subject to extraterritorial laws? The answer determines which authorities can, in law, request access to the data that transits. A model operated under US jurisdiction remains exposed to the Cloud Act, whatever the physical location of the server.

How long is the data kept? A call to a model can be logged on the provider side, sometimes for several weeks, for "service improvement". If your production's responses are in there, they outlive the scan. The right answer is short, documented retention, or no retention at all.

Is the data used to train the model? This is the red line. If the content sent feeds a future training run, a fragment of your database can, in theory, resurface elsewhere. Serious enterprise offers contractually exclude training on customer data. It has to be written, not implied.

Why "sovereign" is more than a word

You might think sovereignty is an ideological preference. In the case of an AI pentest, it is first a reduction of legal surface.

When the model runs under a European jurisdiction, the data's route stays within a framework you know: the GDPR applies, remedies exist, the competent authorities are identified. When it runs elsewhere, you add a layer of uncertainty over data that is already, by nature, the most sensitive in your system, the data an attacker would seek.

For a company under sector obligations (health, finance, essential operators under the NIS2 directive), that uncertainty can be enough to disqualify an offer. We detailed the NIS2 framework in the dedicated article: control over the subcontracting chain is explicit there.

There is also a simpler, almost commercial argument. Having your flaws analysed by a tool is already an act of trust. Letting the data from that analysis go to a third party beyond the reach of European law is asking for one more layer of trust, rarely justified by a technical gain.

The model is not everything: the rest of the chain too

The model's sovereignty is necessary, but it is not enough. The full route matters:

• Where the agent itself runs, meaning the platform that orchestrates requests and stores proofs? The findings reported contain the same sensitive data as the responses read.
• Where are the reports stored? A pentest report is a map of your system's weaknesses. Its hosting deserves the same attention as the model's.
• Who has access to the logs? The requests sent to your production, traced for transparency, must also be protected.

A coherent "French AI pentest" answers for the whole chain, not just the model. That is the difference between an argument and an architecture.

How it is done at Flawfence

We made a clear choice, and it is verifiable. The pentest agent reasons primarily with Mistral AI models, France's sovereign AI, and the platform is hosted in Paris. Your production's responses, the findings and the reports stay within that framework.

This choice has a cost and constraints, and we own it because it is consistent with what we sell: a pentest is an operation of trust, it should not come with a transfer of data outside the law that protects you. We detail our overall operation in the article on AI pentesting.

We do not claim the sovereign choice makes the tool better at detection. It makes it consistent in accountability, which, for data as sensitive as the raw response from your production, seems to us the minimum.

FAQ

What is a sovereign AI pentest?

An AI-driven penetration test whose language model and platform run under a controlled jurisdiction (in practice, European), so that the production data that transits through the tool stays within a known legal framework, with no transfer to a third party beyond the reach of the GDPR.

Why does the model's hosting matter for an AI pentest?

Because the agent reads your production's responses and gives them to the model to reason on. Those responses can contain personal data, tokens, database excerpts. The model becomes a recipient of them: where it runs determines who can, in law, access them.

Is a US model a problem even if the server is in Europe?

It can be: some extraterritorial laws, such as the Cloud Act, apply to a provider subject to US law regardless of the server's location. It is the operator's jurisdiction that matters, not just the data centre's geography.

Which model does Flawfence use?

Primarily Mistral AI models, and the platform is hosted in Paris. The responses read, the findings and the reports stay within that framework.

Conclusion

In an AI pentest, the question "where does the model run?" is not an afterthought, it is a matter of accountability over the most sensitive data in your system. A vendor who answers it precisely, across the whole chain and not just the model, tells you something important about how serious their offer is. A vendor who dodges tells you just as much.