Ownership
You own it.You decide where it runs.
What you own
Everything we build for you, and everything it runs on. If we stopped working together tomorrow, nothing would need to be handed back.
The code
Source code, designs and documentation, in your repository. Third-party frameworks keep their own licences, and we list the ones you rely on.
The accounts
Hosting, domains, AI providers and every other service, set up in your name and paid by you directly. Nothing is resold or billed through us.
The keys
Admin access, API keys and encryption keys stay with you. We work with the access you grant, and you can take it back.
The way out
Everything is documented so another developer could take it over, and every service you depend on comes with a written exit plan.
Where your data lives is your choice
There is no single right answer. It depends on what the data is, who your customers are and what your contracts and regulators expect. These are the three setups we see most, and what each one means.
Suits
Most workloads, and teams that need the widest range of managed services or reach in many countries.
- Where the data sits
- The region you choose, including UK and EU regions
- Whose law reaches it
- Local law, and the law of the provider's home country
- Effort for you
- Low
Location is not the whole story
Choosing a region decides where data is stored. Who runs the service decides whose law can reach it. Under the US CLOUD Act, a US provider can be required to hand over data in its possession, custody or control:
“…regardless of whether such communication, record, or other information is located within or outside of the United States.”
For many workloads that is fine. For some, it is the reason to choose a provider with no US parent company.
Read the longer explanationRead the transcriptHide the transcript
Where your data lives, and who can reach it.
Location: you choose the region. The server, the backups and the logs sit there.
Law: who runs the server decides whose law applies. A US-owned provider is subject to US orders under the CLOUD Act, 18 U.S.C. section 2713, wherever the data is stored.
Control: the same location can give different answers. A region run by a US-owned provider is within reach of US orders; a provider with no US parent answers to local law. Then the question that decides the rest: who holds the encryption keys and the admin accounts.
Exit: for every vendor you keep, a written way out, covering the export format, the time to move and the contract terms.
How we decide together
- 1
Map
Every system you run, where its data sits, who operates it and who holds the keys.
- 2
Decide
What needs special handling and what does not. Moving data that does not need it costs money for nothing.
- 3
Build or move
The hosting, models and encryption that fit the data, set up in your accounts.
- 4
Write the exit
For each service you keep: how you would leave, what it would take and how long.
Our own setup
Soventia is registered in England and Wales. Personal data can flow from the EU to the UK under the EU’s adequacy decision for the UK, renewed in December 2025. What we build runs in your accounts, with providers you choose, so you never depend on our infrastructure.
This site uses two US services: Cal.com for booking calls and Resend for delivering contact form messages. Both are named in our privacy policy along with what they receive, and the booking calendar loads only when you ask for it.
Read the privacy policyCommon questions
Do we need EU hosting?
Not necessarily. If you are an EU company, handle sensitive personal data, or your customers or contracts expect it, it is often the right choice. Plenty of workloads run well on a major cloud. We look at what the data is before recommending anything.
Can we change provider later?
Yes, and planning for it is part of the work. Every system comes with a written exit plan. In the EU, the Data Act also gives cloud customers switching rights, and from 12 January 2027 providers can no longer charge for switching.
Can we use AI without sending sensitive data to just any provider?
Yes. There are European model providers, models hosted in the region you choose, and open-weight models that run on infrastructure you control. Our guide to choosing where your AI runs walks through the options.
Is this legal advice?
No. We build systems with the rules in mind and point to the sources. For a legal opinion on your situation, talk to a lawyer; we are glad to work alongside one.
Find out where your data actually lives.
A 30-minute call is usually enough to tell whether you need a data map, a plan, or nothing at all.