Sovereignty
Inference has a jurisdiction. Choose it.
Every prompt is data. Where it is processed decides which laws reach it, which courts can compel its disclosure and which foreign statutes apply. Zarx keeps that answer short: Spain, EU law, servers NPAW owns.
The data path
Client, edge, GPU. All of it inside the EU.
Data table
| Hop | Where | What happens |
|---|---|---|
| Your systems | Anywhere | Your application sends a request with your API key over TLS. |
| zarx.ai edge | NPAW IP space, Spain | TLS terminates on NPAW equipment in the 193.111.209.0/24 block. Keys are checked, usage is recorded. |
| NPAW-owned GPUs | Spain, EU law | Open-weight models run on servers NPAW owns and operates. The reply streams back the same way. |
What leaves your systems
- Your request: the prompt, the model id and the parameters you send.
- The reply: the tokens the model produces, streamed back to you.
- Usage counts per key: model, prompt tokens, completion tokens, timestamps.
What never leaves NPAW iron
- Prompts and outputs are processed on NPAW iron. They are not forwarded to any third-party model API.
- Fine-tuning data and adapters live on the same servers as the base model.
- Model weights are served locally. Nothing in the data path depends on a US provider.
Why it matters
Sub-processing is where sovereignty leaks.
Most enterprise inference today is served by a US company, or by a European reseller whose model calls end up on a US provider. Contracts can shape that relationship; they cannot change its jurisdiction. A provider subject to US law can be compelled under US law, wherever the datacenter stands.
The usual mitigation is a chain of paperwork: transfer impact assessments, standard contractual clauses, supplementary measures. It is real work and it is fragile. The legal basis for routine EU to US personal-data transfers has been invalidated twice by the Court of Justice of the EU: Safe Harbour in 2015 and Privacy Shield in 2020.
Zarx removes the transfer instead of papering it. The servers are in Spain. The operator is a Spanish company. The models are open weights, served locally, so there is no remote model API behind the service. For inference, no US provider is a sub-processor because none is in the path.
This is positioning, not a legal guarantee: Zarx is designed to help you meet GDPR data-residency requirements and to make your data-protection assessment shorter. Your DPO still decides, and we give them the facts to decide on.
Proof points
Six things you can verify.
- Iron we own.
- NPAW owns and operates the servers that run Zarx. They are not rented cloud instances.
- A network we hold.
- Traffic to Zarx terminates in IP space NPAW holds itself: the IPv4 block 193.111.209.0/24 is assigned to ES-NICEPEOPLEATWORK, country ES, in the RIPE database.
- Law we can name.
- The servers are located in Spain and operated by a Spanish company. Spanish and EU law apply to the service, and the GDPR applies to any personal data in it.
- No US sub-processor.
- For inference, no US provider is a sub-processor: prompts, outputs and fine-tuning data are processed on NPAW iron and are not sent to a third-party model API.
- Weights you can inspect.
- Every model on Zarx is open weights, so the weights we serve can be inspected, pinned and, when licenses allow, taken with you.
- Hardware we can name.
- AMD Instinct MI300X accelerators with 192 GB of HBM3 memory per GPU are in production today, serving models with SGLang and vLLM. NVIDIA GB300 systems are arriving; the Rubin generation is planned.
Sources for each statement
- NPAW owns and operates the servers that run Zarx. They are not rented cloud instances.Source: NPAW infrastructure inventory, 2026-09-03 (server-by-server record of NPAW-operated GPU hosts)
- AMD Instinct MI300X accelerators with 192 GB of HBM3 memory per GPU are in production today, serving models with SGLang and vLLM.Source: NPAW infrastructure inventory (MI300X hosts serving Kimi K2.6 with SGLang and GLM-5.2 with vLLM, 2026); AMD Instinct MI300X public specification for the 192 GB HBM3 figure
- NVIDIA GB300 systems are arriving; the Rubin generation is planned.Source: NPAW hardware roadmap statement, September 2026
- Traffic to Zarx terminates in IP space NPAW holds itself: the IPv4 block 193.111.209.0/24 is assigned to ES-NICEPEOPLEATWORK, country ES, in the RIPE database.Source: RIPE RDAP lookup of 193.111.209.0/24, 2026-09-04 (assigned to ES-NICEPEOPLEATWORK, country ES)
- The servers are located in Spain and operated by a Spanish company. Spanish and EU law apply to the service, and the GDPR applies to any personal data in it.Source: NPAW infrastructure inventory (hosts in NPAW-operated facilities, Spain); legal entity NicePeopleAtWork S.L. (npaw.com legal notice); GDPR territorial scope, Art. 3
- For inference, no US provider is a sub-processor: prompts, outputs and fine-tuning data are processed on NPAW iron and are not sent to a third-party model API.Source: Zarx service architecture: the models we run are open weights served on NPAW servers; the gateway routes to third-party model providers are not part of Zarx
- Every model on Zarx is open weights, so the weights we serve can be inspected, pinned and, when licenses allow, taken with you.Source: Model licenses as published in each model card (see Models)
- The legal basis for routine EU to US personal-data transfers has been invalidated twice by the Court of Justice of the EU: Safe Harbour in 2015 and Privacy Shield in 2020.Source: CJEU, Schrems I (C-362/14, 6 October 2015) and Schrems II (C-311/18, 16 July 2020), public judgments
- This website is static and served from Google Cloud (Firebase Hosting); it sets no cookies and loads no third-party scripts. The API runs on NPAW iron and does not share this hosting.Source: Hosting configuration of this site (static files on Firebase Hosting, no analytics, no cookies)
This website
The marketing site is not the API.
This website is static and served from Google Cloud (Firebase Hosting); it sets no cookies and loads no third-party scripts. The API runs on NPAW iron and does not share this hosting. The distinction matters: the pages you are reading are static files on a content delivery network; the inference service, its keys and its data run only on NPAW iron.
The privacy policy of this site lists Google Cloud as the processor for the early-access form. The API service has its own processing terms, agreed with each partner, and lists no processor outside the EU for inference.
Bring your DPO. We will answer the questions in order.
Request access and tell us what has to stay in your jurisdiction. We reply with the data path, the processing terms and the models we can serve.