Data residency
Inference has a jurisdiction. Choose it.
Every prompt is data. Where it is processed decides which laws reach it, which courts can compel its disclosure and which foreign statutes apply. Zarx keeps that answer short: the EU, EU law, servers NPAW owns and operates.
For your DPO
A short description of the inference path.
Zarx processes prompts and outputs on servers owned and operated by NicePeopleAtWork S.L. (NPAW), in the EU. Inference runs on NPAW's own GPUs in the Barcelona area (Spain); the API entry and gateway run on NPAW hardware in Haarlem (Netherlands); both are operated by NPAW; no US sub-processor is on the data path. Models have published weights and run locally; Zarx does not send these requests to a third-party model API. The marketing website is hosted separately on Firebase Hosting and does not serve inference requests.
This is positioning, not a legal guarantee: Zarx is designed to help you meet GDPR data-residency requirements and to make your data-protection assessment shorter. Your DPO still decides, and we give them the facts to decide on.
The data path
From your systems to servers in the EU.
Data table
| Hop | Where | What happens |
|---|---|---|
| Your systems | Anywhere | Your application sends a request with your API key over TLS. |
| zarx.ai edge | NPAW hardware, Haarlem (Netherlands) | TLS terminates on NPAW hardware in Haarlem (Netherlands), in IP space NPAW holds itself. Keys are checked, usage is recorded, the request is handed to the GPUs. |
| NPAW-owned GPUs | Barcelona area (Spain), EU law | Open-weight models run on GPUs NPAW owns and operates in the Barcelona area. The reply streams back the same way. |
What leaves your systems
- Your request: the prompt, the model id and the parameters you send.
- The reply: the tokens the model produces, streamed back to you.
- Usage counts per key: model, prompt tokens, completion tokens, timestamps.
What stays on NPAW servers
- Prompts and outputs are processed on servers NPAW owns and operates. They are not forwarded to any third-party model API.
- Fine-tuning data and adapters live on the same servers as the base model.
- Model weights are served locally. No US provider is a sub-processor for inference.
Why it matters
Sub-processing is where sovereignty leaks.
Most enterprise inference today is served by a US company, or by a European reseller whose model calls end up on a US provider. Contracts can shape that relationship; they cannot change its jurisdiction. A provider subject to US law can be compelled under US law, wherever the datacenter stands.
The usual mitigation is a chain of paperwork: transfer impact assessments, standard contractual clauses, supplementary measures. It is real work and it is fragile. The legal basis for routine EU to US personal-data transfers has been invalidated twice by the Court of Justice of the EU: Safe Harbour in 2015 and Privacy Shield in 2020.
Zarx removes the transfer instead of papering it. The servers are in the EU, in Spain and the Netherlands. The operator is a Spanish company. The models are open weights, served locally, so there is no remote model API behind the service. For inference, no US provider is a sub-processor because none is in the path.
Proof points
Seven things you can verify.
- Servers we own.
- NPAW owns and operates the servers that run Zarx. They are not rented cloud instances.
- A network we hold.
- Traffic to Zarx terminates in IP space NPAW holds itself: the IPv4 block 193.111.209.0/24 is assigned to ES-NICEPEOPLEATWORK, country ES, in the RIPE database.
- Law we can name.
- Inference runs on NPAW’s own GPUs in the Barcelona area (Spain); the API entry and gateway run on NPAW hardware in Haarlem (Netherlands). Both are operated by NPAW, a Spanish company, so EU law applies to the whole service and the GDPR applies to any personal data in it.
- No US sub-processor for inference.
- For inference, no US provider is a sub-processor: prompts, outputs and fine-tuning data are processed on servers NPAW owns and operates in the EU and are not sent to a third-party API. No US sub-processor sits on the data path.
- Weights you can inspect.
- Zarx runs open-weight inference on servers NPAW owns and operates, with no remote provider API in the inference path.
- Hardware we can name.
- AMD Instinct MI300X accelerators with 192 GB of HBM3 memory per GPU are in production today, serving Zarx workloads on open-source inference software. NVIDIA GB300 systems are arriving; the Rubin generation is planned.
- An operator with certifications.
- Zarx is operated by NPAW, certified ISO 27001, ISO 27701, ISO 42001 and ENS High (Spain’s national security scheme). Certification scopes cover NPAW’s platform and management systems; the inference service is being brought into scope.
Sources for each statement
- NPAW owns and operates the servers that run Zarx. They are not rented cloud instances.Source: NPAW infrastructure inventory, 2026-09-03 (server-by-server record of NPAW-operated GPU hosts)
- AMD Instinct MI300X accelerators with 192 GB of HBM3 memory per GPU are in production today, serving Zarx workloads on open-source inference software.Source: NPAW infrastructure inventory (MI300X hosts serving Zarx workloads, 2026); AMD Instinct MI300X public specification for the 192 GB HBM3 figure
- NVIDIA GB300 systems are arriving; the Rubin generation is planned.Source: NPAW hardware roadmap statement, September 2026
- Traffic to Zarx terminates in IP space NPAW holds itself: the IPv4 block 193.111.209.0/24 is assigned to ES-NICEPEOPLEATWORK, country ES, in the RIPE database.Source: RIPE RDAP lookup of 193.111.209.0/24, 2026-09-04 (assigned to ES-NICEPEOPLEATWORK, country ES)
- Inference runs on NPAW’s own GPUs in the Barcelona area (Spain); the API entry and gateway run on NPAW hardware in Haarlem (Netherlands). Both are operated by NPAW, a Spanish company, so EU law applies to the whole service and the GDPR applies to any personal data in it.Source: NPAW infrastructure inventory (GPU hosts in the Barcelona area; gateway and API entry on NPAW hardware in Haarlem, Netherlands); legal entity NicePeopleAtWork S.L. (npaw.com legal notice); GDPR territorial scope, Art. 3
- For inference, no US provider is a sub-processor: prompts, outputs and fine-tuning data are processed on servers NPAW owns and operates in the EU and are not sent to a third-party API. No US sub-processor sits on the data path.Source: Zarx service architecture: the levels are served on NPAW servers; gateway routes to third-party providers are not part of Zarx
- Zarx runs open-weight inference on servers NPAW owns and operates, with no remote provider API in the inference path.Source: Zarx service architecture and NPAW-operated infrastructure inventory
- The legal basis for routine EU to US personal-data transfers has been invalidated twice by the Court of Justice of the EU: Safe Harbour in 2015 and Privacy Shield in 2020.Source: CJEU, Schrems I (C-362/14, 6 October 2015) and Schrems II (C-311/18, 16 July 2020), public judgments
- This website is static and served from Google Cloud (Firebase Hosting); it sets no cookies and loads no third-party scripts. The API runs on servers NPAW owns and operates and does not share this hosting.Source: Hosting configuration of this site (static files on Firebase Hosting, no analytics, no cookies)
- Zarx is operated by NPAW, certified ISO 27001, ISO 27701, ISO 42001 and ENS High (Spain’s national security scheme). Certification scopes cover NPAW’s platform and management systems; the inference service is being brought into scope.Source: NPAW compliance page, verified October 2026
- Early access runs under a written early-access agreement with NPAW as the processor, established in the EU, and a data processing agreement (DPA) is available on request.Source: Zarx early-access agreement (NPAW, October 2026)
- The early-access pilot is free for 60 days with a usage cap agreed per partner; what follows is agreed before the pilot ends.Source: Zarx early-access agreement (NPAW, October 2026)
- Model changes behind a level are announced with 14 days of notice plus a grace period during which the previous behaviour stays available; price changes are announced with 30 days of notice.Source: Zarx early-access agreement (NPAW, October 2026)
- No content retention by default is the product policy: prompts and outputs are not used to train models. Until that capability is live, content handling follows the dated annex of the early-access agreement.Source: Zarx early-access agreement, content handling annex (NPAW, October 2026)
- Partners can run a security review of the service: NPAW answers questionnaires, describes the data path and names the certification scopes that apply.Source: Zarx early-access agreement (NPAW, October 2026); NPAW security review practice with enterprise customers
- Each Z level also exposes a dated pinned identifier (for example z-pro-2026-10) that maps to one published checkpoint. Use the level to follow improvements, or the dated identifier to keep evaluations stable; dated identifiers change only with notice.Source: Zarx API documentation: model registry and level aliases; Zarx early-access agreement (NPAW, October 2026)
- Dedicated capacity with a fixed model is available under agreement, on datacenter GPUs NPAW owns and operates, for partners who need their own serving capacity.Source: Zarx early-access agreement (NPAW, October 2026); NPAW infrastructure inventory
- Shared capacity on the Z levels is usage based, metered in tokens and accounted for per key. Dedicated capacity is reserved for a period. Figures are agreed per partner; no public price list exists during early access.Source: Zarx early-access agreement (NPAW, October 2026)
For your review
What each reviewer needs first.
A security, legal or engineering review asks different first questions. The answers below come from the same registry of facts and the early-access agreement.
- For the CTO.
- An OpenAI-compatible API: the official SDKs work by changing the base URL. Put z-ultra, z-pro or z-fast in the model field; each level also exposes a dated pinned identifier such as z-pro-2026-10 for evaluations that must stay stable. Model changes behind a level come with 14 days of notice and a grace period.See the API
- For the CISO.
- One data path: API entry on NPAW hardware in Haarlem (Netherlands), inference on NPAW’s own GPUs in the Barcelona area (Spain), no US sub-processor. No content retention by default is the product policy; until that capability is live, content handling follows the dated annex of the agreement. Prompts and outputs are never used to train models. The agreement includes security review rights, and NPAW holds ISO 27001, ISO 27701, ISO 42001 and ENS High.The data path
- For Legal and the DPO.
- NPAW, a Spanish company established in the EU, is the processor. Early access runs under a written early-access agreement, with a data processing agreement (DPA) available on request: a 60-day free pilot with a usage cap, 14 days of notice plus a grace period on model changes, 30 days of notice on price changes.Request access
Sources: Zarx early-access agreement (NPAW, October 2026); NPAW compliance page, verified October 2026.
This website
The marketing site is not the API.
This website is static and served from Google Cloud (Firebase Hosting); it sets no cookies and loads no third-party scripts. The API runs on servers NPAW owns and operates and does not share this hosting. The distinction matters: the pages you are reading are static files on a content delivery network; the inference service, its keys and its data run only on servers NPAW owns and operates.
The privacy policy of this site lists Google Cloud as the processor for the early-access form. The API service has its own processing terms, agreed with each partner. The statement about US sub-processors applies to inference, not to this website.
Bring your DPO. We will answer the questions in order.
Request access and tell us what has to stay in your jurisdiction. We reply with the data path, the processing terms and the models we can serve.