[§ 02] WHERE YOUR DATA LIVES
Every byte of processing, every conversation, every container — kept inside Europe.
// Sovereign Shield
Every byte of compute, every prompt chain, every container — sealed inside the EEA. Iceland's data-haven status, combined with EU-equivalent regulation, gives Enact a legal moat no US hyperscaler can replicate.
Hosting under strict Icelandic law prevents foreign state agencies from demanding warrantless access or executing secret directives against your workloads.
Native alignment with European digital sovereignty laws. Drop-in ready for finance, healthcare, and regulated software supply chains.
Plug in your own Mistral, DeepL, or any European model keys. We never markup tokens. You pay only for secure sandboxed runtime.
░░▒▒▒▒░░░░░░
░▒▒▓▓▓▓▓▓▒▒░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░░
▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░░
▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░
◉ ░▒▓▓▓▓▓▓▓▓▓▓▒▒░░░░░
░░▒▒▒▒▒▒▒░░░ // Why these laws can't reach you
Two US surveillance laws let American agencies pull data from any company that falls under US jurisdiction — even when the servers sit in Europe. Enact is structured to fall outside both. Here is exactly how.
Forces any US-based provider — AWS, Azure, Google, Microsoft 365, Cloudflare — to hand over customer data on US government request, regardless of where in the world it is physically stored.
/ catch
Your data in Frankfurt is still reachable if your provider is American.
Lets US intelligence agencies compel US providers to intercept communications of non-US persons abroad, in bulk, without a warrant and under a gag order.
/ catch
You are never told it happened. Your provider cannot tell you either.
Enact is operated from Norway and hosted in Iceland — both EEA, neither US territory. No US parent, no US subsidiary, no US sales office that creates jurisdiction.
Compute, storage, logs, backups and egress all stay inside Icelandic and EEA networks. No AWS, no GCP, no Azure, no Cloudflare US edge in front of your data.
An EU-hosted provider may not transfer personal data on a foreign court or agency order unless an EU mutual legal-assistance treaty applies. CLOUD Act and FISA 702 requests do not qualify.
| US hyperscaler | Enact | |
|---|---|---|
| Provider HQ | United States | Norway (EEA) |
| Servers | Global, incl. EU | Iceland only |
| CLOUD Act reachable | Yes | No |
| FISA 702 reachable | Yes | No |
| Gag-order risk | Yes — silent disclosure | No legal basis |
| Your recourse | None, you are not notified | Court order in EEA, you can be notified |
/ We are not lawyers — but this stack was designed with European data-protection counsel. Full legal note and provider chain on request.
// MODEL_LAYER
Enact runs on Mistral AI, the frontier model lab headquartered in Paris. Your prompts, completions and embeddings stay inside the EU stack — no US hyperscaler in the loop, no data export, no FISA 702 / CLOUD Act exposure at the model layer.
// Security Specifications
Every agent step is committed to an immutable ledger before it runs. Every privileged action waits for a hardware-signed user approval. No silent retries. No invisible side-effects.
01 — Durable Execution
Steps are atomically journaled before they execute. If the host process dies — kernel panic, OOM, power loss — the next worker resumes from the exact last committed step. Zero double-spends. Zero phantom writes.
Requests read access to
/repo/payments/stripe.ts
scope: read · 1 file · 32 lines
Touch sensor to approve
02 — WebAuthn HITL Approval
When an agent requests filesystem, network, or secret access, the request is signed by your platform authenticator. The private key never leaves your device. A stolen session token cannot approve anything on its own.
[§ 02.1] ICELAND DATA CENTER · IS-1
64.1265° N · 21.8174° W — 100% geothermal power, European jurisdiction, no traffic routed through the US.
░░▒▒▒▒░░░░░░
░▒▒▓▓▓▓▓▓▒▒░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░░
▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░░░
▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░
░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒░░░░░░░
◉ ░▒▓▓▓▓▓▓▓▓▓▓▒▒░░░░░
░░▒▒▒▒▒▒▒░░░ Median round-trip measured live from the edge to the Cloudflare EU peering exchange on every poll.
[§ 03] PRICING
tech founders · self-hosters
Strictly limited to 200 early adopters. BYO model keys.
non-technical founders · SaaS teams
Easiest start. Mistral AI included — no API keys to manage.
[§ 03.1] Compare tiers
| Feature | Founder's Key · BYO Keys | Cloud Vault · AI Included |
|---|---|---|
| Price | €89 once | €29 / month |
| Hosting | Self-hosted (your VPS) | Managed · Reykjavík IS-1 |
| AI engine | BYO Keys (Gemini · Mistral) | 🟢 Mistral Included · 5M tokens/mo |
| Setup | Manual install.sh | 🟢 Click & Connect (Telegram) |
| Agents | Unlimited | Up to 25 |
| Updates | Lifetime | Continuous |
| Support | Community | Priority email |
| Air-gap capable | ||
| Managed encrypted backups | ||
| EU jurisdiction (geofenced) |
Live setup assistance, dedicated SREs, and custom compliance audits.
[§ FAQ] FREQUENTLY ASKED
The US CLOUD Act (2018) compels US-based cloud providers to hand over customer data on request, regardless of where the data is physically stored. Because Enact is hosted exclusively in Iceland by non-US operators, it is not subject to CLOUD Act production orders.
GDPR Article 48 forbids transferring personal data to third-country authorities unless an international agreement applies. Enact's data plane stays inside the EU/EEA and Iceland; no telemetry, model calls, or storage routes through US jurisdictions.
Yes. Enact ships with role-based access control, mandatory human-in-the-loop approvals for high-risk actions, structured audit logs, and incident-reporting hooks that align with NIS2 requirements for essential and important entities.
Iceland combines EEA legal alignment, strong privacy and free-speech protections, 100% renewable geothermal and hydroelectric power, and one of the coolest climates on earth — ideal for low-PUE AI workloads outside US legal reach.
Yes. Enact supports BYOAK (Bring Your Own API Keys) so model credentials never leave your vault, and customer-managed encryption keys for storage at rest.
[§ 99] BUILT FOR EUROPE
Founder's Key — €89 one-time, 200 seats. Locked to our Iceland data center for life.