Security
Sovereignty is not a hosting region — it is jurisdiction, isolation, auditability and the ability to operate with the cable unplugged. These are the controls the platform is built on.
ArcemCloud is a Norwegian company with Norwegian owners, staff and data centers. No parent entity or operational dependency places customer data within reach of the US CLOUD Act, FISA 702 or any other foreign legal instrument. Data, metadata and support access all stay in Norway.
Every tenant gets a dedicated Kubernetes namespace with a default-deny network policy: nothing talks to a workload unless explicitly allowed, and workloads reach nothing by default. GPU sharing uses NVIDIA MIG for hardware-level partitioning — no soft time-slicing between tenants. Customer-supplied model weights stay inside the customer's own isolation boundary: they are never copied to shared storage, another tenant or ArcemCloud.
Every administrative and API action is appended to a hash-chained audit log. Each record commits to the hash of the one before it, so any retroactive edit or deletion breaks the chain and is detectable. Chain heads can be exported for independent verification.
Authentication and authorization run on Zitadel, hosted inside the platform — no third-party identity provider sees your logins. Secrets, keys and certificates live in OpenBao, likewise self-hosted, with sealed storage and audited access.
The platform is built to run with the uplink physically absent. Model weights, container images and updates arrive via controlled offline transfer, and zero-egress verification confirms that no workload traffic leaves the enclave — measured, not assumed.
Every container image, model artifact and dependency is version-pinned, checksummed and mirrored through a private Harbor registry. Nothing is pulled from the public internet at runtime, and every artifact in production can be traced to a reviewed source.
Detailed control mappings against NSM grunnprinsipper, GDPR and DORA — along with architecture and audit documentation — are available to qualified buyers under NDA.
Request documentation