Sovereignty
Sovereign by architecture, not by promise
Your data stays where it lives. Qry runs in an installation of its own, and the models it uses are reached under your contracts. This page says exactly what runs where — and what leaves.
What runs where
Every piece, and where it lives
- Qry and its database
- One installation per organisation — run by IXEN, or inside your own Google Cloud, Microsoft Azure or Kubernetes.
- Your data
- Stays in your databases. Qry queries it with an account you grant and reads only the results it needs to answer.
- The models
- Claude, GPT or Gemini through your own Anthropic, Azure AI Foundry, Google Vertex AI or OpenAI account — in the region you choose — or a model you host behind an OpenAI-compatible endpoint.
- Documents
- In your workspace storage: Amazon S3, Google Cloud Storage, Azure Blob Storage or the installation's own disk.
- Identity
- Your identity provider: Microsoft Entra ID or Google, with your directory groups.
- Credentials
- Stored encrypted with a key set by whoever installs Qry. There is no default key.
What leaves the installation
Three destinations, all of them yours to choose
Your model provider
The question and the data needed to answer it go to the model you configured, under your contract with that provider. Nothing is sent to a model you did not choose.
Your data sources
The queries Qry runs, with the account you granted, read-only if you follow our advice.
The licence check
Qry checks its own licence with IXEN's licence service. It carries no customer data — no questions, no answers, no data.
No telemetry
We do not watch how you use it
Qry sends no usage analytics, error reports or behaviour tracking to IXEN. What happens in your installation is visible to your administrators, not to us.
- Usage, budgets and audit stay in your installation's database
- Web search and external tool servers only when you enable them
The company
IXEN, which builds and runs Qry, is certified at the HIGH category of Spain's National Security Framework (ENS).
Verify it yourself
You do not have to take our word for it
Every release image is signed and ships with a software bill of materials, so your team can check what it runs. Containers run without privileges, and a release with a known critical vulnerability that has a fix is not published.
- Signed images (Sigstore Cosign)
- SPDX software bill of materials with every release
Where the limits are
- Qry needs to reach its licence service at least once a day; a fully disconnected installation is not offered today.
- A hosted model processes what you send it under its provider's terms — choose the provider, region and contract that fit your obligations, or host the model yourself.
See it on your own data
We'll set up Qry against a dataset you choose and walk you through it — one hour, no slides.