Self-hosted Gemini Enterprise alternative for EU data sovereignty

Start by listing every store, then record its location, operator and access path. For an Onyx deployment that usually means the document index (Vespa or OpenSearch), Postgres for accounts and chat history, Redis, object storage for uploaded files, and the model servers. Each one should map to a named EU region or data center in your own cloud account or hardware. Ask the reader to confirm which stores your chosen Onyx configuration uses, since Onyx Lite runs without a vector database or background workers. Keep a current data flow diagram and a store inventory with hostnames, regions and backup locations, because a DPO will ask for that document before anything else.

Remote access from outside the EEA counts as a transfer under EDPB Guidelines 05/2021, even when someone only views data on a screen for support. Auditors will therefore ask for a list of every administrator, vendor engineer and monitoring service that can reach the stack, with its location and the access method. Include managed services such as hosted DNS, email relays, error tracking and identity providers that sit outside your control. Produce access logs for a sample period and the procedure for emergency access. If a vendor or support partner works from a third country, document the access as a transfer and cover it in the contract.

Document every transfer in your record of processing activities, and for each one name the destination, the data category, the legal basis under Chapter V of the GDPR and the safeguard relied on. Under Article 44, onward transfers also need to meet those conditions. Model providers, LLM API endpoints and telemetry tools are the usual gaps. Keep copies of the data processing agreements and the transfer impact assessments you ran, and ask each provider for its sub-processor list and hosting regions. Where the model runs on your own GPUs, the transfer register may be short, and that is the evidence an auditor wants to see.

Your answer depends on who holds the data in the clear and where the operator is established. The CLOUD Act (18 U.S.C. 2713) can reach US providers' data wherever it is stored, and GDPR Article 48 limits recognition of third-country orders to those based on an international agreement. EDPB Recommendations 01/2020 state that where a provider needs data in the clear and the foreign powers go beyond what is necessary, no effective technical supplementary measure is envisioned. For a self-hosted stack, the question shifts to whether any operator or vendor with access is subject to such powers. Write a response procedure, name the legal owner, and record which parties could receive a demand.

Set retention per store and write it down before the first audit. Onyx offers query history auditing and usage analytics, so decide how long those records persist, who can read them, and how deletion works across the index, Postgres, object storage and backups. Model server and reverse proxy logs often contain prompts, so include them. Confirm the exact retention and deletion behavior for your Onyx version with the project, and test deletion of a user's conversations end to end. Auditors will expect a retention schedule, a deletion record and evidence that backups age out on the same schedule.

The Data Act, applicable since 12 September 2025, gives customers the right to switch from a data processing service to another provider or to on-premises infrastructure. It sets a maximum two-month notice period, a 30-day transition and bans switching charges from 12 January 2027 (Articles 25, 29 and 50). Ask your current vendor how it exports conversations, indexed content, agents and configuration, and in what format. For a self-hosted stack, exportable formats for the index, database and prompts matter most, since they determine how portable the system is. Document the export test you ran and the time it took, because that record is what shows the exit path works.

Record the model name, version or checkpoint hash, serving engine version and configuration for every deployment, and keep that history with change tickets. vLLM ships minor releases about every two weeks, and its releases page lists versions such as v0.31.0 on October 5, 2026, so pin the exact version you test and approve. Log the model identifier with each answer where your Onyx configuration allows it, and retain the evaluation results that justified each upgrade. Auditors will ask whether a change went through review, so keep the approval, the regression test output and the rollback plan together.

The cost is a set of components rather than one fee, and most of it depends on your own choices. Infrastructure for the Onyx services (Postgres, the index engine, Redis, object storage and model servers) is paid to your cloud or data center provider. Model serving is the largest variable: GPU capacity for self-hosted models, or API charges if you use a hosted model in an EU region you can verify. Implementation, integration and hardening are paid to whoever delivers them, and staff time to operate upgrades, backups and monitoring recurs. Ask any quote to split one-time work (scoping, connector setup, permission testing, documentation) from recurring work (support, upgrades, model capacity) and to state which GPU and storage sizes it assumes. Gemini Enterprise prices come from Google's own terms and should be compared line by line, not as a total.

The duration depends mostly on your environment and decisions, not on the software alone. The main variables are how many sources you connect, whether each source's permissions can be synced and tested, the state of identity (SSO through Google OAuth, OIDC or SAML, plus SCIM provisioning), the availability of GPUs and approvals to provision them, and how many models you need to validate for data handling. Procurement and security review of the EU hosting location often takes longer than the technical build. No duration is guaranteed here. Ask for a written, fixed-scope plan that lists milestones and what you must supply, such as cloud accounts, network access, identity provider settings and named data owners.

A capable platform team can run it, but the question is whether they have capacity for the whole stack. Onyx is deployable with Docker, Kubernetes, Helm or Terraform, and it works with Ollama, LiteLLM or vLLM for models. The operating load includes patching the index and database, sizing GPU nodes, rotating keys, applying Onyx and Helm chart upgrades, and watching metrics. Multi-node vLLM needs isolated networking because inter-node traffic is unauthenticated by default. Teams that want outside help can buy a fixed-scope implementation, hardening or a support retainer from DeployOpen, which is available as an ongoing service. Decide before work starts which parts your staff will own after handover.

Confirm, in writing, the regional commitments for each stored and processed item, not only the headline EU multi-region. Ask which data stores (indexed content, conversation history, logs, backups and support access) are held in the EU and which are not. Ask which features and models are served only from global endpoints, whether any processing can leave the region, and who can access data from outside the EU for support or administration. Check how retention, deletion and export work for each store. Google's own documentation and your contract are the sources for these answers, so ask for the specific document versions that apply to your tenant.

Treat any global-only model as a separate data flow that needs its own transfer assessment, and in most cases replace it with a model you host or one served in a region you can verify. Under GDPR Article 44, any transfer of personal data to a third country must meet Chapter V conditions, and EDPB Guidelines 05/2021 treat remote access from a third country, even only displaying data, as a transfer. Onyx can use self-hosted models through vLLM, Ollama or LiteLLM, which keeps prompts and retrieved passages inside your infrastructure. Where a hosted model is still needed, document which data it receives, confirm where inference happens, and get legal review before use.

Onyx Community Edition covers the core: RAG, AI chat, agents and actions, under the MIT license, and it can run air-gapped on your infrastructure. Residency does not depend on the edition, because the index, database and processing run where you deploy them. The edition question matters for specific features. Onyx's enterprise features, including RBAC, usage analytics and query history auditing, are listed under the Onyx Enterprise License in the ee directories and may be needed for audit evidence or role separation. Confirm with Onyx which features your auditors require, and which license applies to each component you deploy.

The Data Act gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition under Articles 25, 29 and 50 of Regulation (EU) 2023/2854. It applies from 12 September 2025, and switching charges are banned from 12 January 2027. These rules apply to the service relationship, so check how your Gemini Enterprise contract describes notice, data export formats and transition support. Article 32 also requires providers to take measures against third-country governmental access to non-personal data held in the Union. Have counsel map these clauses to your own contract before you give notice.

Auditors typically ask for a data map showing where each store sits (index, database, object storage, logs, backups and model servers), who can access it, and how access is granted and reviewed. They will also ask for transfer assessments for any third-country access, the processor agreements in place, and records of retention and deletion. DeployOpen prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports or certifications. Independent auditors and certification bodies make those determinations, so agree the evidence list with your auditor before the build begins.