True sovereignty, atomic security and compliance by design — built on open standards, without relying on US hyperscalers.
US solutions were designed under a different legal and regulatory framework. Opendome was built from day one to meet the requirements of the European regulatory framework — without retrofitting.
Any architecture where data resides outside the customer's infrastructure creates a dependency that someone will eventually monetize. Since 2018, the CLOUD Act has also required US providers to hand data over to US authorities, wherever it is stored.
Opendome is deployed in the customer's cloud. The data never leaves its jurisdiction.
A permission model that cannot answer the question "can this identity see this specific field, for this task, on this entity?" is not enough for regulated enterprise environments. The Opendome Cell Model was designed to answer exactly that question — not as configuration, but as an infrastructure guarantee.
GDPR, DORA and the EU AI Act have specific technical requirements — data residency, access traceability and human oversight. In Opendome, those requirements are addressed at the infrastructure layer, not the configuration layer.
When code is auditable, claims about security and sovereignty can be verified. Any customer, auditor or regulator can inspect how Opendome works. That transparency is the only honest way to build trust in critical infrastructure.
The pressure to deploy AI is leading many organizations to buy partial solutions from each vendor. The result is a fragmented architecture. AI needs a single access system: centralized, consistent and secure.
95% of generative AI pilots fail to deliver measurable impact. According to MIT, the cause is not the models: it is data integration (State of AI in Business, 2025).
For twenty years, data was designed for people or purpose-built systems, always with predefined context. AI does not have that: it reasons across multiple systems, different naming conventions and implicit relationships. Without a centralized semantic foundation, it infers, interprets and gets things wrong.
Salesforce, SAP, Oracle, Microsoft and other US hyperscalers are launching headless versions of their platforms. The reason is clear: AI does not consume per-user licenses. Their traditional revenue model is at risk — and their response is predictable. If they used to charge you for access to their interface, they will now charge you for access to your own data via API. With no added value. Your data, in their infrastructure, becomes their business.
No proprietary technology. No closed formats. Every component was chosen because it is best in class, auditable and creates no dependency.
Data is stored in an open format compatible with any query engine and analytics tool. No proprietary formats, no dependency on any vendor to read your own information — now or ten years from now.
A transformation and modeling layer that turns raw data into knowledge: deduplicated identities, corpora anchored to their metadata and a semantic graph that connects them. AI does not work on tables: it works on entities with relationships, context and meaning defined explicitly and auditably.
The security and observability layer that makes the Cell Model possible. Every access is recorded with its full context in an immutable, append-only log. If an identity attempts to operate outside its scope, the system blocks it in real time. This is not monitoring — it is an infrastructure guarantee.
This is not a checklist. It is a technical description of how each regulatory requirement is addressed in the product architecture.
Data residency in the correct jurisdiction, access minimization, purpose limitation and the ability to demonstrate that personal data is processed in accordance with regulations.
Data resides in the customer's infrastructure — never in ours. The Cell Model ensures that each identity accesses only the data strictly necessary for its purpose. Access minimization is not a policy — it is a property of the system.
Complete traceability of access to critical systems, third-party technology provider risk management and the ability to demonstrate operational resilience to an auditor.
The observability layer automatically generates the record DORA requires: which identity accessed which data, for what purpose, at what time, and whether it attempted to operate outside its scope. That record is immutable and auditable.
AI systems that operate on sensitive data in financial environments are classified as high-risk. It requires human oversight, decision traceability and validation before production deployment.
The test environment allows AI to be validated against real data before it reaches production. Once deployed, the Cell Model and observability ensure that it operates within the defined boundaries at all times.
A documented information security management system, with auditable controls over access, traceability and risk management.
Opendome's architecture is compatible with the security controls defined in ISO 27001. Formal certification is on the roadmap for 2026.
The reference standard for Spain's public sector and for companies working with public authorities. It requires access controls, traceability and incident management.
The same mechanisms that address GDPR and DORA — the Cell Model, atomic observability and data residency — apply directly to ENS requirements.
These are not marketing promises. They are architecture and business decisions we made before writing the first line of code.
Hyperscalers delegate services to partners: their business grows through licenses, not outcomes. We do the opposite. We take part in implementation, adapt the solution to each customer and take responsibility for the outcome. Services are not a necessary evil: they are the most honest way to learn and create real value.
We are EU-first in security and regulation. That is why we build on open-source technologies already running in the world's largest companies. Open source is not just a technical decision: it means transparency, auditability and the assurance that your data is never trapped in a proprietary format.
Organizations that contact us are looking for a technical conversation about preparing their data infrastructure before deploying AI. If that is where you are, let's talk.
Request a technical meetingSix European regulations apply to an enterprise AI deployment, and most of them ask for the same things in different words. This manual reduces them to four common questions and explains what each one requires, of whom and from when. It covers the four layers of data sovereignty. A shared reference for executives, business, technology and legal teams.
Descargar el whitepaperBusiness memory already exists: it lives in the data. The only memory that should belong to the agent is procedural.
guardrails vs data security"The agent has guardrails, so the data is protected." That sentence conflates two things operating on different planes. Guardrails watch what the agent says; they don't govern what it accesses. Only structural, reproducible access control protects the data — because it isn't statistical: it's deterministic.
Enterprise AI strategyThere's no enterprise AI strategy without centralizing, relating, describing, and protecting the data. They aren't four good ideas to choose among. They're four conditions, and missing one invalidates the rest.
Ver todos los recursos