Built on certified infrastructure

Your data is encrypted, split into shards, and distributed across 12 independently audited storage providers in 230+ locations. No single provider holds a readable copy.

Ask a security question

Trust Center · Last updated 8 October 2026

12
Independently audited storage providers
230+
Storage locations across our providers
0
Providers holding a readable copy of your data
Every object
Covered by a signed audit record

Compliance

ironshard
GDPRCompliant, DPA available
EU data residencyPinned to your jurisdictions
See the docs →
infrastructure providers

Every provider we use is independently audited, most with both SOC 2 Type II and ISO 27001.

See all providers →

Product & data securityBuilt into the storage layer

Encryption

Data is encrypted at rest and in transit.

Key management

Data encryption keys are encrypted and protected by a Key Management Service (KMS).

Erasure-coded shards

Each object is split into encrypted fragments. One fragment alone is meaningless, but the object is recoverable.

Per-agent access control

Each agent gets its own identity and a policy that limits what it can reach.

Signed audit log

Every read and write is recorded, signed, and exportable as structured JSON.

Isolated branches

Agents work on copy-on-write branches; production stays untouched.

Multi-cloud by design

IronShard spreads encrypted shards across 12 independent storage providers and 230+ locations, from European specialists to global hyperscalers. Each provider is independently audited, and no single one ever holds a readable copy.

European providers

OVHcloud

France · 30 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • BSI C5
  • PCI DSS
  • HDS
  • + more
Compliance page ↗

Exoscale

Switzerland · 8 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • BSI C5
  • HDS
  • TISAX
Compliance page ↗

Hetzner

Germany · 3 locations

  • ISO 27001
  • BSI C5
Compliance page ↗

ScanNet

Denmark · 1 location

  • ISO 27001
  • ISAE 3402 Type II
  • ISAE 3000
Compliance page ↗

Global providers

Microsoft Azure

US · 47 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • BSI C5
  • PCI DSS
  • CSA STAR
  • + more
Compliance page ↗

Google Cloud

US · 43 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • BSI C5
  • PCI DSS
  • CSA STAR
  • + more
Compliance page ↗

Amazon Web Services

US · 34 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • BSI C5
  • PCI DSS
  • CSA STAR
  • + more
Compliance page ↗

Akamai (Linode)

US · 20 locations

  • ISO 27001
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • SOC 2 Type I
  • BSI C5
Compliance page ↗

IBM Cloud

US · 13 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • BSI C5
  • PCI DSS
  • CSA STAR
  • + more
Compliance page ↗

Tigris

US · 11 locations

  • SOC 2 Type II
Compliance page ↗

DigitalOcean

US · 9 locations

  • SOC 2 Type II
  • SOC 3
  • ISO 27001 data centers
Compliance page ↗

Cloudflare

US · 4 locations

  • ISO 27001
  • SOC 2 Type II
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • BSI C5
  • PCI DSS
  • EU Cloud CoC
  • + more
Compliance page ↗

Storage providers and sub-processors →

Common questionsAbout security and compliance

Is IronShard GDPR-compliant?
Yes. IronShard is GDPR compliant as a whole service, not only in how it stores files. It acts as your processor under a Data Processing Agreement that meets Article 28 and applies automatically, publishes its sub-processors, and keeps personal data encrypted, fragmented, and unreadable to any single storage provider. You remain the controller of the data you store, so your own legal basis and your own users' requests stay with you. GDPR Everywhere
How does IronShard support EU AI Act obligations?
Through automatic lineage and audit. Every dataset state, training run, and inference read is recorded and signed, so the questions the Act asks (which data did this model use, who accessed it, and can the result be reproduced) are answerable from the log.
Can healthcare and finance teams run AI agents on IronShard?
Yes. Agents work on isolated branches of real data with per-agent scoping, and every access is logged immutably. IronShard is engineered to meet the storage requirements of HIPAA, GLBA, and PCI-DSS; the Enterprise page covers how these deployments are structured. Enterprise
Where does my data physically live?
Where you pin it. Data is fragmented and distributed across the providers and regions you choose, and it stays within those boundaries. No single provider holds a complete file.
Why does data lineage matter for compliance?
Without versioning and lineage, you cannot prove which datasets trained which model, reproduce a result, or explain an output. IronShard captures dataset state and access history automatically, so lineage is a record you export rather than a document you assemble.