GPU cloud built for
European data sovereignty
Every compute job runs in Hetzner EU data centers under Docker isolation. Workload data stays in the EEA. DPA available. Built for legal, finance, HR, and research AI teams.
The evidence your DPO can review
Compliance depends on your data, purpose, instructions, and risk assessment. We provide concrete technical and contractual evidence; your organisation remains responsible for deciding whether it is sufficient for the intended workload.
| Review item | GhostNexus evidence |
|---|---|
| Workload location | Nuremberg, Germany, recorded in the order form and DPA |
| Execution isolation | Docker flags, network isolation, non-root user, ephemeral filesystem |
| Sub-processors | Hetzner for infrastructure; Stripe for billing; Resend for email |
| Retention | Workload files removed at completion; stdout/stderr retained 30 days |
| Contractual scope | Signed order form and Art. 28 DPA before sensitive production workloads |
GhostNexus is not HDS certified. Do not submit health data or other Article 9 data without a workload-specific written agreement and the safeguards required by your DPO.
Compliance by design, not by checklist
These are architectural decisions, not policies that can be quietly changed.
EU workload residency
Paid private workloads are scoped for execution in Hetzner Nuremberg (DE). Email and billing data use the peripheral sub-processors disclosed below.
Network-isolated execution
Every job runs inside a Docker container with --network=none. Scripts cannot make outbound network calls. Your training data, prompts, and model weights cannot be exfiltrated by the execution environment.
Ephemeral workload files
Scripts and transient input files are removed when the container exits. Client-visible stdout/stderr logs are kept for 30 days, then purged.
DPA available on request
Our Article 28 DPA documents the workload scope, security measures, retention, and sub-processors. It is reviewed and signed for each paid engagement.
Open-source node client
The execution node software is open source (MIT). Your team or DPO can audit the Docker flags, resource limits, and ephemeral-storage controls used for each workload.
French legal operator
GhostNexus is operated by Salim LABOUE, entrepreneur individuel, SIRET 102 801 883 00012. Tax treatment is stated on each order form and invoice.
Docker isolation flags — verifiable
Every job runs with these flags. The node client is open source (MIT) — your security team can audit the exact command constructed before any job executes.
docker run \
--rm \ # Container deleted on exit
--name gn-job-{uuid} \
--network=none \ # ZERO network access
--memory 512m --memory-swap 512m \ # Hard RAM cap
--cpus 1.0 \ # Hard CPU cap
--read-only \ # Immutable filesystem
--tmpfs /tmp:size=64m,noexec,nosuid \ # Ephemeral scratch only
--cap-drop=ALL \ # All capabilities dropped
--security-opt no-new-privileges:true \ # No setuid escalation
-v /tmp/{uuid}_job.py:/job/script.py:ro \ # Script mounted read-only
--user 65534:65534 \ # nobody:nogroup
python:3.11-slim python /job/script.py--network=noneZero outbound/inbound network access. Data cannot be exfiltrated.--read-onlyImmutable root filesystem. No persistent writes outside allowed paths.--tmpfs /tmp:size=64m,noexec,nosuidTemp space capped at 64 MB, non-executable.--cap-drop=ALLAll Linux capabilities removed. No privilege escalation possible.--user 65534:65534Runs as nobody:nogroup — lowest possible privilege.--memory + --cpusHard resource caps. No denial-of-service from runaway jobs.--security-opt no-new-privileges:truePrevents setuid/setgid-based escalation.Workloads GhostNexus is designed for
These examples still require your own lawful basis, data minimisation, and internal approval.
Research & Data Science
Research ethics, data minimisation, purpose limitation, and documented retention
- Evaluate models on pseudonymised research datasets
- Run reproducible batch inference on confidential corpora
- Fine-tune internal models with documented data provenance
LegalTech & Compliance
Attorney-client privilege, GDPR data minimization, bar association data handling rules
- Document classification on contracts containing personal data
- Fine-tune models on confidential legal briefs
- Regulatory document analysis — DORA, NIS2, AI Act compliance workflows
Financial Services
DORA (Digital Operational Resilience Act), EBA guidelines, strict third-country transfer restrictions
- Fraud detection models on transaction data
- LLM for internal financial document Q&A
- Credit scoring model training on EU customer data
HR & Recruiting AI
GDPR Art. 22 (automated decisions), Works council approval requirements in DE/FR
- CV screening models trained on employee data
- Internal knowledge base LLM fine-tuning
- Bias detection models on HR datasets
Data Processing Agreement (DPA)
Required under GDPR Article 28 when using a processor
Your ML team can start today
Start with a scoped, month-to-month pilot. We validate one workload, document the execution boundary, and provide the DPA for your legal or DPO review.
Founding pilot: €299 for one month, subject to workload and capacity review.