Scaleway

Scaleway provides a Data Processing Agreement (DPA) in accordance with Art. 28 GDPR.

As an EU company, Scaleway processes data without third-country transfers, so Standard Contractual Clauses (SCCs) are not required.

Scaleway is contractually committed to reporting security incidents 'as soon as possible'; no fixed hourly deadline is specified.

Scaleway operates its Generative APIs services in its own EU data centers.

Scaleway publishes a sub-processor list on its website and grants customers a 30-day right to object to changes.

Scaleway is a French company (Scaleway SAS) and, as an EU entity, is not subject to third-country transfer requirements.

Scaleway generally deletes requests and generated content immediately after processing (zero retention); exceptions apply for detected abuse activity and in batch mode, where inputs are stored for up to 24 hours.

Scaleway contractually commits not to use customer data (prompts, completions) for training or improving base models and not to make it accessible to third parties.

Since Scaleway does not use customer data for training by default, no separate opt-out is required — this is the contractual default.

Scaleway is ISO/IEC 27001:2022 certified (scope: the technical infrastructure platform supporting its Public Cloud products; valid until 2026-12-05).

Scaleway holds no SOC 2 or C5 attestation; only CSA STAR Level 1 (CAIQ) is available in its trust center.

Pure inference/hosting provider: the AI Act's Article 53 documentation duty falls on the provider of the GPAI model, not on whoever runs the inference. This provider cannot discharge it for third-party models; the duty sits with the respective model provider.

Pure inference/hosting provider: the GPAI Code of Practice is open to providers of general-purpose AI models. A provider that merely operates third-party models is not eligible to sign, so an absent signature is not a shortcoming.

Scaleway publishes its contract documents (General ToS, DPA, Specific Conditions AI Services, SLA) publicly on scaleway.com.

Scaleway publishes an SLA for Generative APIs with a 99.9% monthly availability commitment and credit-based compensation for shortfalls.

Scaleway's general liability clause does not impose a flat liability cap but only excludes indirect damages.