Palantir and data sovereignty in Europe: deployment options, controls the customer keeps and exit strategy.

Palantir and Data Sovereignty in Europe: What the Customer Decides

11 August 2026

A technical reading of a debate that is usually framed in political terms

Quick Answer

The sovereignty of a Palantir deployment is not settled by asking where the vendor is from, but by answering four concrete questions: where the platform runs, who controls access to the data, where the models run and how you get out if one day you have to.

The first three have documented answers. Apollo supports deployment in the cloud, in the customer's cloud or in an air-gapped environment with no internet connection; mandatory controls travel with the data; and AIP supports models self-hosted on the customer's infrastructure.

The fourth, the exit, is the one almost nobody negotiates in time, and the one that most determines real dependency. It should be designed on day one, not on the last day.

Running in a European region is not sovereignty. It is a box ticked in a contract.

Through 2026 the European debate about Palantir has become very visible. France's domestic intelligence agency announced in June that it would replace its tools with those of a national provider; France and Germany signed a declaration in July to build a sovereign European digital backbone; and in Spain a reported veto was publicly denied by the responsible minister.

That context is real and worth knowing. But a board evaluating the platform cannot decide on headlines: it needs to know which decisions remain on its side of the table.

Dependency is not created by the vendor's country, but by the design of the deployment and the contract.

Where It Runs

Palantir describes an architecture in which Apollo manages the infrastructure hosting Foundry and AIP and orchestrates zero-downtime upgrades across very different environments. In practice, that opens three scenarios:

Managed service, in the region the customer chooses.
Deployment in the customer's infrastructure, in their own cloud account.
On-premise or air-gapped, with no internet connection, which is what makes the platform viable in defence and parts of the public sector.

The question worth asking a vendor is not "do you have a European region?" but who administers the environment, with what access, and under which change procedure.

Who Controls Access to the Data

Here the platform offers a stronger model than the market average, and it is worth understanding properly. According to the security documentation, mandatory controls — markings, classification-based access controls and organisations — travel with each unit of data as it is derived, supported by provenance and lineage. Discretionary controls, by contrast, filter what is read but do not follow what is exported.

For a multinational with subsidiaries in several countries this has an immediate application: separation between subsidiaries or jurisdictions is modelled with mandatory controls, not with filtered views.

Diagram: where Palantir runs and what the customer still controls, covering markings, models, auditing and exit.

Where the Models Run

In the AI layer, sovereignty is decided somewhere else: which model processes the data, and where. AIP supports self-hosting models, open-source or custom, on the customer's infrastructure, including air-gapped environments, alongside the managed catalogue and connecting your own model through an external service.

In a European deployment the practical decision is usually mixed: self-hosted models for flows with personal or sensitive data, and the managed catalogue for the rest, with traceability of which application uses which model.

It helps to separate two planes that are often mixed:

What the platform provides: access controls, encryption, audit logging and lineage, which are direct inputs for demonstrating compliance.
What remains yours: the lawful basis for processing, the risk analysis, the impact assessment where required, data minimisation and the classification of the use case under the EU AI Act, which depends on the use and not on the product.

Plainly: no platform makes you compliant. It gives you the tools and the evidence. We also cover this in generative AI governance.

The Uncomfortable Question: How You Get Out

This is the part that most shapes dependency and the least negotiated. Three concrete fronts:

The data. It must be exportable in open formats, and the extraction should be tested before signing, not after.
The logic. Transformations and functions are your assets: keep them in repositories you can take with you.
The business model. Objects, links and actions are reachable through APIs and the Ontology SDK, which allows the model to be rebuilt elsewhere. What does not export without effort are the applications built inside the platform.

Our recommendation: an annual exit test, the way disaster recovery is tested. If it has never been tried, the exit strategy does not exist.

How We Approach a European Deployment

Classify before modelling: which data cannot leave which jurisdiction.
Choose the deployment scenario per use case, not for the whole company.
Model separation between subsidiaries with mandatory controls.
Decide per flow which model is used and where it runs.
Document the exit and test it.

Do you have to justify to a board or a regulator where your data ends up?

At Galde we deploy Palantir Foundry in European multinational corporations and in public administrations, where the sovereignty question is not rhetorical. We design the deployment, the controls and the exit strategy with that demand in place from day one.

Tell us about your case

How Galde Can Help

Through our Palantir consulting and implementation, we define the deployment scenario, the separation by jurisdiction and where models run according to the sensitivity of each flow.

Through data governance, we translate your regulatory obligations into classification, mandatory controls and audit evidence.

And through data platforms, we design coexistence with your current platform and the way out, so that dependency is a decision rather than an accident.

Conclusion

Sovereignty is not bought with a European region, nor lost because of a vendor's passport. It is decided at four points: where the platform runs, who controls access, where the models run and how you get out. Palantir documents solid options for the first three. The fourth depends entirely on you, which is why it belongs on the table before signing.

Palantir®, Foundry® and AIP® are trademarks of Palantir Technologies Inc. Galde is not an official Palantir partner and is not affiliated with the company; we implement the platform for our clients. This article is not legal advice.

Frequently Asked Questions

Can Palantir be deployed without data leaving Europe?

Yes. The platform supports deployment in a chosen region, in the customer's infrastructure or in air-gapped environments with no internet connection. What needs pinning down is who administers that environment and with what access.

Is choosing a European region enough for GDPR?

No. Location is one element among several. The lawful basis, minimisation, impact assessment where required and management of access — including the vendor's own — remain yours.

How is data separated between subsidiaries in different countries?

With mandatory controls such as markings, classification-based access controls and organisations, which follow the data as it is derived. Row and column filtering does not travel with what is exported.

Can we use AI models that never leave our infrastructure?

Yes. The documentation describes self-hosting open-source or custom models, including environments with no internet access, alongside the managed catalogue for cases where it is acceptable.

What should an exit strategy include?

Data export in open formats, control of transformations and functions in your own repositories, access to the model through APIs or the Ontology SDK, and a real extraction test repeated periodically.