Orbifs is an EU-hosted project file system. Your project data is stored on European infrastructure — file content, metadata and backups all in Paris — operated by a European cloud provider, and governed under EU/EEA data-protection law. Here is precisely what that means — and, just as importantly, what we do not claim.
Orbifs is a European-hosted, EU-governed project file system. Customer file content and metadata are stored in Paris (EU), on European cloud infrastructure, with backups kept off-region in Paris (EU). The provider, Archi Systems AS, is established in Norway, within the EEA, and applies the GDPR. We do not market Orbifs as a “fully sovereign cloud” unless and until a complete, verified sovereignty package supports that claim.
We use deliberately accurate language. “Sovereign cloud” is not a single feature — it can involve data location, metadata, logs, backups, encryption keys, support access, subprocessors, contracts, legal jurisdiction and operational governance. We describe each of these honestly rather than reduce them to a slogan.
Under the current architecture, no customer project data is stored outside the EU — metadata, file content and backups all in Paris. That includes:
| Storage | Detail |
|---|---|
| Metadata region | Paris, France (EU) |
| Object / file content | Paris, France (EU) |
| Backups | Off-region, Paris (EU) |
| Provider | OVHcloud — named in our sub-processor list |
| Protection | TLS in transit; SSE (AES-256) at rest; immutable WORM versions |
| Data transfer | No data-transfer fees for customers |
Because Norway is part of the EEA, Archi Systems AS is itself subject to the GDPR — and hosting customer data in the EU (Paris) involves no transfer of personal data outside the EEA.
| Item | Detail |
|---|---|
| Legal entity | Archi Systems AS |
| Company registration | Norwegian org. no. 916 683 332 |
| Registered address | Gustav Vigelands Vei 36, Oslo, Norway |
| Jurisdiction | Norway — a member of the EEA, applying the GDPR |
| Brand / service | Orbifs (orbifs.eu) |
| Sales model | Sold directly by Archi Systems AS — no resellers in the data path |
A sub-processor is a third party that processes customer data on our behalf. We keep this list small and EU-based, and publish the full named list in our sub-processor list and DPA.
| Sub-processor | Purpose | Location |
|---|---|---|
| OVHcloud | Hosting, storage and infrastructure for all customer data | Paris (EU) |
| Mollie B.V. | Billing and payment processing — account/billing data only, never project files | Netherlands (EU) |
| Google / Microsoft (optional sign-in) | Only when a user chooses "Sign in with Google/Microsoft" — authentication data only | Ireland (EU) |
Support and transactional email is not on this list — we run our own mail server in the EEA, so no third party handles your correspondence. See the full sub-processor list →
If any operational vendor is located outside the EEA, we document the transfer mechanism (such as Standard Contractual Clauses) and assess it before use. No such transfer is planned for customer project data, which stays on European cloud infrastructure in France. Any vendor that processes personal data is added to the published list, with purpose and location, and customers are notified of material changes.
You control who in your organisation can reach projects, through user accounts, roles and permissions in the Orbifs admin console. Guest and client access can be granted and revoked per project, so external partners only ever see what you share with them.
We do not call Orbifs a “fully sovereign cloud.” That term carries specific expectations across keys, support access, contracts and jurisdiction that we are still finalising. When the complete, verified package is in place, we’ll say so — and not before.
We’ll provide the Data Residency Statement, our DPA and subprocessor list, and answer your security questionnaire from a maintained answer bank.