Licensed to be used in conjunction with basebox, only.
// security
Model providers
Applies to
Product: Cloud · Server · Audience: Security / Compliance reviewer
Which model infrastructure is used per deployment model. In Cloud and Server the language model runs on the same servers as the basebox platform. In the Cloud, providers of additional compute are added only as sub-processors on your list (Data processing & sub-processors). An external model exists only as a separate app: the optional app with an external model. In the Cloud transition phase until November 2026 the AI models come from Google Vertex AI in Frankfurt.
Per deployment model
| Where the language model runs | Who controls the hardware | Do prompts go to third parties? | |
|---|---|---|---|
| basebox Cloud | On the basebox servers, together with the platform, in the data center of noris network AG in Munich | FAST LTA (ownership, servicing), operated by basebox | No – except to providers of additional compute (e.g. STACKIT, Mistral AI in the EU) if they are on your list of sub-processors, and in the app with an external model |
| basebox Cloud (transition phase until November 2026) | Google Vertex AI in Frankfurt, until the move; the platform runs at Hetzner in Nuremberg | Google (models), Hetzner (platform) | Yes – to Google as sub-processor |
| basebox Server | On the server or a customer GPU host in the same network; bundled (vLLM in the chart) or the customer's external OpenAI-compatible endpoint | Customer | No – except in the app with an external model or if the customer connects an external service themselves |
Transition phase until November 2026
In the transition phase, prompts go to Google Vertex AI in Frankfurt. basebox is a processor here as well; Hetzner and Google are sub-processors (basebox.ai/en/contract). Health data and other special categories under Art. 9 GDPR are best processed only after the move (Transition phase).
Which models
basebox does not develop its own AI model; it runs open-source models itself: in the Cloud on the Cloud's servers, on Server on your hardware. basebox installs the models that fit the available hardware and documents source, licence and version in the Model register. The models are only quantized (runtime and memory optimization); no fine-tuning, no retraining, no change to weights or architecture (Compliance document). Before delivery basebox checks models for documented vulnerabilities and provides no models that violate Art. 5 EU AI Act.
In the Cloud transition phase until November 2026 the models come from Google Vertex in Frankfurt until the move – proprietary third-party models.
Which models make sense on which hardware: LLM recommendations · Tested models.
An external model exists only as a separate app
Besides the AI model in basebox there is the optional app with an external model. There is none by default: you decide whether you want one. Your administrator sets it up as a separate app and releases it only for selected groups; basebox switches nothing on. Whoever does not see the app does not use it.
| AI model in basebox | App with an external model | |
|---|---|---|
| Location | On the Cloud's servers in Germany or on your server | Google Vertex in the EU, with models from Anthropic, on request from Google; on request also at OpenAI |
| Training, storage at the provider | No training | No training; logging for abuse detection: Google no longer than 30 days, OpenAI up to 30 days (longer only where required by law or necessary to prevent harm) |
| Sub-processors | None outside the EU | Google, OpenAI on request; named in the list of sub-processors |
| US CLOUD Act | Does not apply | Applies, because Google and OpenAI are US companies |
| Available | Cloud and Server | In the Cloud; on Server if your firewall allows the connection |
| Cost | Included in the licence | Through the token allowance, €9 per million tokens |
Whether you use the app and for which data, you decide with your data protection officer. On request, basebox provides models from OpenAI or Google through its own access, also billed via tokens. If your organisation connects a provider under its own contract, that provider is not a sub-processor of basebox.
External models on a server
Instead of the bundled inference, a server can use an external OpenAI-compatible endpoint (Connect inference). Documented and proven is this for a customer-owned GPU host in the same network. Technically an external AI service can be connected the same way – the compliance document mentions the "optional connection of external closed-source models (purchased separately by the customer)". Then:
- Prompts, history, retrieved context and document contents go to that service – outside your data processing boundary.
- The contract with the service (DPA, third-country transfer, training exclusion, retention) is your matter; basebox is not involved. Providers you commission and connect yourself are not sub-processors of basebox.
- The commitments of this documentation on data flows and storage do not apply to that path.
- No silent fallback: if the endpoint is offline, basebox shows the error; it does not switch unnoticed to another model.
Recommendation for regulated environments: local inference. Whoever connects an external service documents it as a processing activity of its own.
What the model sees
With every request: the organization's system prompt, the user's personalization, the conversation history, the current input, retrieved text passages from knowledge bases and documents, tool results from connectors and web search.
- Cloud: the request stays on the Cloud's servers unless a provider of additional compute works for you. The AI model is shared; every request is processed without permanent storage and stays logically separated; there is no learning from requests.
- Server: vLLM keeps requests in GPU memory only for the duration of processing; there is no learning from requests (Inference architecture).
- Cloud in the transition phase: the request goes to Google Vertex AI in Frankfurt. Google does not train on the inputs and logs them for abuse detection for no longer than 30 days; Google's terms of service for Vertex apply. As a US company, Google is subject to the US CLOUD Act.
What basebox does not do
- No training or fine-tuning on customer content – in no environment.
- No forwarding of prompts to third parties in Cloud and Server, except to providers on your list of sub-processors and in the app with an external model that your administrator releases. In the Cloud transition phase, prompts go to Google Vertex AI until the move. Everywhere, the administrator-controlled exceptions web search and connectors come on top.
- No content filters as a security guarantee – behavioural rules are set by the system prompt, enforcement is done by approvals (Policies).
For the review
- Cloud: AI model and platform on the Cloud's servers at noris network AG in Munich-East; further providers only via the list of sub-processors. Assess the app with an external model as a separate processing activity. Take the sub-processors from the list (Data processing & sub-processors).
- Server: include the inference host in the data processing boundary; with an external service, assess separately.
- Take the model list with version and licence from the Model register; document your own models yourself.
- Transition phase: include Hetzner and Google as sub-processors until the move; Art. 9 data only after the move (Transition phase).
Next step: Web search