Sovereign AI for confidential professions
9brains combines research, analysis, and firm knowledge in a centrally managed multi-model AI platform, for lawyers, tax advisors, auditors, patent attorneys, and other professionals bound by confidentiality. With German core infrastructure, no training on your data, and strict EU mode for particularly sensitive content.
Those who protect other people's secrets should choose their AI sovereignly, too.
7 days free · no credit card
30 minutes, no obligation · with IT or data protection on request
Law firm practice
Lawyers, tax advisors, auditors, patent attorneys, and other professionals bound by confidentiality work with information whose disclosure harms clients or is prohibited by law. The answer is neither uncontrolled use nor a blanket ban, but a centrally governed and traceable environment.
Confidential client information does not belong in unexamined consumer AI accounts. Professionals bound by confidentiality are additionally subject to the criminal secrecy obligation under Section 203 of the German Criminal Code.
A data processing agreement addresses personal data. Professional secrets can go further. Depending on the profession, external AI services must in particular observe Section 43a BRAO, Sections 39a and 39c PAO, and Section 203 of the German Criminal Code.
AI can formulate convincingly while still naming incorrect decisions, file numbers, or publications. Professional review remains essential.
Contracts, expert opinions, financial statements, patent claims, and technical terminology leave little room for interpretation. AI can prepare work, but it does not replace final professional review.
Efficiency gains must not lower the standard of care. Firms need clear roles, approval points, sources, and rules of use.
Private individual accounts lead to inconsistent settings, unclear data flows, and missing governance. A central platform creates shared approvals and security rules.
Institutional context
Germany and France define digital sovereignty as the ability to develop, use, adapt, and control digital technologies independently, self-determinedly, and securely. The criteria include protecting sensitive data, avoiding lock-in effects, and resilient infrastructure.
For a firm or practice, this becomes a practical question: who processes confidential client and professional secrets, where does it happen, and under which contractual conditions?
Joint Franco-German definition, 17 June 2026The 9brains answer
The four central security and sovereignty features at a glance.
The core platform, production data, and requested chat histories are hosted in Hetzner data centres in Germany. Encrypted backups are kept in Helsinki within the EU.
For every model provided on the platform, we contractually ensure that neither your inputs nor generated responses are used for training. This applies regardless of sovereignty mode and ZDR status.
Zero Data Retention (ZDR) means that the respective model provider discards submitted data immediately after processing and does not store it temporarily. Without ZDR, the provider may retain data for a limited period, for example to detect abuse. The current ZDR status is visible for every model in our platform.
In strict EU mode, only EU-sovereign models are approved. Model processing then takes place entirely and physically on EU infrastructure. This mode is intended for client and invention secrets.
Contractual basis
The 9brains data processing agreement governs processing of personal data under Article 28 GDPR. The supplemental agreement for professional secret holders extends contractual rules to third-party client, business, and other professional secrets, regardless of whether they are personal data.
Depending on the profession, professional rules set concrete requirements for using external providers: careful selection, a text-form contract, confidentiality obligations, and rules for further persons involved, for example Section 39c PAO for patent attorneys. For directly mandate-related services with access to third-party secrets, documented client consent may additionally be required.
Discuss the DPA, supplemental agreement, and professional-law requirements in 30 minutes, together with IT or data protection if you wish.
Traceability
The data flow clearly separates the 9brains platform, model processing, retention at the model provider, and your optionally stored chat history.
Authorised users submit content through encrypted transmission.
9brains checks permissions, adds approved context, and forwards the required data to the selected model.
The model processes the request according to the selected sovereignty mode. Strict EU mode is intended for client and invention secrets.
The response returns encrypted. With ZDR, the model provider discards the data immediately; without ZDR, limited retention may occur.
If you choose to save the conversation, it is retained separately from model processing on the 9brains platform in Germany.
The sovereignty mode controls step 3
Your administrators determine which model categories are available. The following levels explain the product logic.
EU-sovereign models only, with model processing entirely on EU infrastructure.
Wider model choice for everyday business under the defined data protection rules.
Global models only for deliberately approved, non-critical, non-personal content.
Productive use
Structure contracts, expert opinions, financial statements, tax assessments, briefs, and attachments, and prepare key points, deadlines, and irregularities.
Prepare first drafts of client communications, statements, and internal memoranda.
Make technical texts accessible across languages and then perform expert final review.
Retrieve templates, internal guidelines, and quality standards from approved documents with linked references.
Use skills and agents with defined roles, approval points, and traceable sources.
FAQ
No, not without prior classification. Establish binding rules of use and use strict EU mode for client and professional secrets. Your firm or practice assesses additional mandate-related requirements and any consent needed for the specific case.
No. For every model provided through 9brains, we contractually ensure that neither your inputs nor generated responses are used for training. This applies regardless of sovereignty mode and ZDR status.
With Zero Data Retention, the respective model provider discards your data immediately after processing without temporary storage. Without ZDR, the same model provider may retain data for a limited period, for example to detect abuse. Your requested chat history is stored separately in Germany.
The core platform and production data are in Germany. Encrypted backups are stored in Finland within the EU. The AI model processing location depends on the sovereignty mode. In strict EU mode, model processing is also entirely on EU infrastructure.
The 9brains core platform is operated by Hetzner in Germany and therefore not by a US cloud provider. In modes other than strict EU mode, models from international or US providers may be approved. Strict EU mode is provided for processing restricted entirely to EU infrastructure.
The DPA governs personal data under GDPR. 9brains also provides an agreement for professional secret holders. For directly mandate-related services with access to third-party secrets, documented client consent may nevertheless be required, e.g. under Section 39c(5) PAO for patent attorneys.
Next step
In 30 minutes, we show data flows, sovereignty modes, contractual documents, and useful use cases for your firm or practice. No generic AI show, with focus on your security and professional-law questions.
