Loading the catalogue…
evroc Think
L1 · European-hostedevrocSwedenEurope
Swedish cloud provider offering shared inference for open-weight models (Think) over an OpenAI-compatible API, from its own data centres in Sweden.
Compliance posture · Stav's assessment
Jurisdiction
EU · Sweden
Data residency
EU
CLOUD Act / FISA 702
Not exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Adequate
Legal exposure
Adequate
Serving retention
Adequate
Security posture
Weak
Contractual posture
Weak
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 10 risk items · 6 safeguards · 5 privacy-policy issues · DPA, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 23 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L1European-hostedIndicativeregistry 4.1
This level applies to traffic routed through Stav.
evroc AB is a Swedish aktiebolag (559398-0930) serving the evroc Think inference product from EU data centres in Stockholm, Paris and Frankfurt, with no US parent or CLOUD Act exposure — strong L1 and l2.anti_coercion credentials. The binding L2 gate falls on independently audited security certification: no ISO 27001, SOC 2 Type II or equivalent certificate has been published, which is consistent with the platform having only reached general availability in mid-2025 and Think remaining in public beta. To advance to L3, evroc would additionally need to resolve the partial ownership picture (Giant Ventures UK minority stake) at the primary register level and publish evidence that privileged access is confined to EU/EEA personnel.
One criterion from L2: Independently audited security certification.
Stav's own assessment against criterion registry 4.1. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 25 Sept 2026About the ladder →Certifications & legal documents · the provider's own facts
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listnot published
Links to every document and certificate — 3 legal documents
Compiled by Stav from the provider's published documentation. Last verified 14 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 10
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| glm-5-2 | €1.25 | €5.00 | 0.12 s | 307 |
| mistral-medium-3.5-128b | €1.50 | €6.00 | 0.38 s | 57 |
| Kimi K2.6 | €1.25 | €5.00 | 0.10 s | 189 |
| Gemma 4 26B A4B It | €0.13 | €0.50 | 0.10 s | 259 |
| Qwen3 Embedding 8B | €0.10 | €0.10 | 0.08 s | 0 |
| Qwen3-Reranker-4B | €0.05 | — | — | — |
| kb-whisper-large | — | — | 0.17 s | 0 |
| gpt-oss-120b | €0.20 | €0.80 | 0.09 s | 306 |
| multilingual-e5-large-instruct | €0.10 | €0.10 | 0.06 s | 0 |
| qwen3.8-27b | €0.75 | €3.00 | 0.11 s | 348 |