Loading the catalogue…
Nebius Token Factory
L2 · European operationnebiusNetherlandsEurope
Nebius B.V. (Netherlands), part of Nasdaq-listed Nebius Group N.V., runs managed inference for open-weight models with fine-tuning and dedicated endpoints. Serverless regions are selectable and include Finland and France; dedicated endpoints have a fixed contractual region and no failover.
Compliance posture · Stav's assessment
Jurisdiction
EEA · Netherlands
Data residency
EU
CLOUD Act / FISA 702
Not exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Adequate
Legal exposure
Adequate
Serving retention
Adequate
Security posture
Weak
Contractual posture
Adequate
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 3 risk items · 7 safeguards · 1 privacy-policy issue · DPA, sub-processor list, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 17 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L2European operationIndicativeregistry 4.1
This level applies to traffic routed through Stav.
Nebius is at L2. L3 is blocked because the Volozh family trust, not an EU/EEA holder, has about 52% of voting power.
2 criteria from L3: Union-owned, Union-controlled.
Stav's own assessment against criterion registry 4.1. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 17 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
ISO/IEC 27001:2022
ISO/IEC 27001:2022 for Nebius B.V., company-wide; Nebius states Token Factory is in scope. · substantial assurance · Current · verified 17 Oct 2026
ISO/IEC 27701
Privacy information management (privacy extension to ISO/IEC 27001) · Claimed by the provider
SOC 2 Type II
AICPA Trust Services Criteria; Nebius states the report covers HIPAA. Report available via Trust Center under NDA. · Claimed by the provider
EU-U.S. Data Privacy Framework (DPF)
Nebius Inc. and ADC Tech Inc. (U.S. subsidiaries) certified to the U.S. Department of Commerce for EU-U.S. DPF Principles; FTC jurisdiction · Claimed by the provider
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listpublished
Links to every document and certificate — 4 legal documents, 4 certification sources
Compiled by Stav from the provider's published documentation. Last verified 17 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 4
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| Kimi K3 | €2.69 | €13.46 | 0.58 s | 422 |
| GLM-5.1 | €1.26 | €3.95 | 0.16 s | 46 |
| Qwen3 Embedding 8B | €0.01 | Free | 0.18 s | 0 |
| gpt-oss-120b | €0.13 | €0.54 | 0.15 s | 431 |