the blind spotVibe coding shipped speed and quietly outsourced custody.
Describing software to an AI and watching it appear is intoxicating — until you ask where the work lives. Most AI dev tools are end-to-end SaaS: your prompts, your repository, your generated code, your build all run on the vendor's infrastructure, under the vendor's jurisdiction, mixed with everybody else's. In a side project that's fine. In a company it's a governance hole: nobody relit the code, and now nobody knows where it sits or who can reach it. The faster the generation, the bigger the surface you've handed away without noticing.
- Your prompts describe your roadmap — they are strategy, not chat.
- Generated code is an asset you'll maintain for years, sitting on someone else's disk.
- "It works" tells you nothing about where it runs or who controls it.
the distinction nobody makesResidency is where your data sits. Sovereignty is which law can take it.
Vendors love to say "EU region" — that's residency, and it's not nothing, but it's not sovereignty. Sovereignty is jurisdictional: which legal regime can compel the company holding your data to produce it. A US-headquartered cloud with an EU data center still answers to the US CLOUD Act and FISA 702 — your code can be in Frankfurt and still be reachable by a foreign legal order, because jurisdiction follows the company, not the disk. The honest question for any AI dev stack isn't "where is it stored?" but "who can be served a warrant for it, and under whose law?"
- Residency: physical location of the data (a setting).
- Sovereignty: the legal regime that can compel access to it (a structure).
- An EU region under a US parent gives you the first, not the second.
the honest lineYou won't be sovereign over the models. You can be sovereign over the tools.
Let's not oversell. The frontier models — Claude, GPT and the rest — are American, and pretending otherwise would be a lie. But a model on its own does almost nothing useful; the value comes from everything around it: the orchestration, the rules, the verification, the place your code lives. That orchestration layer is exactly where sovereignty is winnable — and it's a huge part of the whole. Agentation is built by a French team for precisely this: we don't claim sovereignty over the model's weights, we give you sovereignty over the tool that drives them and over the code it produces.
- Models: not sovereign, and we say so plainly.
- Orchestration + custody of code: sovereign, and that's most of what matters.
- "With just a model, you don't do much" — the tooling is where the leverage is.
custody by designYour GitHub, EU hosting, EU data, RGPD — sovereignty as the default path.
Agentation never becomes the home of your code. Agents commit and ship into your own GitHub, on your own AI plan — the source of truth stays where it already lived, with you. The orchestration runs on EU infrastructure (Hetzner, Germany); application data sits in the EU (Supabase); the whole thing is built RGPD-first by a French company. So when you ask "where does my code go and who can be forced to surrender it?", the answer is: it goes to your repository, under your account, and the tooling around it lives under EU law — not as a premium add-on, but as the only path the product offers.
- Code ships to your GitHub — we are not the system of record.
- Orchestration hosted in the EU (Hetzner, Germany); data in the EU (Supabase).
- French company, RGPD by design — sovereignty isn't an enterprise tier, it's the floor.
the method that earns the trustThe Digital Native Method makes sovereign AI development actually safe.
Custody is necessary but not sufficient — code you own but can't trust is still a liability. That's where the method comes in. A Product Owner describes the intent on the live product; a Tech Lead encodes the rules once (architecture, conventions, security, your company's policy); agents implement inside a structure that verifies everything — lint, types, tests, security — before anything reaches production, all through your GitHub. Sovereignty answers "who holds it"; the method answers "is it good." Together they turn vibe coding from an ungoverned risk into software you own, can audit, and can stand behind.
- Product Owner: describes intent on the live product, no spec ritual.
- Tech Lead: encodes the rules once; every agent boots inside them.
- Gates: lint, types, tests, security — green or it doesn't land, in your repo.
FAQWhere does my code go when I build with Agentation?
Into your own GitHub. Agents work in isolated worktrees and commit through your account, on your existing AI plan — your repository stays the single source of truth. Agentation orchestrates the work but is never the home of your code, so custody never transfers to us.
Isn't EU data residency the same as data sovereignty?
No, and the difference is the whole point. Residency is where data physically sits; sovereignty is which legal regime can compel access to it. A US-headquartered vendor with an EU data center still falls under the US CLOUD Act — your code can live in Frankfurt and still be reachable under foreign law. Sovereignty is about jurisdiction, not just location.
Are you really sovereign if the AI models are American?
We're honest about this: the frontier models (Claude, GPT) are American and we don't pretend to be sovereign over them. But a model alone does little — the value is in the orchestration, rules, verification and where your code lives. That layer is winnable, and we're a French company that holds it: EU hosting (Hetzner), EU data (Supabase), code in your GitHub, RGPD by design.
Who can be forced to hand over my code or prompts?
Your code lives in your GitHub under your account, so legal custody is yours. The orchestration data Agentation does hold sits on EU infrastructure under EU law — not under a US parent that the CLOUD Act could compel. We're built RGPD-first precisely so the answer to 'who can be served for it' stays inside the EU.
Does keeping custody mean I lose the speed of vibe coding?
No. You still describe outcomes in plain language and agents deliver fast — the difference is the structure underneath. The Digital Native Method runs deterministic gates (lint, types, tests, security) and ships through your GitHub, so you keep the speed and gain the custody and governance that ungoverned vibe coding throws away.