31 Dec 2026

Varonis is pulling the plug on on-prem. ProLion isn’t.

Learn how to keep your data →
Data sovereignty
Industries
Healthcare

Your data never leaves your building.

ProLion runs inside your estate. File names, contents and metadata are processed on your own hardware — there is no ProLion tenant that holds them, which is also why dark sites work at all.

NetApp

Syslog CEF and REST, into the tool you already run

A SaaS data security platform

Your data goes to them.

Content or metadata is sent to a vendor tenant for analysis
Residency is a region setting, not a guarantee of jurisdiction
A dark site or an air-gapped network cannot be covered at all
Your DPIA has to account for a cross-border transfer
Outage at the vendor means no detection at your site

ProLion

Your data stays where it already is.

Analysis and classification run on your own hardware
Austrian company, EU jurisdiction, no US parent
Dark sites with no outbound connection are a supported case
No processor to list for this data, because there is none
Detection keeps working when the internet does not
Why it is being asked now

Sovereignty stopped being a procurement footnote.

Regulated sectors first

Hospitals, utilities, public administration and defense suppliers increasingly have to state where data is processed and under whose law — not merely where it is stored.

AI widened the question

Once an agent reads your file shares, “where does this data go” includes every answer it produces from them.

Availability is part of it

Sovereignty that disappears during a vendor outage was never sovereignty. On-premises detection has no such dependency.

Let’s solve your data challenges.

Connect with our engineers to find the right approach for your infrastructure.

It stopped being a procurement footnote.

The question is no longer where the data center stands. It is whose law reaches the people who run it — and whether anyone can promise you an answer.

73 %
of large German enterprises call the US CLOUD Act a major risk.
61 %
of Western European CIOs intend to lean more on local or regional providers.
~70 %
of the European cloud infrastructure market sits with three US providers.

Industry figures, not ProLion measurements. Sources: techconsult for valantic, March 2026, 212 decision-makers at German enterprises with 1,000+ staff; Gartner survey of 241 Western European CIOs; market share from 2025 industry reporting.

What sovereignty has to mean in practice.

A region label is not sovereignty. These are the questions that decide it, and the only answers that survive an audit.

Where it is analyzed
On your own hardware, not in a vendor tenant
Classification reads file contents — if it runs elsewhere, the contents went elsewhere
Who can be compelled
Nobody, if nothing left
A provider cannot hand over what it never received
What happens offline
Everything
Detection, classification and reporting keep working at a site with no outbound connection
What you can show
The record, on your own hardware
Retention you set, not a retention policy you were given
Fully on-premises
One appliance on your own hardware. Classification, detection and reporting all run on it.
Dark sites included
No outbound connection required, at any point, for any function.
Content stays put
Pattern matching, entity recognition and the machine-learning models run locally. No file is sent out to be read.
Retention is yours
The activity history lives as long as your records do, not as long as a license tier allows.
Evidence without export
What an auditor needs is produced from your own system, not requested from a vendor.
Austrian company, since 2013
Developed and supported in Europe, with 24/7 support from people who know your data.

Talk to an engineer who knows your data.

Four fields, and somebody who knows ONTAP, PowerScale and what FPolicy does. Not a qualification call.

Four fields. No hidden newsletter.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.