Customers / anonymous by policy
Regulated teams that can prove where every prompt ran.
Banks, insurers, health platforms and software providers use YTT Secunet to keep AI inference inside the right legal zone and to hand auditors a receipt instead of a vendor letter.
- Descriptors, not names. Customers are described by sector, scale and headquarters.
- No logos. We do not show a customer logo without written permission.
- Roles, not people. Quotes carry a job title only.
- Measured figures. Numbers come from customer telemetry or their receipt ledger.
- 4
- published deployment stories across 4 regulated industries
- 4
- legal zones in production in these stories: EU, UK, CH, GCC
- 2
- of them on Sovereign Dedicated, with signing keys in the customer's own HSM
- < 8 ms
- p99 added gateway latency, policy evaluation plus receipt minting
- YTT Secunet production telemetry, 2026
- Enterprise softwareEU
DAX 40-scale Enterprise Software Provider
How a DAX 40-scale software provider moved its AI copilot onto EU-only inference and closed stalled enterprise deals
Germany / Managed gateway
- 6
- stalled enterprise opportunities with the AI module back in scope within two quarters
- 11 to 3
- business days to answer the AI section of an enterprise security questionnaire
- Private banking and wealth managementCHEUUK
Tier 1 Swiss Private Banking Group
One AI endpoint, three legal regimes: a Swiss private banking group routes Zurich, London and Frankfurt traffic by jurisdiction
Zurich, Switzerland / Sovereign Dedicated
- 3
- legal regimes served from one internal endpoint and one application build
- 0
- internal audit findings on data location for the assistant's first full quarter
- Digital healthEU
French Digital Health Platform
A French digital health platform keeps patient data on HDS-certified infrastructure while adding AI to clinical workflows
Paris, France / Managed gateway
- 0
- prompts with an unmasked NIR served outside the HDS environment in the first 90 days
- 1,412
- requests refused at the boundary by policy during development, each with a logged reason
- InsuranceGCC
GCC Sovereign Insurer
A Saudi insurer launches AI claims summarisation with every prompt processed in-Kingdom
Riyadh, Saudi Arabia / Sovereign Dedicated
- 0
- personal or restricted data requests served outside the Kingdom since launch, per receipts
- 9 weeks
- from cybersecurity approval to production for motor claims
| Customer | EU | UK | CH | GCC | APAC | US | Deployment | Policy |
|---|---|---|---|---|---|---|---|---|
| DAX 40-scale Enterprise Software ProviderGermany | Managed gateway | eu-gdpr-strict | ||||||
| Tier 1 Swiss Private Banking GroupZurich, Switzerland | Sovereign Dedicated | eu-gdpr-strict; uk-gdpr-idta; swiss-fadp-compliant | ||||||
| French Digital Health PlatformParis, France | Managed gateway | Custom Rego | ||||||
| GCC Sovereign InsurerRiyadh, Saudi Arabia | Sovereign Dedicated | saudi-pdpl-sovereign; uae-pdpl-local |
The evidence is the story.
Every deployment on this page started with the same question from a DPO, an internal audit team or a cybersecurity function: how will you show where this AI feature processed personal data? The stories follow that question through the challenge, the architecture the customer chose and the evidence they now produce, in the vocabulary their reviewers used.
We publish results the customer can stand behind. A latency figure comes from the customer's own APM. A count of requests served outside a zone comes from their receipt ledger, which they can verify with the open-source ytt-verify tool without involving us. Where a result depends on things outside YTT Secunet, such as a sales cycle or handling time, the label says it was measured by the customer.
None of these customers outsourced their legal analysis to us. Each ran its own DPIA or transfer assessment; YTT Secunet supplied the technical controls and the records that made those documents shorter.
Why are the customers anonymous?
Our customers are banks, insurers, health platforms and software providers whose own contracts restrict naming suppliers in security-relevant roles. We describe each one by sector, size and headquarters instead, and we never use a customer name or logo without written permission.
Where do the numbers in these stories come from?
Each figure is either measured by the customer, such as APM latency or handling time, or counted from the customer's own receipt ledger, such as requests served outside a zone. The label says which, and YTT Secunet does not round figures in its favour.
Can we speak to a customer in our sector?
Usually, yes. Once you are in a technical evaluation, our customer engineering team can arrange a reference call under NDA with a customer in a comparable regulatory position, subject to that customer's agreement.
Sovereign route ready
Your auditors will ask where the prompt went.
Give them a signed receipt and an inclusion proof they can check without trusting anyone, including us.