Full data sovereignty, on-premise.

Above 50 employees, NIS2 is in scope. Above €10M, data sovereignty stops being a slogan.

An Italian SMB between 50 and 249 employees — manufacturing, distribution, services — falls in the direct scope of NIS2 D.Lgs. 138/2024. Of the 18 critical sectors plus their supply chain, almost everyone is in. The compliance bar is real: 43 ACN security measures for essential entities, 37 for important ones, board liability if you don't.

Lemnia T3 (sovereign on-prem) runs on a dedicated GPU appliance inside the company's data centre or server room. The entire stack — model, graph, ingestion, audit log — lives on the company's hardware. No fragment of customer data, supplier data, employee data leaves the LAN at query time. Cloud-burst stays opt-in, per-batch, and the audit log is signed.

What the appliance looks like.

• Hardware target

  x86_64 server with NVIDIA RTX 6000 Ada or equivalent. 256 GB RAM, NVMe SSD. Rack-mount or pedestal — your existing data centre or server room.

• Stack on the box

  Linux SEV-SNP for hardware attestation. vLLM 0.19+ runs Qwen3.6-35B-A3B-FP8 + DFlash drafter (2.5-2.9× speedup). Local SQLite + sqlite-vec for the graph store, RocksDB for blob storage.

• User scaling

  Unlimited seats. Desktop clients pair via mTLS certificate over LAN. The iPhone companion app pairs via QR code on first use.

• Integration surface

  All 19 v0.1.5 connectors plus the OpenAPI generic adapter for in-house systems. AD/Entra ID for SSO. Role-based access control inherited from the source systems.

What the DPO and the auditor get, out of the box.

• Signed processing register

  Every query, every dossier read, every report export is logged with BLAKE3 signature. Exportable as GDPR Art. 30 evidence in one click.

• Per-niche pre-signed DPIA

  Template DPIA already tailored to your sector (manufacturing, distribution, services). The DPO signs and files — no draft from scratch.

• NIS2 D.Lgs. 138/2024 surface

  Access log, patch management cadence, separation of duties, BCP/DR drill artefacts — all surfaced as R10 compliance posture report.

• Sub-processor list

  Lemnia is on-prem: the sub-processor list is empty by design. Cloud-burst (Pro mode) lists the EU-hosted GPU vendor as the only optional sub-processor, with per-batch consent.

Why a €50M company can defend this in court.

Garante Provvedimento 474/2025 (Careggi case, €80,000 fine) and Tribunale di Siracusa 338/2026 (Art. 96 c.p.c. gross negligence) are not theoretical risks for a company at this scale — they are insurable events. The insurance posture requires cite-or-refuse, signed register per query, and query-time local execution. Lemnia is built around these three.

The 2026 Hyper-amortisation regime (L. 199/2025 + DM 4 May 2026) explicitly excludes cloud subscriptions from the benefit. RGS rationale: "I canoni cloud non sono beni ammortizzabili." Lemnia, bought once and running on company hardware, qualifies for the 180 % deduction up to €2.5M.