What changed at Noxtua on September 23, 2026
On September 23, 2026, Noxtua announced that it had closed a Series C round totaling more than EUR 100 million, with German legal publisher C.H.BECK becoming its new majority shareholder and Austrian publisher MANZ joining as an investor. The same release says investors Global Brain Corporation, KDDI Open Innovation Fund, CMS, Dentons and Dominik Schiener are "making room", and that CMS and Dentons will remain close collaborators and anchor clients. Its headline puts the figure on C.H.BECK ("invests 100M+ EURO"), while the body describes the round as totaling more than EUR 100 million; the release does not break it down further, so we don't either (Noxtua's press release). For a buyer this is an ownership question: the company behind Noxtua is now controlled by a legal publisher rather than by venture investors and law firms.
The comparison
| Noxtua | Harvey | Legora | |
|---|---|---|---|
| Where it says data is hosted | Sovereign European cloud: IONOS and Deutsche Telekom's T Cloud Public (Germany), and T Cloud Public in Switzerland | Microsoft Azure, with processing in the EU and Switzerland, the US or Australia on request, including subprocessors | "Flexible storage options" in tiers; the page we read names no regions |
| Self-hosting | Says it is the only Legal AI that offers self-hosting exclusively on sovereign European-controlled cloud, using open-source models | Not described on the page we read | Not described on the page we read |
| Model training on your data | Says inputs and outputs are not used to train its AI | Says it contractually does not train on inputs, outputs or uploaded documents | Says it will not use your data to train or fine tune any AI models |
| Certifications listed | BSI C5, ISO 27001, ISO 42001 (company boilerplate); the security page points to a Trust Center for the full list | SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001 | SOC 2 Type II, ISO 27001, ISO 42001 |
| Professional secrecy | Says it meets Section 203 of the German Criminal Code and Section 43e of the Federal Code for Lawyers (BRAO) | Not described on the page we read | Not described on the page we read |
| Content layer | Curated legal data from European publishers, with jurisdiction workspaces such as Beck-Noxtua (Germany) and MANZ-Noxtua (Austria) | Not described on the page we read | Not described on the page we read |
| Published pricing | None found | None found | None found |
Sources: Noxtua security page, Noxtua's Series C release, Harvey security page and Legora security page.
Who each is for
Noxtua is aimed at lawyers whose rules or clients require European infrastructure and a European legal source layer: its workspaces are organised by jurisdiction (Germany, Austria, Switzerland, Poland, Czech Republic, Slovakia, Bulgaria and Sweden), each tied to a local publisher. The cost of that focus is reach: if your matters are mostly outside those jurisdictions, the content advantage shrinks. Its own numbers (more than 30,000 users, around 100 employees) come from its press release.
Harvey is the global platform. Its security page says you can keep data in the EU or Switzerland, the US or Australia, and that it runs on Microsoft Azure. That answers where the data sits, but a US-headquartered vendor on a US hyperscaler is a different sovereignty position from a European-controlled cloud. Whether that matters is a question for your regulator and your clients, not for us. See our Harvey security and data privacy page and Harvey profile.
Legora says its technical team is based in Sweden and that it operates under GDPR, with EU-based and US-based support staff. The page names tiered storage but no regions, so ask directly which region holds your documents and which subprocessors touch them. See our Legora profile and the head-to-head Harvey vs Legora.
Sovereignty is not one question
"Where is the server" is only the first of four things to ask: where data is stored, where it is processed (including the AI model call), who operates and can be compelled to disclose it, and who owns the vendor. Noxtua's page speaks to the first three with named European providers. Harvey's speaks to the first two with regions. Legora's speaks to support location and storage tiers. None of the three pages answers the fourth for you, and ownership has just changed for Noxtua (see above). For the wider European vendor picture, read our guide on European legal AI vendor consolidation and our note on whether AI is safe for confidential legal work.
Pricing, as shown on October 22, 2026
None of the three publishes a price. Noxtua's site sends visitors to "Request Access". Harvey and Legora direct visitors to book a demo. Get written quotes, and ask what the sovereign or in-region option costs compared with the default.
Questions to ask each vendor
- A written price, including what the sovereign or in-region option adds.
- Noxtua's full certification list, beyond the three named in its press release.
- Evidence for Noxtua's claim to be the only legal AI with exclusive European self-hosting, and for its user count.
- Which regions Legora offers, and whether Harvey's EU option covers every feature and model.
- Where AI model calls are processed in the default setup.
- For Noxtua: how the Series C splits between C.H.BECK and other investors.
- Answer quality and legal accuracy on your own matters, in a pilot.
How to test it in a week
- Write down your data constraints: client confidentiality terms, regulator, and any rule that fixes where data may be processed.
- Ask each vendor in writing for hosting region, processing region for model calls, subprocessors, and who can be compelled to disclose data.
- Ask for the certificates themselves (not the badges) and their dates.
- Run the same five non-sensitive documents through each and compare citations to sources in your jurisdiction.
- Ask each about exit: export format, deletion timing and what happens if ownership changes.
Sources
- Noxtua press release: C.H.BECK invests in Noxtua, Sept. 23, 2026 (read in full October 22, 2026) (Company press release; Series C, ownership, user count, certifications boilerplate)
- Noxtua security page (read October 22, 2026) (Vendor claims; European cloud providers, self-hosting, no training, secrecy rules)
- Noxtua FAQ (read October 22, 2026) (Vendor claims; positioning as sovereign Legal AI)
- Harvey security page (read October 22, 2026) (Vendor claims; Azure hosting, EU or Switzerland, US, Australia, certifications, no training)
- Legora security page (read October 22, 2026) (Vendor claims; GDPR, Sweden team, tiered storage, certifications, no training)
- Legora website (read October 22, 2026) (Vendor claims; calls to action are Book a demo, no pricing page)
Questions and answers
Is Noxtua more sovereign than Harvey or Legora?
Noxtua says it runs on European cloud providers (IONOS and Deutsche Telekom) and offers self-hosting on European-controlled infrastructure. Harvey says it runs on Microsoft Azure with EU, Swiss, US or Australian regions. Whether that is more sovereign depends on who must not be able to access the data; we haven't tested any of them.
Who owns Noxtua?
According to Noxtua's September 23, 2026 press release, C.H.BECK, Germany's legal publisher, became its majority shareholder in a Series C round, and Austria's MANZ joined as an investor. The release says CMS and Dentons remain collaborators and anchor clients.
Does Harvey keep data in the EU?
Harvey's security page says customers can keep data in-region, naming the EU or Switzerland, the US and Australia, and its FAQ says the EU and Switzerland option applies to subprocessors as well. Harvey hosts in Microsoft Azure. Ask which features are covered in your region.
Does Legora offer EU data residency?
Legora's security page says its technical team is based in Sweden, that it operates under GDPR, and that it offers tiered storage options, but the page we read names no regions. Ask Legora in writing where your documents are stored.
How much do Noxtua, Harvey and Legora cost?
None of the three publishes a price that we could find. Noxtua asks visitors to request access, and Harvey and Legora direct them to book a demo, so a written quote is the only way to compare.
Operational information, not legal advice. Descriptions are each company's own statements, read October 22, 2026; we did not test any product. Prices and availability change; check the vendor before you decide.