Security, compliance and data sovereignty at IONext

IONext is sovereign AI infrastructure operated by PT Data Awan Nusantara, an Indonesian legal entity based in Jakarta. The IONext information security management system is certified to ISO/IEC 27001:2022 by TÜV NORD Indonesia (Registration No. 01 07 E 26000410, valid until 6 May 2029). GPU compute, inference and customer data storage run on infrastructure located in Jakarta, Indonesia.

Key facts

Item	Detail
Legal entity	PT Data Awan Nusantara
Registered address	Treasury Tower Lantai 2, Kawasan District 8 Lot 28, Jl. Tulodong Atas 2 No. 28, Senayan, Kebayoran Baru, Jakarta Selatan 12190, Indonesia
Certification	ISO/IEC 27001:2022 (SNI ISO/IEC 27001:2022)
Certification body	TÜV NORD Indonesia
Certificate registration no.	01 07 E 26000410
Validity	7 May 2026 to 6 May 2029
Data processing and storage location	Jakarta, Indonesia
Billing currency	Indonesian Rupiah (IDR)
Regulatory framework	Law No. 27 of 2022 on Personal Data Protection (UU PDP)

Is IONext ISO/IEC 27001 certified?

Yes. PT Data Awan Nusantara, the operator of IONext, holds an ISO/IEC 27001:2022 certificate issued by TÜV NORD Indonesia on 7 May 2026, registration number 01 07 E 26000410, valid until 6 May 2029. The certificate confirms that the IONext information security management system meets the requirements of the standard.

The certified scope, as written on the certificate: "Information Security Management System Covering the Provision of Artificial Intelligence (AI) Platform services, and AI-based Cloud Infrastructure Resources such as GPU, Storage, and Networking", per the Statement of Applicability Version 2.0 dated 2 March 2026.

This means the services customers actually use (the AI platform, GPUs, storage and networking) are inside the certified scope, not only offices or support functions. The certificate is re-assessed through surveillance audits during its validity. Copies are available to download on this page in English and Bahasa Indonesia and can be verified with TÜV NORD Indonesia using the registration number above.

Where is customer data processed and stored?

IONext processes and stores customer data on infrastructure located in Jakarta, Indonesia. This covers GPUs for inference and training, virtual machines, Kubernetes, S3-compatible object storage and block storage. The open-weight models IONext serves (for example Qwen, Gemma and DeepSeek) run on IONext's own hardware in Jakarta, so inference requests are not forwarded to API providers abroad.

For Indonesian companies, physical location matters because it decides which law governs the data. Data stored by an Indonesian legal entity inside Indonesia falls under Indonesian jurisdiction.

How does IONext support UU PDP compliance?

Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP) has applied in full since its two-year transition period ended on 17 October 2024. Under UU PDP, the customer who decides why data is processed acts as the Personal Data Controller, while IONext as the infrastructure provider acts as the Personal Data Processor, processing data on the customer's instructions.

IONext supports customers' obligations in three ways:

1. No cross-border transfer by default. Article 56 of UU PDP requires a Controller to ensure an equal or higher level of protection before transferring personal data outside Indonesian jurisdiction. Because IONext processes and stores data in Jakarta, customers do not need a cross-border transfer assessment for workloads running on IONext.
2. Certified security controls. The IONext information security management system is audited against ISO/IEC 27001:2022, which supports a Controller's duty to apply appropriate technical and organisational measures.
3. Audit trail. The platform provides an audit trail so access and resource changes can be traced.

UU PDP compliance remains a shared responsibility. Customers remain responsible for the legal basis of processing, data subject consent and data governance inside their own applications.

For public-scope Electronic System Operators, Government Regulation No. 71 of 2019 requires electronic systems and data to be managed, processed and stored in Indonesia, with limited exceptions. IONext's Jakarta infrastructure meets that location requirement.

What security controls does the IONext platform provide?

As of September 2026, the IONext platform provides the following controls:

Layer	Controls
Network	Virtual Private Cloud (VPC), managed load balancer, private cloud
Application protection	Web Application Firewall (WAF), anti-DDoS protection
Data	Backup Protect and Backup Protect DR (disaster recovery)
Governance	Audit trail; public or private status of every resource visible from the ORBIT topology view
Operations	IONA flags resources that are exposed when they should not be, such as a database reachable over a public IP

Who is the legal entity behind IONext?

IONext is operated by PT Data Awan Nusantara, a limited liability company established and domiciled in Indonesia, registered at Treasury Tower Lantai 2, Kawasan District 8, Jl. Tulodong Atas 2 No. 28, Jakarta Selatan. Contracts, billing and legal responsibility for the service sit with this Indonesian entity. Company profile and leadership are on the About IONext page.

How do billing and procurement documents work?

IONext bills in Indonesian Rupiah (IDR) through an Indonesian legal entity, so costs do not move with the US dollar exchange rate. Invoices include VAT (PPN) under Indonesian tax rules. For procurement, IONext can provide a copy of the ISO/IEC 27001:2022 certificate and company documents on request through the contact page. System integrators answering these compliance questions in a client tender can use the IONext Partner Program for system integrators.

Frequently asked questions

Does my data ever leave Indonesia? Not for services running on IONext. GPUs, inference and storage are in Jakarta. Open-weight models run on IONext hardware and are not forwarded to overseas APIs.

How can I verify the IONext ISO certificate? Use registration number 01 07 E 26000410 to verify with TÜV NORD Indonesia. The certificate is valid from 7 May 2026 to 6 May 2029.

Does using IONext automatically make me UU PDP compliant? No infrastructure provider can guarantee that. IONext provides data location in Indonesia, ISO/IEC 27001:2022 certified security controls and an audit trail. Full compliance also depends on how the customer handles data in its own applications.