Spain’s Sherpa.ai raises $18M for AI that never touches your data

Basque startup Sherpa.ai raised $18m to build AI that does not expose customers’ raw data to a foreign cloud. The Spanish company sells its privacy-preserving AI to regulated sectors including banks, hospitals, and governments. While operational details are limited in the report, the funding signals investor confidence in on-device or data-isolated AI approaches.

Analysis

This is less a startup-funding story than a signal that enterprise AI procurement is shifting from raw model access to data-control architecture. The immediate equity impact is probably small, but the spend pool is real: regulated buyers will pay for inference that preserves locality, auditability, and access control, which favors hybrid/on-prem vendors and security stacks over pure public-cloud AI consumption.

Second-order, the likely winners are IBM, DELL, HPE, PANW, CRWD, and ZS, because privacy-preserving AI raises the value of the control plane around data rather than the model itself. The losers are the parts of MSFT, AMZN, and GOOGL exposure that depend on frictionless cloud migration in banks, hospitals, and government; if this thesis broadens, cloud AI attach rates in regulated verticals can compress over 6-18 months as buyers demand sovereign or confined deployments.

The contrarian view is that privacy is a feature, not a moat, and most enterprises will still choose the cheapest workable model if productivity gains are large enough. That makes this a slower adoption curve than the AI hype cycle suggests. The key falsifier is procurement behavior: if RFPs start explicitly mandating local-only inference or confidential-computing standards, the theme becomes investable; if not, the opportunity stays mostly niche and vendor-specific.

Key Decisions for Investors

• Accumulate IBM on pullbacks for a 3-6 month trade versus XLK: it has the cleanest mix of hybrid cloud, services, and regulated-client credibility. Risk/reward is decent if enterprise AI budgets keep shifting toward controlled deployments; exit if next-quarter software bookings or AI commentary disappoint.
• Initiate a tactical long DELL / short SMCI pair for 1-3 months. The thesis is that privacy-heavy AI deployments favor integrated, serviceable infrastructure over the most momentum-driven rack vendor. Falsify this if GPU supply scarcity again rewards fastest-delivery hardware names.
• Add to PANW or CRWD on weakness for a 6-12 month horizon as AI privacy concerns expand security budgets around identity, data access, and audit trails. This is a second-order beneficiary trade; cut it if buyers start bundling these features into cloud subscriptions without incremental spend.
• Do not short MSFT, AMZN, or GOOGL yet; instead set a watchlist and wait for evidence of sovereign-AI mix shift in regulated verticals. A durable short only works if cloud AI margins or attach rates show visible pressure over the next 1-2 quarters.