GDPR-compliant AI: what actually matters.

<p id="lawful">Before talking hosting, sub-processors and DPA, you need to know <strong>why</strong> you can process personal data. GDPR has six lawful bases (Art. 6(1)):</p><ul><li><strong>Contract</strong> — e.g. order-status request by the buyer.</li><li><strong>Legitimate interest</strong> — e.g. internal process optimization with pseudonymized data.</li><li><strong>Consent</strong> — explicit, documented, revocable any time.</li></ul><p>Plus <strong>purpose limitation</strong>: data may only be used for the original purpose. A support bot using order data may not repurpose it for marketing profiling.</p>

<p id="subprocessors">A sub-processor is any third party processing data on your behalf — e.g. Anthropic for LLM inference, AWS for hosting, Mistral as alternative. GDPR requires you to know <em>who</em>'s in the chain.</p><p>Our setup:</p><ul><li>Full list of every sub-processor in the DPA (see below).</li><li>Each sub-processor has its own DPA with us — chain is transparent.</li><li>Changes need your consent (or at least prior veto right with a clear timeline).</li></ul>

<p id="training">This is the question we get most — and the answer decides whether a vendor is even an option.</p><p><strong>For us: no, never.</strong> Neither your knowledge-base content nor your customers' conversations are used for training. This is fixed in the DPA and ensured by our sub-processor choices:</p><ul><li><strong>AWS Bedrock</strong>: guarantees no model training on customer content.</li><li><strong>Anthropic API</strong> (Enterprise tier): explicit training opt-out, contractually secured.</li><li><strong>OpenAI API</strong>: standard API doesn't train on customer data (unlike ChatGPT-web!).</li></ul><p>If a vendor won't commit to that in writing — walk away.</p>

<p id="checklist">Before picking an AI vendor, walk this list:</p><ol><li>Is the server location in the EU? If yes: guaranteed without US replication?</li><li>Is there a written DPA with all sub-processors listed?</li><li>Is training on your data explicitly excluded?</li><li>How long are conversations stored? Can you configure it?</li><li>Are there audit logs, and who has access?</li><li>Which encryption in transit and at rest?</li><li>Is there a breach response plan?</li><li>Can the bot be fully uninstalled — including all data — on demand?</li></ol><p>If a vendor won't answer one of these clearly — go elsewhere. Including past us. That clarity is non-negotiable.</p>