GDPR
GDPR-compliant AI, in writing.
An AI tool doesn't make you compliant. A contract does, and knowing where your data goes. Here are ours, each one a page you can read.
Free to start: 300 trial credits once, for every model. No card.
Chat with Work
The short answer
Five things a review asks.
- Contract
- A data processing agreement under Art. 28 for every business customer, part of the Terms.
- Who else
- A public list of sub-processors, with 30 days' notice before a new one.
- Where
- The app in Germany. GPT, Gemini, and Claude in the EU. On every plan, the trial included.
- Training
- No one trains models on your data.
- Changes
- Integrations start at Read. Changes ask first, unless you let them run.
Where it runs
Every piece, and where it is.
What stays in the EU, and the few things that don't, said plainly.
-
The app
On our servers at Hetzner in Germany, with encrypted backups in Finland and France.
-
The models
Gemini on Google Cloud's Vertex AI in the EU, GPT on Azure's EU Data Zone, and Claude on AWS Bedrock's EU profiles. A busy model's stand-in is another of these, still in the EU. That's also how you get Claude in the EU while Claude Duet is US only.
-
Web search
Off by default. Once an admin allows it and you turn it on in a chat, the searches go to Google or Bing, outside the EU.
-
Your own ChatGPT plan
Off until an admin allows it. Then a chat you answer with it goes from your computer to OpenAI, outside the EU and outside our DPA.
-
The tools you connect
Stay where they are. We reach them with each person's own account, and their vendors work under your agreements with them.
-
Slack, Discord, Campfire, Teams
What's posted there is kept by that platform: mostly outside the EU, Teams where your Microsoft 365 keeps its data.
In writing
Three documents, all public.
Read them before you sign up. Your data protection officer will want to.
- DPA
- The data processing agreement: you're the controller, we process for you, a breach reaches you within 48 hours, and you may audit us once a year.
- Sub-processors
- 12 companies, each with what it receives, where, and the safeguard for any transfer. Last changed November 7, 2026.
- Privacy policy
- The legal basis for each purpose and every transfer outside the EU, with its safeguard.
What we keep
What we keep, and for how long.
Not everything is encrypted: account and billing details stay readable so the service can run, and code works on plaintext copies while it runs.
Encrypted by the app
- Your questions
- The answers
- Chat titles
- What it read
- Cached text
- Files
- Integration tokens
Deleted when
- Cached text: 30 days unused
- Chats: you delete them, purged 30 days later
- Bots' conversations: 12 months without a message from outside
- Tokens and cache: you disconnect
Never
- Trained on
- Indexed ahead
- Shown on admin screens
Inside your team
Sharing shares answers, never access.
- Accounts
- Each person connects their own. A tool's results are shown in full only to the person whose account returned them.
- Projects
- Teammates on a project read its chats. Guests read only the chats shown to them, without the links.
- Changes
- Every integration starts at Read. Each change asks first, unless you let it run, and admins can turn changes off for everyone.
- Audits
- CASA Tier 2 for the read-only Drive, Docs, Sheets, and Slides scopes. SOC 2 Type I in progress. Security has the rest.
Or run it yourself
Your servers, your models.
Self-host it, with local models through Ollama or GPUStack, and nothing about your people or their chats reaches us unless you choose.
FAQ
GDPR and AI, answered.
Is Chat with Work GDPR compliant?
No tool is compliant on its own: you are, as the controller, with a processor you can check. We give you what a review needs, in public: a data processing agreement under Art. 28, the list of sub-processors, the app in Germany, every model in the EU, and what we keep and for how long. There's no GDPR certificate to show, and we don't pretend there is.
Do you sign a data processing agreement?
Every business customer gets one as part of the Terms of Service, under Art. 28 GDPR, with no separate signature needed. If you want a signed copy for your records, email support@chatwithwork.com.
Which sub-processors do you use?
12 companies, each with what it does, what data it receives, where, and the safeguard for any transfer, on the sub-processors page. You hear 30 days before a new one starts. The services you connect aren't on it: they work under your own agreements with their vendors.
Does any data leave the EU?
The models don't: GPT, Gemini, and Claude run in the EU. Web search does, when an admin allows it and you turn it on in a chat. So does a chat you answer with your own ChatGPT plan, and what you post in Slack, Discord, or Campfire, which those platforms keep. The privacy policy lists every case.
Do the models train on our data?
No. We don't train models on your data, and our model providers' business terms say they don't either. The one exception is a model you bring yourself: your own ChatGPT plan follows your ChatGPT settings.
How do we delete our data?
Delete chats as you go: a deleted chat disappears at once and is purged 30 days later. Owners can delete the whole organization, and we delete its data within 30 days. Encrypted backups keep deleted data until they expire, at most two years.
AI bots in Europe, in writing.
Start with one bot and one tool. For a business, the DPA applies from the first chat.
Free to start: 300 trial credits once, for every model. No card.