EU hosting by default. DPA ready for signature. No data export to the US. Encryption at rest and in transit. Audit logs per query.
OpenAI processes data in the US. Under Schrems II and the EU-US Data Privacy Framework, that's legally complex for client data.
Procurement, legal and CISOs want a DPA, sub-processor list, data flow diagram. Generic chatbots don't deliver.
Right to be forgotten, access, rectification — how does that work in a vector database? Not obvious.
Documents, embeddings and logs stay in EU jurisdiction. Model calls via EU endpoints where possible; otherwise only anonymised context.
GDPR Art. 28 DPA ready. Public sub-processor list. Changes notified 30 days in advance.
Deletion request? We remove the document, recompute the collection embeddings, log the request. Audit trail preserved.
EU providers in EU jurisdiction. No US cloud in the chain for storage and compute.
AES-256 at rest, TLS 1.3 in transit. RBAC at knowledge base level, audit logging per action.
On upload, personal data is auto-detected. Mask, reject or explicitly allow — your choice per knowledge base.