GDPR-compliant AI for SMEs: where your data is.
If I build AI for you, you’ll want to know where your data ends up. This page lists every supplier with the region its servers run in, and what does and does not go to the AI model. Whoever looks after your IT can check it line by line.
Checked on 28 September 2026✦If the setup changes, I update this page before the change takes effect
Secure and European in short
Diginesso is the sole proprietorship of Wesley Beerendonk, who builds AI agents and automation for small and mid-sized businesses in the Netherlands, Germany and Italy. In a standard project your database and the application are hosted in Frankfurt, and emails the system sends go out from Ireland. You choose the AI model. With a European model your data stays in Europe. You sign the GDPR data processing agreement (DPA) before I touch a single record. I’m not a lawyer: this page describes how I set things up technically.
What data goes to the AI model?
Only the piece of text the model has to read for one task. For an invoice that is the invoice, for an email that one email. Your database, your files and the rest of your records stay where they are.
Stays where it is
- Your database and your files. They are hosted in Frankfurt and are not copied to an AI service.
- Your passwords and keys. They sit in a locked-down vault. They are never in the code and never in a chat.
- The rest of your records. An agent that handles invoices gets to see invoices. The rest of your system stays closed to it.
- What your people type into a screen I build. That stays in your own environment.
Goes to the model
- Only what that one task needs. Your customer database doesn’t come along.
- To a provider we agree on in advance. I name it in your data processing agreement.
- Through a business account. Its terms say your text is not used to train the model. If a provider won’t agree to that, I don’t use it.
- Or nothing goes out at all. Then the model runs on your own server. That works, though it is slower and costs more.
For each process I write down which text goes to the model, how long it stays there and who can request it.
Which suppliers see your data, and where are their servers?
This is the complete list for a standard project. Before I add another supplier to your setup, I tell you, and that supplier goes into your data processing agreement. The region codes are included so you can look them up yourself.
eu-central-1fra1eu-west-1The name of the model provider and the country of processing go into your contract. If the model has to change later, for example because a provider withdraws a version, I tell you at least 30 days in advance, along with what it means for quality and cost. If there is an outage, or a provider stops overnight, I switch first and let you know as soon as possible afterwards.
Supabase, Vercel and Resend are American companies with servers in Europe. How to do without American suppliers is explained below. What this website itself processes about visitors is in the privacy policy.
How strict do you want it
Can it be fully European, or on your own server?
Yes. Stricter usually means more expensive or slower, which is why the choice is yours. All three setups work, and you can switch later.
European servers
- Where it runs
- With the suppliers in the list, in Frankfurt and Ireland.
- The AI model
- A European model, or a large American model through a business account, with processing in Europe where that is offered. The American route only with your consent.
- The downside
- Three suppliers have an American parent company.
The companies too
- Where it runs
- For every component I find a European company, with no American parent anywhere in the chain.
- The AI model
- A provider from France or Germany, for example, processing within the EU. For reading, summarising and sorting that is more than good enough.
- The downside
- More setup work, and a few handy services drop out. For the heaviest reasoning work such a model still lags slightly behind the leading ones.
On a server you choose
- Where it runs
- In your own server room, or with a host you pick. I build a system on your own server as custom software.
- The AI model
- Runs on that same machine, so the text for the model stays on that server too.
- The downside
- You pay for the machine and its upkeep, and such a model is slower than the best online models.
Not sure? In the AI Process Audit I work out the difference in euro per month, and which risk the more expensive option takes off your hands.
The EU AI Act
When do the EU AI Act rules apply? These are the dates after the Digital Omnibus.
The AI Act has been in force since 1 August 2024 and applies in stages. The Digital Omnibus, Regulation (EU) 2026/1744, has applied since 27 July 2026 and pushed back the heavy requirements for high-risk systems.
What this means for SMEs
An agent that processes invoices or answers customer questions is usually not high-risk. High-risk covers uses such as recruitment or credit scoring. One rule does apply: a customer who talks to an agent must be able to see that it is an AI.
What I always do
For each system I write down what it does and who is responsible for it, so you have a file before anyone asks for one. Where a decision affects money or people, a person signs off, and every action the system takes goes into a log. If one of your customers talks to an agent, the screen tells them it is an AI.
Source: Regulation (EU) 2024/1689 on EUR-Lex and the Digital Omnibus, Regulation (EU) 2026/1744. Checked on 28 September 2026.
I’m not a lawyer. Ask one how the law applies to your system.
- since 2 February 2025
Prohibited practices
A few uses are banned, such as scoring people on their social behaviour. You also had to make sure your staff understand enough about AI. The Omnibus softened that: you take measures to build that knowledge, without having to guarantee a set level.
- since 2 August 2025
Rules for the model makers
The companies behind the large AI models have to describe how their model works and what it was trained on. That information helps with your own file.
- since 2 August 2026
Telling people it is an AI
Anyone talking to an AI system must be able to know it. For an agent in your customer service, this is the rule that matters most.
- from 2 December 2027
High-risk, Annex III
Heavy requirements for systems in areas such as recruitment or credit scoring. Before the Omnibus this date was 2 August 2026.
- from 2 August 2028
AI in certified products, Annex I
AI in products that already go through their own EU conformity assessment, such as medical devices, comes last.
How do you handle GDPR when using AI?
You are the controller, because it is your data and you decide what it is used for. Diginesso is the processor, and the suppliers in the list are sub-processors (suppliers I bring in). Below is how I handle the GDPR in a project, and you can check all of it. Is your company based outside the EU? Then the GDPR may also require you to appoint an EU representative under Article 27, a legal role I don’t take on.
The DPA comes first
You sign it before I touch a single record, with the suppliers from the list named in it. If your company has its own data processing agreement, I sign that too, as long as it contains nothing I can’t deliver.
As little data as possible
I only fetch what the process needs. Every agent and every integration gets the narrowest access that still gets the work done.
How a single-task AI agent worksRetention periods you set
By default processed documents are kept for 90 days, so you can check what happened. Want 7 days, or as many years as your legal retention period requires? I set that up too.
All access is logged
Apart from the systems that do the work, only I have access to the live system, with two-factor authentication. There is no team behind me with access. Every time a person or a process gets access, it is recorded.
How I monitor a live systemAccess and erasure requests
Wherever a system holds personal data, I build in a way to find and delete it from the start. You can then handle a request from one of your customers yourself.
If something does go wrong
If there is a data breach, I tell you within 24 hours what happened and which data it affects. You report it to your supervisory authority, and I supply what you need for that.
What happens to your data if we part ways?
That is fixed in advance in the terms. You don’t need my permission for anything, and I don’t hold back the export over an unpaid invoice either. Your data is not collateral.
What the terms say about ending- The accounts
- Already in your nameYou remove my admin rights and everything keeps running.
- The export
- Within ten working daysThe tables as CSV (opens in Excel) and the database as an SQL dump (for a developer). The code, the workflows and the prompts in a git repository or in the system’s own export format. The documentation as PDF and as plain text.
- Deletion
- Within 30 days on my sideThe automatic backups then expire on their own, after 90 days at the latest.
- Confirmation
- In writing, with the dateThe export and the deletion cost you nothing.
You can also ask at any time which data I hold of yours and where it is. You get that list within five working days.
Who builds it
I can’t pass you on to a security department.
You have this page and my email address. I build the system and I also run it, so if something goes wrong, I deal with it myself.
Does something here look wrong to you? Tell me at info@diginesso.com and I’ll either correct it or explain why it stands.
More about Wesley and DiginessoWhat I don’t have
There are a few things I don’t have yet. I’d rather list them here than have you find out later.
- ISO 27001 or SOC 2Those certifications cost a sole proprietorship a lot of money and time. If you really need one, I tell you up front how long it takes and what it costs.
- Legal adviceI’m not a lawyer. I know how to set this up technically and what the law requires of such a system. Whether your own situation holds up is a question for someone who is qualified to give legal advice.
- A guarantee of complete securityI can’t promise complete security. What I do is write down where your data is and who can reach it, so you can weigh the risk yourself.
Questions
Frequently asked questions about AI and the GDPR
Can AI be GDPR-compliant?
Yes, provided it is settled which data goes to the AI model and where that data is stored. In what I build, the model only reads what it needs for one task, and the region each supplier works in is fixed. Whether your processing as a whole complies also depends on what you do with the data yourself.
Does my data stay in the EU?
Yes, if you choose a European AI model. In the standard setup your database, your files and the application are hosted in Frankfurt, and system emails go out from Ireland. If you pick a model from outside Europe, only the text sent to that model can leave the EU. Supabase, Vercel and Resend are American companies with servers in Europe.
Is my data used to train AI models?
No. I only use business accounts whose terms say input is not used for training, and I don’t use a provider that won’t put that in writing.
Do I get a data processing agreement?
Yes, and you sign it before I touch a single record. I work from a standard text that names every sub-processor (supplier I bring in). If your company uses its own data processing agreement, send it over and I’ll sign that too. If it contains something I can’t deliver in practice, I tell you beforehand.
What if something has to be processed outside the EU?
Then I ask you first and explain why it is needed. If you say no, I find another route or leave that feature out.
What about the US CLOUD Act?
It is a disputed risk: three of my suppliers are American companies with servers in Europe, and lawyers disagree on whether a US authority can demand data held there. If you don’t want that risk, choose the setup with European companies only or your own server.
Does my AI system count as high-risk under the EU AI Act?
Usually not. High-risk covers the uses listed in Annex III of the AI Act, such as recruitment or credit scoring. An agent that processes invoices or answers customer questions normally falls outside that, though a customer must be able to see they are talking to an AI. Because of the Digital Omnibus, the heavy requirements only apply from 2 December 2027.
Can I have my own pentest or audit done?
Yes. You bring in a tester of your choice, and I provide the access and the documentation and set up a test environment. The reports go straight to you. I fix whatever comes out of it. Under maintenance that is included in the monthly fee, and the log shows when it was done.
Want your IT person to check this?
Feel free to forward this page. Do you have a question about the setup yourself, or want to know which work in your company can be automated? You get a personal reply from me within one working day.