GDPR-compliant AI: 7 questions to ask your vendor

I’m Denis Shokhirev, an agentic AI systems architect shipping production systems from Freiburg, Germany, on a stack of Claude, Supabase, n8n, Doppler, and self-hosted Postgres. In regulated European markets, a single GDPR misstep isn’t a “bug”—it’s a five-figure fine, potential project shutdown, and weeks of legal back-and-forth. Here’s the seven-point vendor check I run before letting any AI service touch client data in production.

1. Where is your data physically stored?

In 2024, 73% of cloud-based AI solutions for DACH process data outside the EU, even when their websites promise “European hosting” (Cloud Security Alliance, 2024). Don’t rely on marketing. Ask for the exact data center location, not just the provider’s name, and clarify who can access the underlying hardware.

Quick verification pattern

# Find the server’s geolocation by IP
host live.gerdennisai.com
geoiplookup <IP-ADDRESS>

If the vendor uses AWS, Azure, or GCP, require a contract that specifies the cloud region (e.g., “eu-central-1” for AWS Frankfurt).

2. How does data flow through the processing chain?

In real B2B setups, client data often moves through 3–4 services (n8n, Claude, Supabase, Postgres). If even one link lacks logging or encryption, you have a blind spot for audits and breach investigations. Demand a full, step-by-step data flow—ideally as a diagram or YAML—showing every handoff and log point.

Example minimal data pipeline

steps:
  - Receive client request
  - Route via n8n
  - Call Claude API
  - Write results to Supabase/Postgres
  - Log the action

This isn’t bureaucracy; it’s your audit trail when regulators come knocking.

3. Are personal details ever sent into an LLM?

Many assume using an LLM “via API” keeps data private. In practice, every prompt—including names, emails, invoice numbers—may be stored on the model server. For example, OpenAI’s data retention policy (as of 2023, OpenAI Data Usage Policies) states prompts are held up to 30 days for abuse monitoring. Any personal detail you send is a risk vector.

Mitigation checklist

Mask or redact personal data before sending to the LLM
Use self-hosted LLMs for full control
Request a written data cleansing policy from your vendor

4. Can user data actually be deleted on demand?

GDPR mandates the “right to be forgotten.” If the AI vendor can’t delete a user’s data—across live DB and backups—it’s a direct violation. In my experience, 80% of no-/low-code AI SaaS tools can’t physically delete user rows from backups or logs.

Postgres deletion pattern

DELETE FROM users WHERE id = 'user-123';
-- Check deletion
SELECT * FROM users WHERE id = 'user-123'; -- should return 0 rows

Demand a written data deletion process and clarify how long data lingers in logs or backups (“retention period”).

5. Who is liable for data breaches or outages?

GDPR fines for personal data breaches run up to €20 million or 4% of annual revenue (GDPR, source). If your vendor doesn’t provide a clear incident response SLA, you—the product operator—bear the full legal risk. Push for a contract that spells out who owns each risk and incident response duty.

Risk	Vendor Responsible	You Responsible
API outage	Yes	No
Unencrypted data transfer	No	Yes
User data deletion on request	Depends	Depends

Your Data Processing Agreement (DPA) is the document that matters in court, not the sales brochure.

6. How is security tested—by code, not claims?

Too many vendors skip basic code and infra audits. I’ve seen agent deployments with zero checks for SQL injection, XSS, or token leaks. At a minimum, your vendor should run scheduled audits with tools like bandit, semgrep, and gitleaks, and provide you the report. If not, you’re flying blind.

bandit static analysis example

bandit -r ./src -f html -o bandit-report.html

No report? That’s a red flag.

7. What happens to your data when you leave?

Switching vendors in DACH market usually takes 5–9 business days (based on real migrations between Supabase and AWS RDS). But if your contract doesn’t guarantee a full export in a standard format, you’re vendor-locked. Demand an API/CSV export option, no extra fees, and a written SLA for data handover.

Typical data export process

# Export from Supabase
supabase db dump --file backup.sql
# Restore to new server
psql -h new_host -U user -d new_db -f backup.sql

Your contract should specify the export process, timeline, and supported formats.

FAQ

As of 2024, external GDPR audits (by PwC, EY, etc.) run €2,500–€8,000 per data chain. If you have a single AI module, you may self-check, but you won’t get a compliance certificate.

If your vendor is ready, integration takes 2–4 weeks. Otherwise, budget up to 3 months for contract reviews and remediation.

What if the service fails or leaks data?

You must report to the regulator within 72 hours (GDPR Art. 33). If your vendor is at fault, contract terms (DPA) decide who pays—but you’re still the public face.

Is all data kept inside the EU?

If only local hosting (Hetzner, IONOS) is used, yes. Any cloud AI (AWS, Azure, Google Cloud) requires explicit region checks.

Who is accountable for AI mistakes?

If it’s a data processing error, the product operator is on the hook. The vendor is only liable as stated in SLA/DPA.

Does your current AI workflow cover all seven points—or are there blind spots that could cost your license and reputation? Where is your weakest link: agent logic, data storage, or export process? I run a free 30-min stack audit for DACH founders building AI in regulated markets. DM me on LinkedIn or write to @ger_dennis_ai.