> **TL;DR.** Commercial products (API, Team, Enterprise): contractually no training by default. API log retention dropped from 30 days to **7 days** on 2025-09-14 — the strongest default in the LLM market. Consumer products (claude.ai free, Pro, Max): training default flipped to **opt-in** on 2025-10-08, with up to 5-year retention. Anthropic became a Microsoft 365 Copilot subprocessor on 2026-01-07 and is **explicitly out of EU Data Boundary scope** for that route.
>
> **DPO action:** map staff use of consumer claude.ai (defaults are no longer protective); decide whether to allow Anthropic models in Copilot tenants; apply for ZDR if data sensitivity warrants.

## What the tool does

Anthropic runs Claude — both the consumer-facing chat product (claude.ai) and the API behind it. Buyers will be looking at one of three things: the API (for embedded apps), Claude Team / Enterprise (for staff use), or claude.ai consumer plans. As with OpenAI, the terms, training defaults, and retention defaults differ between commercial and consumer products. Do not conflate them.

## Data processed

- Text input from users / apps
- Documents you upload for analysis
- Image content (Claude vision)
- Tool-use / function-call results
- Embeddings (Anthropic's first-party embeddings story has shifted through 2025–2026 via the Voyage AI acquisition; if your use case relies on embeddings, confirm the current API surface and terms)

**Special-category likelihood:** **High** for the same reasons as OpenAI — if staff or end users can type freely, sensitive content gets in. DPIA needed for any public-facing or HR-adjacent deployment.

**Default geographic processing:** Multi-region; primarily US infrastructure.

## DPA availability

Anthropic publishes a DPA via the Privacy Center. **An updated DPA effective 2026-01-01** is automatically incorporated into the Commercial Terms of Service — when a customer accepts the Commercial Terms, they accept the DPA without a separate signature flow.

- Pointer (Help Center): `https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa` — short article that links the actual DPA document
- The DPA itself covers SCCs Module 2 / Module 3 for international transfers, the UK International Data Transfer Addendum, and a Swiss addendum
- Establishes the customer as data controller, Anthropic as processor
- Irish law governs the agreement; disputes resolve in Irish courts
- Last updated: 2026-01-01

This auto-incorporation model is buyer-friendly compared to OpenAI's account-gated DPA flow, but the implication is the same: read the terms before signing the commercial contract. Note that the SCC modules, UK Addendum, and Irish governing-law provisions are stated in the DPA document itself, not in the Help Center pointer article.

## Subprocessor list

Anthropic publishes a subprocessor list. Notable subprocessors include:

- **Amazon Web Services (AWS)** — primary infrastructure
- **Google Cloud Platform** — additional infrastructure
- **Microsoft Azure** — added as a subprocessor for Microsoft Foundry / Copilot integrations from 2026-01-07
- Various support and analytics tooling

The multi-cloud posture (AWS + GCP + Azure) is unusual and gives Anthropic redundancy, but it also means buyers should not assume a single cloud's regional guarantees apply.

## Training-on-customer-data position

**Commercial products (API, Team, Enterprise): not used for model training. By default and contractually.** Anthropic states API inputs and outputs are never used for model training; Team and Enterprise plans do not use data for training.

**Consumer products (claude.ai free, Pro, Max): default changed 2025-10-08.** Consumer plans now default to **opt-in for model training**, with data potentially retained for **up to 5 years** for training purposes unless the user opts out. **This is a material change** that many enterprise buyers have not registered. Staff using personal claude.ai accounts are now in a training-eligible flow by default.

**API log retention:** As of 2025-09-14, default API log retention dropped from 30 days to **7 days**. Organisations needing the longer 30-day window for audit can opt in via DPA. **Zero Data Retention (ZDR)** is available for qualifying enterprise customers — inputs and outputs not stored beyond what's needed for abuse screening.

> Anthropic's commercial defaults are stronger than OpenAI's (7-day vs 30-day default retention). The consumer-tier shift to default-opt-in for training is a real risk that mirrors OpenAI's shadow-use problem. — My read

## EU / UK transfer position

Anthropic relies on **Standard Contractual Clauses (SCCs)** (Module Two and Module Three) for EU transfers, incorporated through the DPA. The DPA explicitly **adapts the SCCs for the UK International Data Transfer Addendum** (the addendum laid before UK Parliament on 2 February 2022) and includes an addendum for transfers subject to Swiss data protection law. Irish law governs the agreement and disputes resolve in Irish courts.

Anthropic is **certified under the EU-US Data Privacy Framework** (confirmed active 2026-03 — same DPF reauthorisation caveat as [OpenAI](/vendors/openai)).

EU data residency: Anthropic has been adding region-specific deployments via cloud partners; confirm current options for your specific tier before assuming one exists.

**Significant warning:** when Anthropic models are accessed **via [Microsoft 365 Copilot](/vendors/microsoft-365-copilot)** (default-enabled for most commercial tenants from 2026-01-07), Anthropic processing is **out of scope for the Microsoft EU Data Boundary**. EU buyers using Copilot's Anthropic features need to know this and decide actively whether to allow it.

## Security documentation

Anthropic's trust center at `trust.anthropic.com` lists:

- **SOC 2 Type I and Type II**
- **ISO 27001:2022**
- **ISO/IEC 42001:2023** — issued by Schellman Compliance, accredited by ANSI National Accreditation Board. Anthropic is one of the few major LLM providers with this certification.
- **HIPAA Business Associate Agreement (BAA)** — available for qualifying healthcare customers

## AI Act role + risk classification

- **Role:** Anthropic is a **provider** of general-purpose AI models. GPAI obligations under Articles 51-55 apply to Anthropic.
- **Your role as a buyer:** **deployer**, with separate obligations.
- **Risk tier:** same logic as [OpenAI](/vendors/openai) — most uses sit at limited or minimal risk; Annex III triggers high-risk obligations regardless of which model you use.

Anthropic publishes a Responsible Scaling Policy and AI Safety Level (ASL) framework, which is more substantive than most peers. Useful evidence of provider-side governance in your audit file.

## DPIA prompts (for your use case)

1. **Are you using the API/Team/Enterprise tier or claude.ai consumer?** Consumer-tier defaults changed in October 2025 — staff accounts may now be in a training-eligible flow by default.
2. **Are you accessing Claude via [Microsoft 365 Copilot](/vendors/microsoft-365-copilot)?** If yes, processing falls outside the EU Data Boundary; EU subjects' data is leaving the boundary unless you actively block it.
3. **Special-category data:** same Article 9 question as OpenAI. Staff can paste anything; UI controls and training matter.
4. **AI Act Annex III applicability:** if your use case is in recruitment, credit, education, law enforcement, migration, or justice, deployer obligations apply.
5. **API log retention:** the 7-day default is short, but if you've opted into 30-day, document it. If you need ZDR, apply via Anthropic enterprise sales.

## Unresolved questions / red flags

- **Consumer-tier training default flipped 2025-10-08.** Many enterprise DPOs are still operating on the assumption that claude.ai consumer is "no training by default." That is no longer true.
- **Microsoft 365 Copilot integration moves Anthropic processing out of the EU Data Boundary** for those Copilot tenants. This is not obvious and is being missed.
- **EU residency options are evolving.** Confirm at each review.
- **DPF reauthorisation contested.** EU institutional debates ongoing through 2026; could affect transfer mechanism availability mid-cycle.
- **Embeddings story has shifted** through the Voyage acquisition. If your stack relies on Anthropic embeddings, confirm the current product / term shape.

## Related profiles

- [OpenAI](/vendors/openai) — same general-purpose LLM category, different defaults
- [Microsoft 365 Copilot](/vendors/microsoft-365-copilot) — embeds Anthropic models out of EU Data Boundary scope
- [Perplexity](/vendors/perplexity) — routes to Anthropic models, applying Anthropic's terms transitively

## Sources checked

- `https://privacy.claude.com/en/articles/7996862-how-do-i-view-and-sign-your-data-processing-addendum-dpa` — corroborated 2026-04-29
- `https://trust.anthropic.com/`
- Anthropic data retention policy change 2025-09-14 (30 → 7 days)
- Microsoft Foundry documentation on Anthropic as subprocessor and EU Data Boundary scope — 2026-04-29
- Public reports of consumer-tier training default change 2025-10-08
- Anthropic-in-Copilot default-enable announcement 2026-01-07
## Related reading

- [DPA for AI vendors](/topics/dpa-for-ai-vendors) — the eight clauses to check on any AI vendor DPA, with Anthropic's 7-day retention default put in context
- [EU AI Act for AI buyers](/topics/eu-ai-act-for-ai-buyers) — deployer-side obligations for UK and EU buyers running Claude through the API or Enterprise tier
- [HIPAA for AI tools](/topics/hipaa-for-ai-tools) — BAA gate and Security Rule checklist for US healthcare buyers using Claude
- [OpenAI vs Anthropic DPA](/compare/openai-vs-anthropic-dpa) — head-to-head on the two most-asked-about API vendors
- [Copilot 365 vs Google Workspace AI compliance](/compare/copilot-365-vs-google-workspace-ai-compliance) — relevant because Anthropic became a Copilot subprocessor on 2026-01-07

> **TL;DR.** Voice samples are **biometric data** under UK and EU GDPR (Article 9). **Enterprise tier:** training off by default, Zero Retention Mode available, EU/US/India data residency. **Non-Enterprise tiers** (free / Creator / Pro / Scale): training default-ON unless opted out — and the opt-out applies prospectively only, so audio already submitted may already be in training datasets. **Zero Retention Mode applies to Text-to-Speech, Speech-to-Text, and ElevenAgents APIs** — voice cloning is not enumerated as ZRM-eligible, so cloned voice models persist. AI Act Article 52 transparency obligations apply to all AI-generated audio in EU contexts.
>
> **DPO action:** use Enterprise tier for any EU or biometric processing; document explicit consent for any cloned voices; implement Article 52 disclosures even for benign use cases.

## What the tool does

ElevenLabs makes AI voice synthesis and voice cloning. Buyers commonly evaluate one of three products:

1. **ElevenLabs platform (free / Creator / Pro / Scale)** — consumer / SMB tiers for individual creators and small teams. Voice synthesis from text, voice cloning from short audio samples, dubbing
2. **ElevenLabs API** — programmatic access to text-to-speech, speech-to-speech, and the Agents Platform for voice agents
3. **ElevenLabs Enterprise** — admin controls, custom DPA, BAA availability, data residency, Zero Retention Mode

Voice cloning specifically has its own compliance posture and is **not** covered by the same defaults as text-to-speech. Treat voice cloning as a separate evaluation item in any DPIA.

## Data processed

- Source text (which can include any personal data the user types)
- Audio samples for voice cloning (almost always personal data — biometric in most readings)
- Audio output (the synthesised speech itself)
- For Speech-to-Speech: the source audio of the input speaker
- For the Agents Platform: full conversation transcripts and audio
- Account / billing data

**Special-category likelihood:** **Very high.** A voice sample is biometric data under UK and EU GDPR readings — Article 9 special-category processing. Even text input often contains personal data the speaker would not want synthesised. Voice cloning of any identifiable person without their explicit consent raises both a GDPR concern (lawful basis) and an emerging AI Act concern (Article 52 transparency, Article 5 prohibited practices in deceptive contexts).

**Default geographic processing:** US-centric. **Enterprise tier offers data residency in US, EU, India** per ElevenLabs documentation. Non-Enterprise tiers do not have data residency selection.

## DPA availability

ElevenLabs publishes a DPA.

- URL: `https://elevenlabs.io/dpa`
- The DPA applies when ElevenLabs processes customer personal data as a processor on behalf of customers acting as controllers
- Auto-incorporated into Enterprise terms; non-Enterprise customers should confirm DPA coverage applies to their tier before processing personal data through the service
- Custom DPA negotiation is available on Enterprise

## Subprocessor list

ElevenLabs maintains a subprocessor list — check the trust center or DPA appendix for the current location at review time.

Notable subprocessors (typical):

- **AWS or Google Cloud** — primary infrastructure
- Various analytics, support, and email tooling
- **Underlying AI model providers** — ElevenLabs has historically used proprietary models, but Agent Platform features may invoke third-party LLMs (e.g. for conversation logic) — verify per use case

If the subprocessor list is not findable at review time, flag as red — for a vendor processing biometric data, opacity on subprocessing is unacceptable.

## Training-on-customer-data position

**Enterprise:** Training data use is **off by default unless explicitly opted in**. Customer audio and text are not used to train ElevenLabs' models in the default Enterprise configuration. **Zero Retention Mode** is available for Enterprise — input/output not retained beyond the immediate request lifecycle.

**Non-Enterprise tiers (free / Creator / Pro / Scale):** **Audio may be used to improve ElevenLabs' models unless the user actively opts out.** The opt-out toggle applies **prospectively only** — material already submitted may already be in training datasets. This is the same trap as ChatGPT consumer + claude.ai consumer, but with biometric data, which makes it worse.

**Critical scope of Zero Retention Mode:** ElevenLabs' compliance documentation enumerates ZRM-eligible (HIPAA-Covered) services as **Text-to-Speech API, Speech-to-Text API, and ElevenAgents** only. Voice cloning is **not enumerated** as a ZRM-eligible service, so cloned voice models persist on ElevenLabs servers regardless of ZRM status. The compliance FAQ also carves out a specific exception within ElevenAgents: *"Agent configuration data is persisted, meaning it is not covered by Zero Retention Mode and should not contain PHI."*

In practice this means voice cloning models, and ElevenAgents agent configuration data, sit outside ZRM by enumeration. Enterprise procurement teams need to capture this explicitly.

> Enterprise + ZRM is a defensible posture for text-to-speech and speech-to-text. Voice cloning needs a separate explicit assessment regardless of tier — the data type (biometric) and the persistence of voice models put it outside ZRM's enumerated scope. Non-Enterprise voice cloning is not appropriate for any organisation processing identifiable individuals' voices. — My read

## EU / UK transfer position

ElevenLabs is a US company. Transfers from the EU/UK to the US rely on **Standard Contractual Clauses (SCCs)** under the DPA. For UK transfers the DPA references the **UK Addendum issued by the UK Information Commissioner under Section 119A(1) of the UK Data Protection Act 2018 (version B1)** — substantively the UK International Data Transfer Addendum, framed via UK ICO/DPA-2018 rather than the "Parliament-laid 2 February 2022" phrasing some other vendors use. Same instrument, different language.

ElevenLabs is **certified under the EU-US Data Privacy Framework**, the **Swiss-U.S. DPF**, and the **UK Extension to the EU-U.S. DPF** — listed as Active across all three on the official `dataprivacyframework.gov` registry as of 2026-05. Coverage extends to both HR Data and Non-HR Data (same reauthorisation caveat as [OpenAI](/vendors/openai) / [Anthropic](/vendors/anthropic)).

**EU data residency:** **Enterprise-only feature.** Data is stored in isolated EU environments for Enterprise customers who configure it. Non-Enterprise customers' data is processed in default US infrastructure regardless of their location.

This is the most consequential limitation for EU/UK SME buyers: unless they're on Enterprise (typically £££), there is no EU residency option. A free or Creator tier user in Germany processing voice samples of EU subjects has US-resident processing without contractual safeguards beyond the standard ToS.

## Security documentation

Per the trust portal at `https://compliance.elevenlabs.io/` (verified 2026-05-02):

- **SOC 2 Type 2**
- **ISO 27001:2022**
- **ISO/IEC 27017:2015** (cloud-specific information security controls)
- **ISO/IEC 27018:2019** (cloud privacy / PII processor controls)
- **ISO/IEC 27701:2019** (privacy information management)
- **ISO/IEC 42001:2023** (AI management systems — downloadable certificate visible as "42001 - AIMS Certificate - Eleven Labs.pdf")
- **PCI DSS 4.0.1 Level 1**
- **CSA STAR Level 1**
- **AIUC-1** (AI Use Case certification)
- **HIPAA** — attestation; BAA available on Enterprise for qualifying healthcare customers
- **HDS** (Hébergeur de Données de Santé — French health data hosting certification)
- **GDPR / UK GDPR** — attestation, addressed in the DPA

The cert portfolio is strong for a vendor at ElevenLabs' size, broader than Perplexity and comparable to the Big Tech LLM peers. The ISO 42001 certification specifically is a real AI Act audit signal. The HDS attestation is unusual and directly relevant for any French / Swiss buyer in regulated health contexts.

ElevenLabs' security posture has matured rapidly through 2025-2026 but is still less battle-tested than Big Tech peers. For a vendor handling biometric data, this matters.

## AI Act role + risk classification

- **Role:** ElevenLabs is a **provider** of AI systems (TTS, voice cloning, Agents Platform). The Agents Platform may also make ElevenLabs a provider of GPAI-adjacent systems depending on the feature mix.
- **Your role as a buyer:** **deployer** with deployer obligations.
- **Risk tier:**
    - Text-to-speech for narration / accessibility / content production: typically **limited risk** with transparency obligations (users must be told they're hearing AI-generated audio)
    - Voice cloning of real people: **high risk** if used for impersonation or in deepfake contexts; **prohibited** if deceptive in ways that fall under Article 5 prohibited practices
    - Voice agents in customer service, recruitment screening, or other Annex III adjacent flows: **high risk** under AI Act Annex III obligations

The AI Act treats deepfakes (synthetic audio deceptively presented as a real person) with explicit transparency obligations under Article 52. ElevenLabs' tooling can produce content that triggers these obligations regardless of the buyer's intent.

UK ICO has issued public statements on biometric processing through 2025–2026 and continues to refine guidance — review the ICO's current biometric data guidance alongside any ElevenLabs deployment plan.

## DPIA prompts (for your use case)

1. **Are you processing biometric data?** Voice samples are biometric under most GDPR readings. If yes, you need an Article 9 lawful basis (typically explicit consent) plus a DPIA covering Article 35.
2. **Is the cloned voice a real person's voice — and do you have their explicit, informed, written consent?** Without consent, cloning likely lacks a lawful basis under GDPR. Copyright in the source recording is a separate question and does not establish consent on the data subject's behalf.
3. **Are you on Enterprise with data residency configured to your jurisdiction?** Free / Creator / Pro / Scale tiers do not offer EU residency. SME-tier processing of EU voice samples in US infrastructure is a material risk.
4. **Have you opted out of training data use** if you are not on Enterprise? Default-on training of biometric data is the worst-case scenario.
5. **Have you implemented disclosure** that synthesised audio is AI-generated, per AI Act Article 52 transparency obligations? Even for benign use cases.
6. **Voice cloning specifically:** are voice models stored beyond your project lifecycle? ElevenLabs retains voice models even under ZDR — plan for deletion when the project ends.
7. **Agents Platform:** if used, are conversation transcripts being processed under terms appropriate for the data type? This is a different surface from TTS and may have different defaults.

## Unresolved questions / red flags

- **Biometric data + non-Enterprise defaults = systemic risk.** SMEs using free or Pro tiers to process identifiable people's voices are very likely operating outside their lawful basis.
- **Zero Retention Mode is enumerated, not universal.** ZRM applies to Text-to-Speech, Speech-to-Text, and ElevenAgents APIs. Voice cloning is not enumerated as ZRM-eligible, so cloned voice models persist. ElevenAgents has its own carve-out: agent configuration data persists outside ZRM. Buyers thinking they have ZRM coverage on voice cloning specifically do not — and should not store PHI in ElevenAgents agent configuration.
- **EU data residency is Enterprise-only.** Pricing for Enterprise tier is not publicly listed — get a quote before assuming it's affordable for an SME.
- **Subprocessor list URL has shifted** — flag if not findable at review time.
- **AI Act Article 52 transparency obligations** apply to all AI-generated audio in EU contexts. Few buyers have implemented this.
- **Voice cloning legal position is moving fast** — UK ICO, EDPB, and national regulators are actively shaping enforcement. A profile dated more than 90 days old should be re-checked.
- **Use of cloned voices in advertising or political content** may trigger additional sectoral obligations (Ofcom, ASA, Electoral Commission for UK; equivalent EU bodies). Outside the GDPR scope, but check sector-specific obligations before deployment.

## Related profiles

This is the only voice-AI profile in the index so far. For text-LLM context that often pairs with voice agents:

- [OpenAI](/vendors/openai) — Whisper / Realtime API for speech-related work
- [Google Gemini](/vendors/google-gemini) — natively multimodal, including audio

## Sources checked

- ElevenLabs DPA: `https://elevenlabs.io/dpa` — referenced 2026-05-02
- ElevenLabs Data Residency documentation: `https://elevenlabs.io/docs/overview/administration/data-residency` — referenced 2026-05-02
- ElevenLabs Enterprise: `https://elevenlabs.io/enterprise` — referenced 2026-05-02
- ElevenLabs Privacy Policy: `https://elevenlabs.io/privacy-policy` — referenced 2026-05-02
- ICO public guidance on biometric processing
- Independent compliance write-ups (Deepgram audit guide, XS2Content EU-hosted analysis) — referenced for context 2026-05-02
## Related reading

- [DPA for AI vendors](/topics/dpa-for-ai-vendors) — the eight clauses to check on any AI vendor DPA, applied to ElevenLabs Enterprise
- [EU AI Act for AI buyers](/topics/eu-ai-act-for-ai-buyers) — Article 50(4) deepfake labelling obligations for buyers running voice cloning
- [HIPAA for AI tools](/topics/hipaa-for-ai-tools) — BAA gate for US healthcare voice work (clinical narration, patient-facing voice assistants)
- [ElevenLabs vs other voice AI vendors](/compare/elevenlabs-voice-ai-dpa-comparison) — buyer-side comparison against the hyperscaler voice products

> **TL;DR.** Three distinct surfaces buyers conflate: **Gemini Enterprise / Vertex AI** (contractually no training, ZDR available, broad cert portfolio); **AI Studio** at `ai.google.dev` (free-tier API; less protective defaults); **consumer Gemini** at `gemini.google.com` and embedded in Workspace (training enabled by default unless disabled). EU residency is configurable per-call on Vertex AI — easy to leak. Google Cloud has the broadest compliance certification portfolio of any major LLM provider.
>
> **DPO action:** lock down which Gemini surface your staff actually use; configure region pinning at the SDK level (not project level); review Workspace Gemini Apps Activity setting at tenant scope.

## What the tool does

Google ships Gemini in three places that buyers commonly conflate:

1. **Gemini Enterprise / Vertex AI** (rebranded "Gemini Enterprise Agent Platform" at Google Cloud Next 2026) — the enterprise platform for building, deploying, and governing AI agents grounded in your own data. Sits inside Google Cloud, billed via GCP, governed by Google's Cloud DPA.
2. **Gemini API via AI Studio** at `ai.google.dev` — developer-facing free / paid tier for prototyping. Different terms from Vertex AI.
3. **Gemini consumer surfaces** — the standalone chat at `gemini.google.com` and the embedded Gemini features inside Google Workspace (Gmail, Docs, Slides, Sheets, Meet). For most enterprise buyers using Workspace, this is the most-touched surface.

Compliance defaults differ across all three. Most enterprise procurement should be looking at Gemini Enterprise / Vertex AI; AI Studio is fine for prototyping but is not the enterprise contracting surface.

## Data processed

- Text and multimodal input (image, audio, video, PDF — Gemini is natively multimodal)
- Document content via Vertex AI grounding / RAG
- Prompts, function-call payloads, tool-use intermediates
- Embeddings (Vertex AI offers first-party embeddings)
- Optional grounding from Google Search (Vertex AI feature, off by default)
- For Workspace Gemini: any content the signed-in user has access to in Gmail, Drive, Calendar, etc.

**Special-category likelihood:** **High** in any free-form deployment. Gemini's multimodal nature means staff may upload images / scanned documents that contain Article 9 categories (medical scans, ID photos, etc.) without realising. UI controls and DPIA matter more than usual.

**Default geographic processing:** Vertex AI processing region is **configurable** (EU, US, multi-region). EU residency available but **not the default** — must be configured at the project / model-call level. Default in many quickstart paths is `us-central1`.

## DPA availability

**Google Cloud Data Processing Addendum (Cloud DPA)** governs Vertex AI and Gemini Enterprise. Auto-incorporated into Google Cloud commercial agreements. Publicly available without a sales call.

- URL: `https://cloud.google.com/terms/data-processing-addendum`
- Includes SCCs and the UK International Data Transfer Addendum (UK Addendum)
- Updated regularly; check version date on each review

For AI Studio (Gemini API direct), the Google APIs Terms of Service apply and DPA coverage is more limited. Most enterprises should not be using AI Studio for production workloads.

For Workspace Gemini, the existing Google Workspace DPA applies — verify your Workspace tier covers the AI features you use.

## Subprocessor list

Google Cloud publishes a subprocessor list applicable to all Google Cloud services including Vertex AI / Gemini Enterprise.

- URL: `https://cloud.google.com/terms/subprocessors`
- Updates announced via Google Cloud subprocessor email list (subscribable)
- Last updated date and added/removed entries are tracked in the document

For Gemini-specific data flows, the relevant subprocessors are largely Google's own subsidiaries plus standard infrastructure providers. Less third-party reliance than peers.

## Training-on-customer-data position

**Vertex AI / Gemini Enterprise:** **Customer data is not used to train Google's AI/ML models without prior permission or instruction.** Google's Service Specific Terms Section 17 ("Training Restriction") makes this an explicit contractual commitment for Cloud customers.

**Vertex AI Zero Data Retention (ZDR):** Available for Generative AI on Vertex AI. When enabled, prompts and responses are not retained at all (beyond the immediate request lifecycle). Configurable per project / model.

**AI Studio / `ai.google.dev` free tier:** Training defaults are **less protective**. Free-tier API requests have historically been used to improve Google's models. Confirm current free-tier policy on review — Google has shifted defaults over the past 18 months.

**Gemini consumer (`gemini.google.com`) and Workspace Gemini:** Conversations may be used to improve Google's products (with human reviewers seeing samples of conversations) unless training is disabled. The relevant admin control sits in the Workspace admin console under **"Control Workspace Intelligence for generative AI features"** (renamed from the older "Gemini Apps Activity" label). Workspace admin docs state explicitly: *"Your content is not human reviewed or used for Generative AI model training outside your domain without permission."* Many admins have not actively reviewed this control.

> The enterprise no-training story for Vertex AI is solid and contractual. The free-tier API and consumer-chat defaults are not. The biggest unmanaged risk is staff using `gemini.google.com` on personal Google accounts, sometimes signed in as their work identity if Workspace is configured permissively. — My read

## EU / UK transfer position

Google Cloud DPA relies on **Standard Contractual Clauses (SCCs)** for EU transfers and incorporates the **UK International Data Transfer Addendum** for UK transfers.

**EU-US Data Privacy Framework (DPF) certification:** Google LLC and several Google entities are DPF-certified (active as of 2026-03 — same reauthorisation caveat as [OpenAI](/vendors/openai) and [Anthropic](/vendors/anthropic)).

**EU data residency:** Vertex AI offers EU regions (`europe-west1`, `europe-west4`, others). **Configuration is per-call, not per-project by default** — a DPIA must specify and verify region pinning. Multi-region configurations can route EU subjects' data outside the EU unless explicitly constrained.

**Google's "Sovereign Cloud" partnerships** (with T-Systems in Germany, others) offer additional EU data sovereignty options for highly regulated buyers. Out of scope for most SMEs, but relevant if your sector requires it.

## Security documentation

Google Cloud has the broadest certification portfolio of any major LLM provider:

- **SOC 1 / 2 / 3** — yes, all
- **ISO 9001, 27001, 27017, 27018, 27701** — yes
- **ISO/IEC 42001:2023** — yes, accredited certification covers Google Cloud Platform, Google Workspace, and the Gemini App (the assessment was conducted by Coalfire, mapped against both ISO 42001 and the NIST AI Risk Management Framework)
- **FedRAMP High** — yes (US government)
- **HIPAA BAA** — available for qualifying customers
- **PCI DSS** — yes
- **C5 (Germany), IRAP (Australia), MTCS (Singapore)** — multiple regional certs

The breadth here is a real advantage in compliance audits. Standards coverage is rarely the gap with Google; the gap is configuration defaults.

## AI Act role + risk classification

- **Role:** Google is a **provider** of general-purpose AI models (Gemini family). GPAI obligations under Articles 51-55 apply.
- **Your role as a buyer:** **deployer**, with deployer obligations.
- **Risk tier:** as with all GPAI, depends on the use case. Annex III triggers high-risk obligations regardless of the model. Vertex AI's enterprise governance features (Model Garden filtering, Safety filters, Vertex AI Model Monitoring) help evidence deployer due diligence — keep audit trails.

Google publishes AI Act readiness materials and a Model Card for Gemini family models.

## DPIA prompts (for your use case)

1. **Which Gemini surface are you actually deploying — Vertex AI, AI Studio, consumer chat, or Workspace Gemini?** They have different DPAs, different training defaults, and different data residency stories. Get this on paper before anything else.
2. **Have you configured EU data residency** at the call level for any EU subject data? Default routing may be US-resident.
3. **Have you applied for ZDR** on Vertex AI Generative AI if your data sensitivity warrants it?
4. **Have you mapped staff use of `gemini.google.com` and Workspace Gemini features?** Personal Google accounts using consumer Gemini sit under consumer terms; this is the most-missed risk in Workspace-using SMEs. For Workspace tenants, confirm the **"Control Workspace Intelligence for generative AI features"** admin setting reflects your training-restriction stance.
5. **AI Act Annex III applicability:** if your use case touches recruitment, credit, education, law enforcement, migration, or justice, deployer high-risk obligations engage.
6. **Multimodal input:** are users uploading images/PDFs that may contain Article 9 special-category data? UI controls plus a DPIA covering this scenario.

## Unresolved questions / red flags

- **Three distinct surfaces with different defaults** confuse procurement. Most "Gemini compliance" assertions in SME marketing material conflate them.
- **EU residency is configurable, not default.** Same problem as [OpenAI](/vendors/openai); commonly missed.
- **Free-tier AI Studio defaults shift periodically.** Don't assume yesterday's read still holds — re-check on each profile refresh.
- **Workspace Gemini training defaults track Workspace policy.** Workspace Business / Enterprise admins can set training restrictions via the "Control Workspace Intelligence for generative AI features" admin control; many haven't actively reviewed it.
- **Vertex AI's regional pinning happens at the SDK call level**, not project level — a missed config in code can quietly route EU data to US.
- **"Gemini Enterprise" rebrand from Vertex AI (Cloud Next 2026)** is recent. Documentation is still being migrated; older URLs may break.

## Related profiles

- [OpenAI](/vendors/openai) — same general-purpose LLM category, US-centric defaults
- [Anthropic](/vendors/anthropic) — same category, multi-cloud subprocessing

## Sources checked

- Google Cloud Service Specific Terms Section 17 ("Training Restriction") — corroborated 2026-05-01
- Vertex AI ZDR documentation: `https://docs.cloud.google.com/vertex-ai/generative-ai/docs/vertex-ai-zero-data-retention`
- Google Cloud DPA: `https://cloud.google.com/terms/data-processing-addendum`
- Google Cloud subprocessor list: `https://cloud.google.com/terms/subprocessors`
- Cloud Next 2026 Gemini Enterprise Agent Platform announcement — multiple secondary sources 2026-05-01
## Related reading

- [DPA for AI vendors](/topics/dpa-for-ai-vendors) — the eight clauses to check on any AI vendor DPA, applied to Workspace Gemini
- [EU AI Act for AI buyers](/topics/eu-ai-act-for-ai-buyers) — deployer-side obligations for buyers running Workspace Gemini or Vertex AI
- [HIPAA for AI tools](/topics/hipaa-for-ai-tools) — Workspace BAA scope for Healthcare and Life Sciences customers
- [Copilot 365 vs Google Workspace AI compliance](/compare/copilot-365-vs-google-workspace-ai-compliance) — the closest enterprise-tier alternative
- [Gemini vs Vertex AI compliance](/compare/gemini-vs-vertex-ai-compliance) — picking between the Workspace surface and the Google Cloud developer surface

> **TL;DR.** Strong contractual no-training position for the paid Copilot product. **EU Data Boundary default weakened on 2026-04-17** — "flex routing" allows EU tenant data to process outside the EU during peak demand, on by default. Anthropic enabled as subprocessor 2026-01-07 — Anthropic processing is **explicitly out of EU Data Boundary scope**. Two products share the Copilot name (Microsoft 365 Copilot vs Copilot Chat / consumer Copilot) with very different data models.
>
> **DPO action:** review your tenant's flex routing setting and Anthropic models toggle now. If you have not reviewed since 2026-03-25, your data is processing outside the EU Data Boundary by default.

## What the tool does

Microsoft 365 Copilot is an AI assistant embedded in Word, Excel, PowerPoint, Outlook, Teams, and the wider M365 stack. It draws on the user's tenant data (emails, files, chats) via Microsoft Graph and combines that with large language models to generate text, summaries, action items, and draft documents. There is also a separate Microsoft 365 Copilot Chat product, which has a different data model. Buyers must distinguish them in any DPIA. Copilot Studio (the agent platform) is a separate compliance evaluation again.

## Data processed

The hard part of this profile is that Copilot processes a lot:

- **Email content** (Outlook)
- **Document content** (OneDrive, SharePoint)
- **Chat and meeting transcripts** (Teams)
- **Calendar data**
- **User identity and permissions**
- Anything else accessible via the user's M365 Graph permissions

**Special-category likelihood:** **Very high.** Copilot reads anything the signed-in user can read. In a typical SME, that includes HR records, performance reviews, financial data, and customer correspondence. DPIA is not optional for any deployment.

**Default geographic processing:** EU Data Boundary applies for EU tenants — **but with significant caveats** (see EU/UK transfer position below). The "flex routing" change effective 2026-04-17 materially weakens the default.

## DPA availability

Microsoft 365 Copilot is governed by the **Microsoft Product Terms** and **Data Protection Addendum (DPA)**, both publicly available and incorporated by reference into all M365 commercial agreements.

- DPA URL: Microsoft publishes the current Product Terms and DPA at `aka.ms/DPA`
- Sign-up requirement: applies automatically to all M365 commercial customers
- Updated regularly; check version date on each review

The DPA establishes Microsoft as processor for tenant content and includes SCCs and the UK Addendum.

## Subprocessor list

Microsoft maintains a list of "Subprocessors and Data Locations" for online services. Notable subprocessors / sub-models for Copilot specifically:

- **[OpenAI](/vendors/openai)** — historical core model provider
- **[Anthropic](/vendors/anthropic)** — added as a subprocessor effective 2026-01-07; Anthropic models default-enabled for most commercial tenants
- Various support, analytics, and infrastructure subprocessors

**The carve-out worth flagging:** when Copilot uses Anthropic models, the processing **falls outside the Microsoft EU Data Boundary**. Microsoft documentation states verbatim:

> "Anthropic models deployed in Microsoft offerings (including Microsoft 365 Copilot, Researcher, Copilot Studio, Power Platform, Agent Mode in Excel, and Word, Excel, and PowerPoint agents) are currently excluded from the EU Data Boundary, and when applicable, in-country processing commitments."

By default, EU tenants now have Copilot inferencing happening with a subprocessor that does not honour the boundary. The exclusion covers Researcher, Copilot Studio, Power Platform, and the Excel/Word/PowerPoint Agent Modes alongside the Copilot chat experience. Admins can disable Anthropic models in Microsoft 365 admin centre, but the default is on.


## Training-on-customer-data position

**Microsoft 365 Copilot does not use prompts, responses, or data accessed through Microsoft Graph to train foundation LLMs**, including those used by M365 Copilot itself. This is a contractual commitment in the Product Terms.

**Source:** Microsoft Learn — "Data, Privacy, and Security for Microsoft 365 Copilot."

This is a real difference from consumer Copilot products and one of the strongest commercial-tier no-training commitments in the market.

## EU / UK transfer position

This is the **most important section of this profile** and where buyers most often have an outdated mental model.

**Historical position (pre-April 2026):** Microsoft committed to processing EU tenant data within the EU Data Boundary. This was a strong selling point.

**Current position (effective 2026-04-17):** Microsoft has enabled "**flex routing**" by default. Flex routing allows Copilot LLM inferencing to occur **outside the EU Data Boundary during peak demand** — your tenant's prompts and Graph-derived content can be processed in non-EU infrastructure when EU capacity is constrained.

- Flex routing is **enabled by default for all new tenants** created after 2026-03-25
- For existing tenants, flex routing was **enabled by default on 2026-04-17** unless the admin disabled it
- Admins can disable flex routing in the Microsoft 365 admin centre under Copilot settings

**Combined with the Anthropic subprocessor change** (out of EU Data Boundary by design), the realistic default for an EU Copilot tenant in 2026 is that *some* of their data processing happens outside the EU.

**SCCs** apply to non-EU processing under the Microsoft DPA. **UK Addendum** applies for UK customers.

> The 2026-04-17 default change is a material risk that EU/UK DPOs need to evaluate immediately. "Copilot is EU Data Boundary by default" is no longer accurate. If you have not reviewed your tenant settings since March 2026, you may be processing personal data outside the EU without a current decision having been made. — My read

## Security documentation

Microsoft's compliance posture is broad and well-documented. Relevant for Copilot:

- **SOC 1 / 2 / 3** — yes, all
- **ISO 27001 / 27017 / 27018 / 27701** — yes
- **ISO/IEC 42001:2023** — yes, both Microsoft 365 Copilot and Microsoft 365 Copilot Chat are certified (issued by Mastermind, accredited by IAS). Microsoft also holds CSA STAR for AI 42001.
- **FedRAMP** — yes (US government)
- **HIPAA / HITRUST** — yes
- **EU GDPR / UK GDPR** — explicit compliance commitments in DPA
- **Microsoft Service Trust Portal** — exhaustive compliance documentation, gated access

Microsoft's standards coverage is broad and well-evidenced. The compliance gaps live in defaults and configuration.

## AI Act role + risk classification

- **Role:** Microsoft acts as both **provider** (of Copilot as a system) and a deployer-side enabler. The underlying LLMs ([OpenAI](/vendors/openai), [Anthropic](/vendors/anthropic)) are GPAI providers.
- **Your role as a buyer:** **deployer**, with deployer obligations.
- **Risk tier for typical use cases:** depends entirely on what you let Copilot do. Generic productivity assistance sits at minimal/limited risk. If Copilot is making or substantially supporting decisions in HR, hiring, performance management, or other Annex III-adjacent areas, deployer high-risk obligations apply.

Microsoft publishes AI Act readiness materials. Useful evidence for your audit file but does not relieve your own obligations.

## DPIA prompts (for your use case)

1. **Have you reviewed your flex routing setting since 2026-03-25?** If not, it is currently on by default and your tenant data may be inferencing outside the EU.
2. **Have you decided whether to allow Anthropic models?** They were enabled by default 2026-01-07 and process outside the EU Data Boundary.
3. **Have you mapped which roles can access Copilot?** Copilot reads anything the user can read. Over-permissioned mailboxes and SharePoint sites become AI-exposure points.
4. **Have you implemented Microsoft Purview or equivalent DLP** to control what Copilot can surface? Default deployments have minimal guard rails.
5. **AI Act Annex III applicability:** is Copilot being used in any HR, hiring, performance, or decision-support flow that touches Annex III? If so, deployer high-risk obligations engage.
6. **Copilot Studio agents:** if you've built or enabled agents, treat each as a separate AI system for AI Act purposes — risk-classify each independently.

## Unresolved questions / red flags

- **The flex routing default change (2026-04-17) is the single biggest active compliance risk for EU Copilot tenants right now.** Many DPOs have not reviewed this setting. The "EU Data Boundary by default" assumption is outdated.
- **Anthropic-as-subprocessor (2026-01-07) introduces an explicit EU Data Boundary exception.** Decision required, not implicit.
- **Copilot's data access scope is the user's full Graph permissions.** Over-permissioning becomes a Copilot-magnified problem.
- **The Copilot family confusion is rampant.** Microsoft 365 Copilot (paid, tenant-data, no-training), Copilot Chat (consumer / different data model), Copilot Studio (agent platform), Copilot in GitHub (separate again). Each needs its own DPIA entry.
- **Microsoft Service Trust Portal is gated** — buyers need to register to pull primary compliance documents.

## Related profiles

- [OpenAI](/vendors/openai) — model provider sub-route
- [Anthropic](/vendors/anthropic) — model provider sub-route, out of EU Data Boundary

## Sources checked

- `https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy` — checked 2026-04-29
- Microsoft documentation on flex routing change effective 2026-04-17 — corroborated via multiple independent sources
- `https://learn.microsoft.com/en-us/copilot/microsoft-365/connect-to-ai-subprocessor` — Anthropic as subprocessor 2026-01-07
- Independent reporting on flex routing implications (windowsforum, changepilot, innfactory, office365itpros) — 2026-04-29
## Related reading

- [DPA for AI vendors](/topics/dpa-for-ai-vendors) — the eight clauses to check on any AI vendor DPA, with the Copilot Anthropic-subprocessor question explained
- [EU AI Act for AI buyers](/topics/eu-ai-act-for-ai-buyers) — deployer-side obligations for buyers running Copilot Agents in Annex III use cases
- [HIPAA for AI tools](/topics/hipaa-for-ai-tools) — BAA gate and Security Rule checklist for US healthcare buyers on Copilot
- [Copilot 365 vs Google Workspace AI compliance](/compare/copilot-365-vs-google-workspace-ai-compliance) — the closest enterprise-tier alternative
- [OpenAI vs Copilot enterprise compliance](/compare/openai-vs-copilot-enterprise-compliance) — ChatGPT Enterprise direct vs the Copilot route

> **TL;DR.** API and ChatGPT business products: contractually no training by default since 2023-03-01. ChatGPT Plus consumer: trains on conversations unless the user opts out — the dominant unmanaged risk for any organisation with knowledge workers. Default API processing is **not** EU-resident; enterprise EU residency is configurable but not on by default. ZDR is approval-gated through sales. ISO 42001 certified — the strongest AI Act audit signal in the LLM market.
>
> **DPO action:** map staff use of consumer ChatGPT, configure EU residency for any EU-subject processing, apply for ZDR if data sensitivity warrants.

## What the tool does

OpenAI runs ChatGPT (consumer and business products) and the API behind it. Most enterprise buyers will be looking at one of three things: the API (for building your own apps), ChatGPT Team / Business / Enterprise (for staff use), or ChatGPT Edu (for education). The terms, training defaults, and data residency story are different for each — do not assume an answer for one applies to the other.

## Data processed

You will typically pass through some or all of:

- The text the user types (which can include any personal data your staff or product feeds in)
- Document content (if you upload files for analysis)
- Voice input (Whisper / Realtime API)
- Image content (GPT-4o vision)
- Embeddings of customer or proprietary data (RAG patterns)

**Special-category likelihood:** **High** if your use case touches health, legal, HR, or any sector where staff might paste sensitive content. Article 9 (UK GDPR) processing is a real risk and most buyers underestimate how often it happens in practice. A DPIA is rarely optional.

**Default geographic processing:** Multi-region; primarily US infrastructure. EU residency is available on enterprise tiers but is not the default — it must be configured.

## DPA availability

OpenAI publishes a Data Processing Addendum that customers can sign through their account portal.

- Sign-up requirement: account-gated; signing the DPA requires an OpenAI account and (for full enterprise terms) sales contact
- The Commercial Terms incorporate the DPA for paid API and ChatGPT business products

If a buyer is using ChatGPT free/Plus consumer tier, the consumer terms apply, which are not equivalent to a DPA — this is an extremely common mistake in SME deployments.

## Subprocessor list

OpenAI publishes a subprocessor list at `https://openai.com/policies/sub-processor-list/`. Last updated 2026-02-11. Notable subprocessors:

- **Microsoft Corporation** — cloud infrastructure for API, ChatGPT Enterprise, ChatGPT Edu, ChatGPT Business (effectively Microsoft Azure, though the list names the corporate entity)
- **Cloudflare** — edge / CDN
- Various support tooling (CRM, analytics, customer support)

The Microsoft / Azure dependency is significant: OpenAI's processing inherits Azure's regional commitments, which means EU buyers should pay attention to which Azure regions OpenAI's enterprise tier supports. Do not assume EU residency without confirming with OpenAI sales.

## Training-on-customer-data position

**API and business products: not used for training by default.** OpenAI states (verbatim from `openai.com/business-data/`):

> "By default, we do not use data from ChatGPT Enterprise, ChatGPT Business, ChatGPT Edu, ChatGPT for Healthcare, ChatGPT for Teachers, or our API platform — including inputs or outputs — for training or improving our models."

This default has applied to API customers since 2023-03-01.

**Consumer ChatGPT (free / Plus): conversations may be used to improve models** unless the user opts out via settings. Most enterprises have staff using ChatGPT Plus on personal accounts — assume this is happening unless you've actively prevented it.

**Default abuse monitoring retention:** 30 days for API content, even when not used for training. Eligible enterprise customers can apply for **Zero Data Retention (ZDR)** via the OpenAI sales team, which removes the abuse-monitoring retention. ZDR is **opt-in and approval-gated**, not automatic.

> The training-by-default-no story is solid for paid API/business tiers, but the 30-day abuse-monitoring retention catches buyers off guard. Plan for it explicitly in your DPIA. — My read

## EU / UK transfer position

OpenAI relies on **Standard Contractual Clauses (SCCs)** for EU transfers, supplemented by the **UK International Data Transfer Addendum** for UK transfers. OpenAI is **certified under the EU-US Data Privacy Framework** (active as of 2026-03 — confirm current status on each review since DPF reauthorisation is contested through 2026).

EU residency option: enterprise tier offers EU data residency for ChatGPT Enterprise; API EU residency is also available but requires configuration. **Default API processing is not EU-resident** — this is the most-missed compliance fact in our market.

## Security documentation

OpenAI's trust center at `trust.openai.com` lists:

- **SOC 2 Type 2** — covering all products. Report available behind registration gate.
- **ISO 27001:2022** — certificate available for public viewing
- **ISO 27017:2015, 27018:2019, 27701:2019** — cloud security, cloud privacy, privacy information management
- **ISO 42001:2023** — AI management systems, increasingly relevant for AI Act buyers
- **CSA STAR**
- **PCI DSS v4.0.1**
- **FedRAMP** — listed (US government)

The ISO 42001 certification is unusual at this scale and a strong signal for AI Act audit defensibility.

## AI Act role + risk classification

- **Role:** OpenAI is a **provider** of general-purpose AI models (Article 51-55 GPAI obligations apply to OpenAI as the model maker)
- **Your role as a buyer:** you are a **deployer** of OpenAI's models when you build a product on top of the API. Your obligations differ from theirs
- **Risk tier for typical SME use cases:** most chatbot, summarisation, and document-processing uses sit in **limited risk** (transparency obligations) or **minimal risk**. **High-risk** (Annex III) is triggered if the use case touches employment decisions, creditworthiness, education access, or other Annex III categories — at which point full conformity assessment applies, regardless of who built the underlying model.

OpenAI publishes an AI Act readiness position, but it does not relieve your deployer obligations.

## DPIA prompts (for your use case)

Answer these before deploying OpenAI in production:

1. **Are users likely to enter Article 9 special-category data** (health, biometric, criminal, religion, etc.) into the prompt? If yes, your lawful basis and safeguards must cover that — UI controls and staff training matter.
2. **Are you using the API or a consumer ChatGPT account?** If staff are using personal ChatGPT Plus, conversations may be retained and used for training. Your data governance must address shadow AI use.
3. **Is your use case in AI Act Annex III** (recruitment, credit, education, law enforcement, migration, justice, critical infrastructure)? If yes, you are a deployer of a high-risk system regardless of the underlying model. Conformity assessment, fundamental rights impact assessment, registration in the EU AI database — all apply.
4. **Have you configured EU residency** if you have EU subjects? Default API is not EU-resident.
5. **Have you applied for Zero Data Retention** if your data sensitivity warrants it? The 30-day default abuse-monitoring window is a real retention period.

## Unresolved questions / red flags

- **Consumer-tier shadow use is the biggest unmanaged risk.** Most SMEs have staff using ChatGPT Plus on personal accounts, which sit under consumer terms. The compliance posture of paid API / Enterprise is irrelevant to that traffic.
- **EU residency is not the default.** Buyers frequently assume "OpenAI Enterprise" implies EU processing; it does not unless configured.
- **Zero Data Retention is approval-gated.** The sales process can be slow. Plan timing.
- **DPF reauthorisation contested.** EU institutional debates are ongoing through 2026; a CJEU appeal on the framework's adequacy was filed October 2025 with a ruling expected late 2026 at earliest. DPF certification could be invalidated mid-cycle.

## Related profiles

- [Anthropic](/vendors/anthropic) — same general-purpose LLM category, different defaults
- [Microsoft 365 Copilot](/vendors/microsoft-365-copilot) — embeds OpenAI models with different EU Data Boundary commitments
- [Perplexity](/vendors/perplexity) — routes to OpenAI models, applying OpenAI's terms transitively

## Sources checked

- `https://trust.openai.com/` — checked 2026-04-29 (SOC 2, ISO 27001:2022, ISO 27017/27018/27701, ISO 42001, FedRAMP, PCI DSS)
- `https://openai.com/policies/sub-processor-list/` (last updated 2026-02-11)
- `https://openai.com/policies/data-processing-addendum/`
- `https://openai.com/enterprise-privacy/`
- `https://openai.com/business-data/`
- OpenAI API data usage and ZDR documentation
## Related reading

- [DPA for AI vendors](/topics/dpa-for-ai-vendors) — the eight clauses to check before signing any AI vendor DPA, OpenAI included
- [EU AI Act for AI buyers](/topics/eu-ai-act-for-ai-buyers) — deployer-side obligations for any UK or EU buyer running ChatGPT or the API
- [HIPAA for AI tools](/topics/hipaa-for-ai-tools) — BAA gate and Security Rule checklist for US healthcare buyers
- [OpenAI vs Anthropic DPA](/compare/openai-vs-anthropic-dpa) — head-to-head on the two most-asked-about API vendors
- [OpenAI vs Copilot enterprise compliance](/compare/openai-vs-copilot-enterprise-compliance) — direct ChatGPT Enterprise vs the Copilot route
- [Perplexity vs ChatGPT for regulated industries](/compare/perplexity-vs-chatgpt-regulated-industries) — research workflows with citation evidence trail

> **TL;DR.** Four distinct products: **Enterprise Pro / Enterprise Max** (no training, ZDR available, contractual); **Sonar API** (same enterprise posture); **consumer free / Pro** (training enabled by default unless opted out); **Comet** (agentic browser — much larger data-collection surface). Perplexity routes some workloads to underlying LLMs (OpenAI, Anthropic, plus first-party Sonar models) — terms apply transitively. **Search query strings themselves are often Article 9 data** in regulated sectors and most DPIAs miss this. HIPAA scope tightened February 2026.
>
> **DPO action:** distinguish surfaces in your AI inventory; address transitive dependencies on OpenAI / Anthropic; treat Comet as a separate vendor evaluation.

## What the tool does

Perplexity is an AI-powered answer engine. Instead of returning a list of links like a search engine, it crawls the web and synthesises a sourced answer. Buyers commonly evaluate one of four products:

1. **Perplexity (free / Pro consumer)** — at `perplexity.ai`, individual or team subscriptions
2. **Perplexity Enterprise Pro / Enterprise Max** — business-tier with admin controls and stronger compliance defaults
3. **Sonar API** — Perplexity's developer API for embedding answer-engine functionality into other products
4. **Comet** — Perplexity's agentic browser (separate product, separate compliance posture)

Compliance posture differs across these surfaces. Most enterprise buyers should be looking at Enterprise Pro or Sonar API, not the consumer tier.

## Data processed

- Search queries (which often contain context that is itself personal data)
- Documents uploaded for Q&A (Pro / Enterprise feature)
- Conversation history
- Files uploaded for analysis
- For Comet (browser): browsing history, page content, account credentials if sign-ins are stored

**Special-category likelihood:** **Medium-high.** Search queries are unusually revealing — a query string like "side effects of [drug] when pregnant" is itself special-category data. Free-form team usage will leak Article 9 categories regularly.

**Default geographic processing:** US-centric. Perplexity has been adding EU options for Enterprise tiers through 2026 — confirm current regional configuration with Perplexity sales before procurement decisions.

## DPA availability

Perplexity publishes a Data Processing Addendum.

- URL: `https://www.perplexity.ai/hub/legal/dpa`
- The DPA is incorporated into Perplexity Pro for Enterprise Terms of Service and Perplexity API Terms of Service
- Auto-incorporation model — by accepting Enterprise / API terms, the customer accepts the DPA

Consumer tier (free / Pro individual) does NOT auto-incorporate the DPA in the same way. Consumer use sits under the standard consumer Terms with weaker processor commitments.

## Subprocessor list

Perplexity publishes its subprocessor list at `https://trust.perplexity.ai/subprocessors` (also rendered inline on the trust portal landing page). First two listed: Amazon Web Services (cloud provider, US) and Microsoft Azure (cloud provider, US).

Notable architecture (which determines transitive subprocessing):

- **Sonar models** — Perplexity's first-party fine-tuned Llama derivatives running on Perplexity's own retrieval pipeline. No external LLM provider in the path.
- **Agent API / Agentic Research API** (launched 2026-03) — provides routed access to **[OpenAI](/vendors/openai), [Anthropic](/vendors/anthropic), Google, and xAI** models through a unified interface. **Using this API exposes you to all four providers' terms transitively.**
- **AWS or Google Cloud** — primary infrastructure
- Various analytics and support tooling

The multi-LLM Agent API is a genuine compliance complication: a buyer using it is in practice also accepting OpenAI's, Anthropic's, Google's, and xAI's terms transitively. Sonar-only deployments avoid this — confirm which API your integration uses.

## Training-on-customer-data position

**Enterprise Pro and Enterprise Max:** Customer data is **not used to train AI models**. Zero Data Retention (ZDR) is offered. This is contractual.

**Sonar API:** Same posture — no training, ZDR available. Configurable file retention.

**Free / Pro individual consumer tier:** **Default may include data being used for AI training, with opt-out available in user settings.** This is the same trap as ChatGPT consumer and consumer Gemini — staff using personal Pro accounts are in a training-eligible flow unless they've actively opted out.

**API log retention:** Configurable on Enterprise / Sonar. Default retention period changes periodically; confirm at review time.

> Enterprise / Sonar defaults are strong and on par with [Anthropic](/vendors/anthropic) / [OpenAI](/vendors/openai) enterprise tiers. Consumer-tier shadow use is the dominant unmanaged risk for any organisation with knowledge workers. — My read

## EU / UK transfer position

Perplexity relies on **Standard Contractual Clauses Module 2 (controller-to-processor) and Module 3 (processor-to-processor)** for EU transfers via the DPA. The DPA explicitly names the **International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.0) issued by the UK Information Commissioner** for transfers subject to UK GDPR. Perplexity is **certified under the EU-US Data Privacy Framework** including the **UK Extension to the EU-US DPF** — verified self-certification with the U.S. Department of Commerce as of 2026-05 (same DPF reauthorisation caveat as [OpenAI](/vendors/openai) and [Anthropic](/vendors/anthropic)).

EU data residency: confirm current options for Enterprise tiers. Default processing is US-resident.

## Security documentation

Per the trust portal at `https://trust.perplexity.ai/` (verified 2026-05-02):

- **SOC 2 Type 2** — yes (Enterprise Pro platform; report available through the trust portal)
- **ISO 27001** — **not publicly displayed**
- **ISO/IEC 42001** — **not publicly displayed.** Notable absence given that Anthropic, OpenAI, Microsoft, and Google all hold this certification
- **HIPAA** — yes; BAA available for qualifying healthcare customers (Enterprise tiers only). PHI is **expressly forbidden** without a BAA in place per Enterprise Terms updated February 2026
- **GDPR / UK GDPR** — yes, addressed in the DPA
- **PCI DSS — SAQ A** — yes
- **FedRAMP 20x Low** — yes (resource available in trust portal, gated)

Perplexity's security disclosures have been less comprehensive than Google's or Microsoft's. Audit-grade documentation is available through the trust portal but typically behind a registration gate.

## AI Act role + risk classification

- **Role:** Perplexity is a **provider** of an AI system (the answer engine). It is also a **deployer** of underlying GPAI models (OpenAI, Anthropic, etc.)
- **Your role as a buyer:** **deployer** of an AI system, with deployer obligations
- **Risk tier:** typical search / information-retrieval use sits at minimal or limited risk. Annex III applicability depends on what answers are being relied on for (e.g. if used in HR screening flows, high-risk obligations may apply)

Perplexity has not, as of 2026-05-01, published a comprehensive AI Act mapping for its products.

## DPIA prompts (for your use case)

1. **Which Perplexity surface are staff using?** Free, Pro individual, Pro for Enterprise, Sonar API, or Comet — each has a different compliance posture. Don't accept "we use Perplexity" as a sufficient inventory entry.
2. **Are search queries themselves a privacy concern for your sector?** Legal, healthcare, HR, compliance teams — query strings often expose case-level detail that the buyer didn't realise was being transmitted.
3. **Is the underlying LLM stack acceptable to you?** Perplexity routes through multiple model providers depending on plan and feature. Your DPA chain runs through Perplexity to those vendors transitively.
4. **Comet browser specifically:** if any staff use Comet, you have a much larger data-collection surface (full browsing history, page content) than the answer-engine product. Treat Comet as a separate vendor evaluation.
5. **AI Act Annex III applicability:** is the answer engine being used as decision-support in any Annex III process? If yes, deployer high-risk obligations engage.

## Unresolved questions / red flags

- **Agent API multi-LLM dependency** means a buyer's data flows through Perplexity to OpenAI / Anthropic / Google / xAI — four sets of terms apply transitively. Most procurement processes don't capture this. Sonar-only deployments avoid this — confirm which API your integration actually uses.
- **No public ISO 27001 or ISO/IEC 42001 certifications.** A real gap relative to peers. Perplexity has SOC 2 Type 2 and FedRAMP 20x Low, but ISO is the lingua franca of EU procurement. Raise it with Perplexity sales for any enterprise procurement.
- **Comet browser is a separate compliance surface** from the answer engine and is being rolled into Pro / Enterprise plans. Many buyers don't realise they've enabled it.
- **Search query content can itself be Article 9 data** in regulated sectors — the query string is a data flow most DPIAs underweight.
- **EU data residency options are evolving** — re-verify on each review.
- **Public subprocessor list URL has shifted** historically — flag if not findable.
- **HIPAA BAA scope was tightened February 2026** to forbid PHI without an active BAA — relevant for any healthcare customer.
- **Major publishers have publicly contested Perplexity's web crawling.** The exposure for buyers is reputational rather than contractual — relevant if your brand is sensitive to AI-content provenance debates.

## Related profiles

- [OpenAI](/vendors/openai) — sub-route LLM provider, terms apply transitively
- [Anthropic](/vendors/anthropic) — sub-route LLM provider, terms apply transitively

## Sources checked

- Perplexity DPA: `https://www.perplexity.ai/hub/legal/dpa` — referenced 2026-05-01
- Perplexity Enterprise: `https://www.perplexity.ai/enterprise` — referenced 2026-05-01
- Perplexity Help Center "Data Collection at Perplexity" — referenced 2026-05-01
- Perplexity Enterprise Terms of Service (last updated 2026-02-06 per public sources) — checked 2026-05-01
- HIPAA / PHI restriction effective March 2026 — per public Enterprise ToS updates
## Related reading

- [DPA for AI vendors](/topics/dpa-for-ai-vendors) — the eight clauses to check on any AI vendor DPA, applied to Perplexity Enterprise
- [EU AI Act for AI buyers](/topics/eu-ai-act-for-ai-buyers) — deployer-side obligations for Perplexity deployments
- [HIPAA for AI tools](/topics/hipaa-for-ai-tools) — the BAA position for Perplexity Enterprise vs the hyperscaler alternatives
- [Perplexity vs ChatGPT for regulated industries](/compare/perplexity-vs-chatgpt-regulated-industries) — the citation-evidence-trail advantage for research workflows

AI vendor profiles

Anthropic

ElevenLabs

Google Gemini

Microsoft 365 Copilot

OpenAI

Perplexity