How we check vendor data statements
What we record
We only record public statements by the vendors, for example from privacy policies, data processing agreements, help centres and trust centres. For every statement we keep the source, a verbatim quote and the date of our check.
For each plan we record: storage location of customer data, location of AI processing, availability of a data processing agreement (Art. 28 GDPR), the basis for transfers to third countries and the use of inputs for training. We also note whether a tool can be self-hosted and whether its group is based outside the EU.
Where the information appears
The “Data in the EU” overview sits in the menu under “Find tools” and is the same in every language for every visitor, regardless of location. Every tool page has a “Data & privacy” box.
Only the vendor's own pages count as sources (website, help centre, trust centre, DPA, terms, documentation). We do not use blogs, comparison sites or other third-party sources. Hints from the submission form are only taken over after we have checked the vendor's page.
Where no checked information exists yet, the box says “No vendor information recorded yet”. Where we checked the vendor's pages and found nothing, it says “No vendor information found” with the check date. Neither is a statement about the actual data processing.
For checked tools the box shows further rows: sub-processors, transfers outside the EU, retention, audits and certificates the vendor names, and professional secrecy (Section 203 German Criminal Code). Each row summarises in the page language what the vendor writes, with a link to the vendor page and the check date; we keep the verbatim quote as evidence; where nothing is stated it says “No vendor information found”. We only list audits and certificates (e.g. ISO/IEC 27001, SOC 2, BSI C5) that the vendor names for this product; announced or ongoing audits are left out. We do not rate audits or contracts.
In the submission form, vendors and users can optionally add six answers (storage location, DPA, training, sub-processor list, retention, audits and certificates named), each with a link to the vendor's page. These answers are never published automatically. Transfers outside the EU and professional secrecy are added by the editors only.
The four levels
EU by default: per the vendor, data is stored in the EU by default, a data processing agreement is available, and inputs are not used for training or training is off by default in the business plan.
EU selectable: per the vendor, EU storage or EU processing can be selected in this plan, and a data processing agreement is available.
Non-EU with contract: per the vendor, processing also takes place outside the EU and is contractually safeguarded, for example through standard contractual clauses or the Data Privacy Framework.
Not established: one of the statements is not documented, the vendor offers no data processing agreement, or inputs are used for training by default. This does not state that a use is impermissible.
What the levels do not mean
The levels are not a seal and not an assurance. We do not confirm that a tool meets the requirements of the GDPR. Whether a use is permitted depends on the purpose, the legal basis, the data processed and your own measures. This page is not legal advice; if in doubt, please consult your data protection officer or a lawyer.
An EU storage location alone does not say whether parties outside the EU can access data.
Updates and corrections
Every statement shows its check date. If a statement is older than six months, we say so. If a vendor changes its terms, the level may change.
Vendors and readers can submit corrections with evidence via our contact form. We check the evidence and update the statement with a new check date.
Independence
We work independently. Revenue, for example from advertising or partner links, does not affect selection, order or the level we assign for data handling. We label paid content and partner links as “Advertisement”.