AI Assistant on Your Own EU Server vs. US Cloud: What GDPR Requires for Your Business Inbox
AI assistant for your inbox on your own EU server or in a US cloud? What GDPR, the DSK and the AEPD require: DPA, transfers and no training on your data.
Key takeaways
- GDPR does not ban a US cloud, but the transfer needs a legal basis such as the EU-US Data Privacy Framework or standard contractual clauses.
- Every provider that processes your customer emails needs a written data processing agreement under Art. 28 GDPR.
- The German DSK separates closed AI systems, where you control the data, from open systems that risk reusing it.
- Staff pasting customer emails into a personal chat account is a bigger problem than where the server sits.
- With your own assistant you check three places: your mailbox, the assistant's server and your account with the AI provider.
An AI assistant on an EU server under GDPR is not a free pass, and a US cloud is not automatically forbidden. What matters is where your customer emails are processed, whether each of those places is covered by a data processing agreement, and whether any data leaving the EU has a basis under Chapter V GDPR. The Verselo AI assistant runs on a dedicated, isolated EU server just for your company, and we lay out exactly those places before you start.
Why do employees paste customer emails into ChatGPT, and what is the GDPR problem with that?
A made-up example. A property management firm with twelve people. A tenant sends a long complaint about mould, with name, address and phone number. The clerk pastes it into her personal ChatGPT account and asks for a polite reply. The reply is good. The company has no idea it happened.
The AI is not the problem. The missing contract is. Art. 28 GDPR requires a written data processing agreement (DPA) with every provider that processes personal data on your behalf. A personal account has none. On top of that, free and personal plans may use what you type for training, depending on the settings.
How to spot this and raise it with your team is covered in shadow AI in the workplace. What separates the ChatGPT plans is in Is ChatGPT GDPR compliant?.
Pasting emails into a public chat vs. a dedicated AI assistant on your own EU server: what changes day to day and for data protection?
The German data protection conference (DSK) separates two kinds of system in its guidance on AI and data protection of 6 May 2024. In closed systems you control what goes in and comes out, and the provider is not set up to keep training on that data. Open cloud systems carry the risk that inputs are reused for other purposes, and they often involve transfers to third countries.
| Pasting the email into a personal chat | Dedicated assistant on an EU server | |
|---|---|---|
| Contract with your company | None, personal account | DPA for running the assistant |
| Who decides what is sent | Each employee | Fixed rules you set |
| Training on your emails | Possible, depending on plan and settings | Business account with the AI provider only, no training |
| Where the reply ends up | In the chat, copied back by hand | As a draft in your mailbox |
| Traceable for the company | No | Yes, every rule change is saved |
The day-to-day difference is just as large. In a chat window someone copies one email at a time and explains the context again and again. Your own assistant reads the mailbox directly and leaves the reply in your tone as a draft.
Which data actually leaves the EU when an AI assistant answers your emails?
Honesty pays here, because a line like "everything stays in the EU" rarely survives a review. Email text is processed in three places.
Your mailbox. Your emails stay where they already are: Gmail, Microsoft 365 or your IMAP provider. For Microsoft 365, Microsoft commits under its EU Data Boundary to store and process customer data of tenants with an EU or EFTA sign-up location in EU and EFTA datacenters, with documented exceptions. Before you start, check the current status and your tenant's configuration.
The assistant's server. It sits in the EU and belongs to your company alone. It only remembers facts you have confirmed.
The AI provider. To draft a reply, the assistant sends the text it needs to your own business account with the AI provider. Whether that text leaves the EU depends on the provider and your contract. That is the real question to check.
Data going to the US is not unlawful in itself. With Implementing Decision (EU) 2023/1795 of 10 July 2023, the European Commission found that US organisations certified under the EU-US Data Privacy Framework provide an adequate level of protection. If a provider is not certified, you need other safeguards such as standard contractual clauses.
What do GDPR, the German DSK and the Spanish AEPD actually require: processing agreement, third-country transfers, no training on your data?
For a company with 5 to 50 staff it comes down to four points (not legal advice):
- A DPA with every processor. With whoever runs the assistant and with the AI provider, as Art. 28 GDPR requires. For running the assistant you sign a DPA with Verselo.
- A basis for every transfer outside the EEA. Chapter V GDPR (Art. 44 to 46) allows such transfers only on an adequacy decision or appropriate safeguards. The Spanish authority AEPD points out that when you rely on standard contractual clauses, since the Schrems II ruling you have to assess the laws of the destination country and may need supplementary measures.
- No training on your emails. Check the terms of your plan in writing. One example: Anthropic states in its Privacy Center that by default it does not use inputs or outputs from its commercial products, such as business plans and the API, to train its models, unless the customer explicitly reports feedback or opts in.
- Data subject rights. The DSK reminds you that an AI provider acting as processor must help you answer access and erasure requests (Art. 28(3)(e) GDPR). If a tenant asks what happened to their email, you need an answer.
Professional firms often carry extra confidentiality duties. What that looks like for a tax practice is on the page AI assistant for tax advisors.
How do you assess in 14 days whether an AI assistant fits your company's data protection requirements?
- A 30-minute call. You show us what lands in your inbox. We tell you honestly whether the assistant pays off and which places your data protection officer will want to see.
- Setup. We set up your dedicated EU server and connect mailbox and calendar. You sign the DPA with us, and we go through the three places where email text is processed.
- Two weeks of drafts. The assistant sends nothing on its own. Every reply sits as a draft in your mailbox, and you approve it.
- Automation on your terms. After about 14 days you decide, email type by email type, what may go out automatically. Prices and commitments stay drafts.
When is it not worth it? If only a few customer emails reach your inbox each day. Then giving the team a business account with clear rules is enough. More on the server and access rights is on our security page.
Conclusion
EU server or US cloud, GDPR asks about contracts and legal bases rather than labels: a DPA with every provider, a basis for every transfer outside the EU and no training on your emails. A dedicated assistant on an EU server keeps those places few and easy to check. What it would look like for your inbox is something we can go through in a 30-minute call.
Frequently asked questions
Can an AI assistant in a US cloud process my customer emails?
In principle yes, if the transfer has a basis under Chapter V GDPR. That can be the adequacy decision for the EU-US Data Privacy Framework, if the provider is certified, or standard contractual clauses. You also need a data processing agreement.
Is it enough that the assistant's server is in the EU?
Not on its own. Check every place where email text is processed: your mailbox at your email provider, the assistant's server and the AI provider that drafts the reply. Each needs a contract, and a transfer basis if data leaves the EU.
Will my emails be used to train an AI model?
That depends on the AI provider's plan. Many providers exclude training on business plans and the API by default, but not always on free personal accounts. Check the terms of your plan in writing.
What will my data protection officer want to see before we start?
A list of the places where emails are processed, the data processing agreements, the basis for each transfer outside the EU and a statement that your data is not used for training. At Verselo we go through these points with you before the start.