Built for an approver who is a lawyer.

The spine of the pilot is a defensible lawful basis and EU residency throughout. Everything below is written to be read by your counsel before anything goes live, not after.

Three routes that work. You pick one.

The only component with a real choice in it is where the model runs. Everything else stays EU-hosted regardless of which of these you take.

Option A

Self-hosted, in the EU

EU · GDPR boundary
Your data
app + database
→
Model
on EU GPUs

Data never leaves EU-controlled servers, model included. The strictest option, and the easiest to defend on paper.

StrictestModel quality: good
Option B

EU-resident router

EU · GDPR boundary
Your data
app + database
→
Router
GDPR terms
→
EU providers
resident

Inference stays with EU-resident providers, chosen through one contracted router. Balances control against model quality.

BalancedModel quality: better
Option C

Major provider, under a DPA

Legal cover · DPA + SCCs
Your data
app + database, EU
→
Major provider
no-training terms

Already GDPR-compliant for business use, covered by a DPA plus Standard Contractual Clauses. Best model quality, with the cover contractual rather than geographic.

Contractual coverModel quality: best

The model runs on one of three GDPR-workable routes, chosen with you. Your application and database stay EU-hosted in all three.

What we commit to in writing.

Four things, none of them conditional on how the pilot goes.

Lawful basis

Legitimate interest, with a documented assessment. Existing-relationship contacts are worked first, which is also the strongest part of the base.

Your data stays yours

Never used for another client. Never used to train any external model. Both are contractual, not a policy page.

Opt-outs and disclosure

Opt-outs honoured across every channel, immediately and permanently. AI disclosed wherever a person would reasonably want to know.

Stop anytime

We return or delete every record within thirty days, confirmed in writing. There is no lock-in mechanism to argue about later.

Sub-processors.

The full list, so your counsel can check it early rather than at signature.

ProviderRoleLocation
Hetzner Application hosting and data storage. EU · Germany / Finland
Model inference Drafting and research. Route chosen with you: self-hosted EU, an EU-resident router, or a major provider under a DPA. EU, or covered by SCCs
Sending Email and LinkedIn, on your own domains and accounts. Your infrastructure
Grounded in the primary sources rather than a vendor summary: GDPR Art. 6(1)(f) and Recital 47, EDPB guidance, the ePrivacy Directive, Malta's IDPC, and the EU Standard Contractual Clauses.

Counsel welcome, and expected.

We would have your lawyer review the lawful-basis approach, the DPA and the hosting route before launch, not after the first send. A one-page mutual NDA and a short DPA are the only paperwork needed to start that review.

What we are taking as given.

Four assumptions sit under the pilot. If any of them turn out to be wrong, the plan changes, so they are better checked now than in week three.