Is my data secure?

The key facts about data security at MeinGPT at a glance

Yes, your data is secure. Here are the key facts about data security at MeinGPT at a glance.

Tip

Maximum security: Made & hosted in Germany with strictest data protection standards and EU-wide GDPR compliance.

🛡️ Key Security Facts

These are the three questions we get asked most often, with short answers and the facts behind them.

Where is my data processed?

With DPA 2.0, all AI models run in the EU; you can see the hosting location of each model in the model overview, and administrators release or block models organisation-wide. Without DPA 2.0, models that process data outside the EU are marked in the model picker. Processing outside the EU/EEA takes place only on your company's documented instruction, for example when an administrator actively selects a model or integrated service located outside the EU/EEA. Platform hosting is primarily in Germany, with a German provider (Hetzner) per our sub-processor list, and all subcontractors are GDPR compliant.

Who has access to my data?

Your company, as the controller, stays in control of your data. Access is restricted by a role-based access concept, support access is limited to what is technically necessary, your data is not used for AI training, and transfers are encrypted with TLS.

Can I delete my data?

Yes. Your administrator requests the deletion of your account from MeinGPT support; you can't delete your account yourself. Deletion takes effect in the live system immediately. Data is removed from backups within 30 days at the latest, as set out in the data processing agreement (DPA) and the privacy policy. We provide proof of deletion on request. Data we must keep for legal reasons, such as invoices and logs, is retained.

🔐 Technical Security

On the technical side, we rely on several independent layers of protection – from transmission to infrastructure to software:

Encryption:

  • 🔐 TLS 1.3 for all data transfers
  • 🔑 AES-256 for data storage
  • 🛡️ Customer Managed Keys upon request

Infrastructure:

  • 🏢 ISO 27001 certified data centers
  • 🔥 WAF & DDoS protection against attacks
  • 📊 24/7 monitoring with automatic alerts

Software:

  • 🔍 Regular security audits by third parties
  • 🛠️ Automatic updates of critical security patches
  • 🎯 Zero-Trust Architecture with minimal permissions

⚖️ Legal Protection

We're covered on two fronts here: externally audited, and equipped with the full set of GDPR data subject rights.

GDPR Compliance:

  • 🏛️ External Data Protection Officer - heyData GmbH
  • 📋 Data Processing Agreements for all partners
  • 🔍 Regular compliance audits

Your Rights:

  • 📋 Information - Complete data overview upon request
  • ✏️ Correction - Correction of incorrect data
  • 🗑️ Deletion - Right to be forgotten
  • 📤 Data portability - Export in standard formats

🤖 AI-specific Security

Protection continues when external AI models are involved too – both against misuse and through transparency about the providers we use.

Protection against misuse:

  • 🚫 No sharing with OpenAI - Azure OpenAI EU Zone without OpenAI access
  • 🔒 Enterprise APIs - No access to consumer services
  • 🛡️ Zero Data Retention - No permanent copy of your inputs at the model provider
  • 🎯 Content Filtering - Automatic detection of problematic content

Transparency:

💼 For Businesses

Businesses with their own compliance requirements get additional support and configuration options:

Compliance Support:

  • 📄 Request DPA - Data Processing Agreements
  • 🏢 Enterprise Features - OnPremise Outpost available
  • 📊 Audit Reports - Detailed compliance reports
  • 🎯 Individual Configuration - Customized privacy levels

Industry-specific requirements: For industries with particularly strict requirements – such as healthcare, government, or finance – the workspace can be restricted to EU-hosted models only, and we offer on-premise operation. See Provider Selection and Outpost for details.

🔍 Common Security Questions

Can the US government access my data?

Your data stays in the EU, provided only EU-hosted models are enabled. An administrator controls which models are available in the workspace settings and can disable all non-EU-hosted models there.

What happens in case of a data breach?

Our approach: We inform your company, as the controller, without undue delay, take the measures needed to secure the data and mitigate possible consequences, and ask for further instructions.

How secure are my chat histories?

High security: TLS-encrypted transfer and encrypted storage of chat history, role-based access, no permanent storage with AI providers.

Is my data processed in the USA?

Depends on your model selection: With DPA 2.0, all models run in the EU. Processing outside the EU/EEA takes place only on your company's documented instruction, for example when an administrator actively selects a model or integrated service located outside the EU/EEA; it is then safeguarded under Art. 44 et seq. GDPR, for example by an adequacy decision or appropriate safeguards.

Note

More questions? Contact our Data Protection Officer at datenschutz@heydata.eu or use our live chat.

🔗 Detailed Information

Was this page helpful?