GDPR compliant AI: security, locations and certificates.
NexPatch processes data in an EU data centre in Frankfurt am Main, under a data processing agreement pursuant to Art. 28 GDPR, with a documented deletion concept and complete logging. Technical measures include access controls, tenant separation and encryption. ISO 27001 and SOC 2 Type II certification are currently in the audit process; the date of certification will be published once it is complete.
01 Where processing happens
Your data is processed in a data centre in Frankfurt am Main, operated by an EU-based data-centre operator. Subcontractors who may have access to infrastructure or metadata as part of operations are named individually in the data processing agreement, not described only in general terms. A change of location or subcontractor is announced in advance, so you can make your own assessment.
02 Data processing agreement
The basis of our collaboration is a data processing agreement under Art. 28 GDPR, which sets out the scope, purpose and duration of processing. The deletion concept defines the period after which data from pilots, test operations or completed projects is removed, and documents this process so it can be traced. Access and processing steps are logged, so that, if needed, it can be reconstructed who accessed which data and when.
03 Technical measures
Access to systems and data follows the principle of least privilege: every person and every service receives only the rights needed for that specific task. Tenants are separated logically and, where required, physically, so that data from different customers cannot mix. Data is encrypted in transit and at rest. Security-relevant events are logged and reviewed regularly.
04 Certificates
A certificate alone says little if the audit body and validity date are missing. That's why we list both together.
| Certificate | Audit body | Status |
|---|---|---|
| ISO 27001 | independent certification body, to be named once confirmed | audit in progress, date not yet set |
| SOC 2 Type II | independent audit report over a defined period | audit in progress, date not yet set |
Once a certificate is granted, we will publish the audit body and issue date here, rather than just showing a badge.
05 Test criteria for sovereignty
The term "sovereign AI" gets used often and tested rarely.
These are the six questions we hold ourselves to, and we recommend asking them of any provider who talks about sovereignty.
- 1. In which country, and under which jurisdiction, is the hardware physically located?
- 2. Who, exactly, are all subcontractors with access to infrastructure or metadata, named individually?
- 3. Can models and data be operated with no connection at all to a provider outside the EU?
- 4. How, and within what period, is data fully deleted after the contract ends, and how is that proven?
- 5. What logs are available for you to review yourself, rather than staying internal to the provider?
- 6. What happens to operations and data if the provider discontinues the service or is acquired?
No competitor we have reviewed answers all six questions publicly. We do so deliberately here, so you can measure NexPatch and any other provider against the same standard.
06 Regulatory classification
Three European regulations are currently especially relevant for running AI in a company.
| Regulation | What it covers | Deadline |
|---|---|---|
| EU AI Act | Risk-based obligations for AI systems, staggered by risk class | Obligations phase in through 2027 |
| NIS2 | Cybersecurity requirements for operators of essential and important entities | German national transposition delayed; date not yet set |
| Data Act | Rules on data access and portability, including for connected products and cloud services | In effect since September 2025 |
This overview is not legal advice. Whether and to what extent individual obligations apply to your company is best clarified with your legal department or outside counsel; we are glad to provide the technical classification.
Frequently asked questions
More on the pricing packages that include these security measures is under pricing. Details on individual funding programmes that can also support security-relevant projects are under funding. Questions about implementation in your specific case are best clarified in an initial call.