The short answer
Chatbase says it is GDPR compliant, and it publishes the paperwork buyers expect from a processor: a Data Processing Addendum (DPA), the EU standard contractual clauses for transfers, a sub-processor list and a deletion deadline. Its main processing takes place in the United States. The DPA says so in as many words: "Company's primary processing operations take place in the United States" (Data Processing Addendum, read 25 October 2026).
The GDPR allows transfers on those clauses when their conditions are met. What US processing changes is how much is left for you to do: a transfer to document, a privacy notice that mentions it, and 20 sub-processors to check. The table below takes ten points in turn: what Chatbase publishes on each, where, and what to ask before you sign.
Note. Everything said here about Chatbase comes from its own public pages as they read on 25 October 2026, linked where they are used. Pages change, so check them again before you decide. We make ChatterLab, which competes with Chatbase, and we say where Chatbase is the better choice.
What "GDPR compliant" can mean for a chatbot vendor
For the conversations on your website you are, in the usual set-up, the controller and the chatbot vendor is your processor. The GDPR splits the work between you.
The vendor's share is set out in Article 28 of the GDPR. It processes the data only on your documented instructions, keeps it confidential and secure, brings in other processors only with your authorisation and tells you of changes so you can object. It helps you answer people's requests, deletes or returns the data when the service ends, and gives you what you need to verify all this, audits included. These terms belong in a written contract: the data processing agreement. When data goes to a third country such as the United States, Chapter V applies as well: a few narrow exceptions aside, the transfer needs an adequacy decision of the European Commission (Article 45) or appropriate safeguards (Article 46), such as the Commission's standard contractual clauses.
Your share stays with you. Article 28(1) makes it your duty to choose a processor that offers sufficient guarantees. You also need a lawful basis (Article 6), a privacy notice that names the recipients and any transfer to a third country (Article 13), an impact assessment where the processing is likely to be high-risk (Article 35), and a way to handle requests for access and erasure (Articles 15 and 17).
So a vendor's "GDPR compliant" can only speak for its own share. Chatbase says much the same: its 2024 announcement, as updated on 4 September 2026, now tells buyers that a provider's compliance statement is not where a GDPR review ends (Chatbase is now GDPR compliant, read 25 October 2026).
Ten points to check, and what Chatbase publishes on each
Two of our articles go deeper into the reasoning: whether a chatbot needs EU hosting and what a chatbot's data processing agreement should contain.
| Point | What Chatbase publishes | Chatbase page, read 25 October 2026 | What to ask or do |
|---|---|---|---|
| Roles and DPA | A Data Processing Addendum that supplements its Terms of Service. You enter into it by accepting the terms, and its standard contractual clauses count as signed at that point. Chatbase is your processor, or your sub-processor when you serve clients of your own. For account and usage data it is a controller itself. No version date for the DPA was found on its public pages as of 25 October 2026. | DPA, opening paragraph and sections 2, 6 and 9 | Keep a dated copy of the version you accept. If your law requires the clauses as a separate signed document, the DPA says Chatbase signs them on request. |
| Where data is processed | Mainly in the United States. The privacy policy names AWS us-east-1 for the database and the application, managed by Supabase and Vercel. Chatbase's own comparison of GDPR platforms says its public documentation lists no EU data-residency option. | DPA section 6; privacy policy; comparison | If a contract or internal policy requires EU-only storage, ask in writing whether any option exists. None was found on its public pages as of 25 October 2026. |
| Sub-processors and where they are | 20 sub-processors on its Trust Center list. The 8 that carry a location all say United States, among them OpenAI, Anthropic, Google Gemini, Supabase and Vercel. The other 12 carry none, among them Stripe, Twilio, Mistral, Groq and ElevenLabs. A new sub-processor is announced to subscribers at least 10 days before it starts, with 10 days to object; a customer who does not subscribe waives prior notice. | Sub-processor list; DPA section 4.2 | Subscribe to the notices. Ask where the 12 without a location process data, and which of the 20 receive your visitors' messages for the model you choose. |
| Transfer mechanism | The EU standard contractual clauses of 4 June 2021 (Decision 2021/914), with the controller-to-processor and processor-to-sub-processor modules, under Irish law and Irish courts. A section on supplementary measures covers requests from government agencies. A mention of the EU-US Data Privacy Framework was not found on its public pages as of 25 October 2026, and a search of the Data Privacy Framework List that day found no entry for Chatbase. | DPA section 6; privacy policy | You are the exporter, so the transfer assessment is yours to document. Ask Chatbase for its input, and how the onward transfer to each AI provider is covered. |
| Training on your data | Chatbase says it does not use customer data to train, retrain or fine-tune any AI model, on any plan, and that it uses model providers' APIs without opting into their data-sharing programmes. It lists zero data retention as an Enterprise feature. | Pricing and security FAQs; comparison | Ask which contract clause says so, and how long the model providers keep prompts on your plan. |
| Retention and deletion | The DPA promises deletion within 30 days of a written request or of the contract ending, backups and sub-processors' copies included. In the dashboard you can delete all of an agent's conversations, and you can let visitors delete their own. Outside its HIPAA workspaces, an automatic retention period for chat conversations was not found on its public pages as of 25 October 2026. | DPA section 2.4; settings, channels and HIPAA docs | Decide your own retention period and who deletes what, and when. Ask whether a period can be set per agent. |
| Security certifications | SOC 2 Type II. Its Trust Center lists a 2026 SOC 2 Type II report and a third-party penetration test, both on request. HIPAA-eligible Enterprise workspaces with a business associate agreement. | Security page; Trust Center resources | Request the report and check the period and systems it covers. SOC 2 does not make a product GDPR compliant, as Chatbase's own comparison says. |
| Staff and support access | Production access requires two-factor authentication, and roles and permissions limit who can reach sensitive data. Where the staff who can access customer data are based was not found on its public pages as of 25 October 2026. | DPA exhibit C; privacy policy | Ask who at Chatbase can read your conversations, from which countries, and whether that access is logged. |
| AI Act notice | Its GDPR guide tells EU deployments to account for the AI Act's disclosure rules and suggests a line saying the visitor is chatting with an AI. The chat bubble has a dismissable notice above the input, up to 200 characters, which disappears once the visitor sends a message, and a footer below it. A description of a built-in AI notice was not found on its public pages as of 25 October 2026. | GDPR guide; channels docs | Write the notice yourself, in your visitors' language, and check that it shows before the first message. Article 50 of the AI Act asks that people are told at the latest at the first interaction (what it requires). |
| EU-based contact | An EU representative under Article 27 of the GDPR: Prighter Germany GmbH in Berlin, with Prighter Ltd in London for the UK. The company itself is Chatbase Inc. in San Francisco, and its terms are governed by Delaware law. | Privacy policy; terms section 10.10 | The representative is a point of contact, not the party you contract with. Disputes under the clauses go to Irish courts, under the terms to Delaware. |
Where Chatbase is the better choice
On several points that matter to buyers, Chatbase publishes or offers more than we do. From its pages as read on 25 October 2026:
- Security evidence for procurement. A 2026 SOC 2 Type II report and a third-party penetration test, both on request (Trust Center). ChatterLab has no SOC 2 report.
- US healthcare. HIPAA-eligible Enterprise workspaces with a business associate agreement (security page). ChatterLab is not HIPAA-eligible.
- Channels. Besides website chat, its documentation lists e-mail, phone, Slack, WhatsApp, Messenger and Instagram (channels). ChatterLab answers in the chat widget on your site, with no voice and no WhatsApp.
- Integrations. Its plans include connections to Zendesk, Salesforce, HubSpot, Intercom, Freshdesk, Shopify and Stripe, among others (pricing).
- Paperwork you can read before you sign up. Its full DPA is public and comes with the terms, with a 30-day deletion deadline that covers backups and at least 10 days' notice to subscribers before a new sub-processor starts. Our DPA is sent on request, and our public pages give no period for how long deleted data stays in backups and do not describe advance notice of a new sub-processor.
- Scale. Chatbase says more than 10,000 businesses use it (security page).
If several of these decide it for you and EU-only storage does not, Chatbase is the better fit, and the US transfer becomes a documented step rather than an obstacle.
How ChatterLab answers the same ten points
This is our own product, so read it as a vendor describing itself. Each line is taken from our documentation and public pages, mostly Data and privacy.
| Point | ChatterLab |
|---|---|
| Roles and DPA | You are the controller and we are your processor. For an agency, its client is the controller, the agency their processor, and we are the agency's. A data processing agreement is sent on request: write to management@sri-group.eu. There is none to sign inside the product yet. |
| Where data is processed | The application runs on Vercel in Frankfurt, Germany. Agents, sources and conversations are in a Neon database in the EU, files in Cloudflare R2 under EU jurisdiction, and answers are written through Cortecs, a European model gateway. Two steps run in the United States: turning text into search vectors (OpenAI) and sending e-mail (Resend). |
| Sub-processors and where they are | Named in the documentation, with what each one handles and, for those that touch your visitors' data, where. Our privacy notice is updated when who processes data changes; advance notice of a new sub-processor, with a chance to object, is not described on our public pages. Ask for it with the DPA. |
| Transfer mechanism | Resend works under the EU-US Data Privacy Framework and standard contractual clauses. OpenAI works under its data-processing terms; our documentation does not say which transfer tool those use, so ask for it with the DPA. |
| Training on your data | We do not train models on your content or your conversations, and OpenAI does not use this data to train its models. What Cortecs, which writes the answers, and the model providers it routes to may keep or use is not described in our public documentation: ask for it with the DPA. |
| Retention and deletion | Conversations stay until you delete them or the agent; nothing deletes them automatically. Files visitors send are kept 30 days and contact details 3 years. IP addresses are not stored. Deleted data stays a while in our database host's backups, and the documentation gives no period. |
| Security certifications | No SOC 2 report. Our security documentation describes the measures. |
| Staff and support access | Not described in our public documentation. Ask us. |
| AI Act notice | Built in, in the widget's language, on every plan, and no setting removes it. Answers are marked as AI-generated in the page's code (our AI Act page). |
| EU-based contact | SRI Group BV in Antwerp, Belgium, runs ChatterLab (privacy notice). |
The two differ in where the data sits and in how the paperwork reaches you. Chatbase processes in the United States under the standard contractual clauses and publishes its full DPA; ChatterLab stores conversations, sources and files in the EU, names its two US steps and sends its DPA on request. Neither makes your own share of the work go away. Chatbase fits a team that needs its channels, integrations or certifications and is ready to document a US transfer. ChatterLab fits a team that wants EU storage and a built-in AI notice, and can do without voice, WhatsApp and a SOC 2 report. Prices and features side by side are on our Chatbase comparison page, and the same facts about us in short on our GDPR page.
Why EU hosting is not the only question
Chatbase's guide to chatbot GDPR compliance argues that the GDPR does not require every chatbot to keep its data only in the EU (GDPR guide, read 25 October 2026). That is correct. Chapter V allows a transfer to a country without an adequacy decision when appropriate safeguards are in place, and Article 46(2)(c) names the Commission's standard contractual clauses as one of them. What US processing changes is the work around the transfer:
- You document the transfer. When a transfer rests on the clauses, the exporter, which is you, checks whether the law and practice of the destination country could undermine them, and adds measures where needed. The EDPB's Recommendations 01/2020 set this out in six steps and ask for the assessment to be documented. For the United States, the European Commission says that the US national-security safeguards behind the EU-US Data Privacy Framework apply to all transfers to US companies, whatever the transfer tool, and so also facilitate the use of standard contractual clauses. The adequacy decision behind that framework remains in force: the General Court dismissed an action to annul it on 3 September 2025 (case T-553/23), and an appeal was pending before the Court of Justice on 25 October 2026 (case C-703/25 P).
- Your privacy notice says so. Article 13(1)(f) asks you to tell visitors that their data goes to a third country, on which safeguard, and how they can obtain a copy of it. An example follows below the list.
- You check every recipient, not only the host. The database can sit in one place and the model in another. Of the 20 sub-processors on Chatbase's list on 25 October 2026, 12 showed no location.
- Some buyers need EU storage anyway. A client contract, a public tender or an internal policy can require it, whatever the GDPR allows. Chatbase's own comparison (read 25 October 2026) tells teams with such a rule to treat its US processing as a constraint.
- EU hosting does not settle everything either. An EU-hosted vendor can still send text to a US service. ChatterLab does, for search vectors and e-mail, which is why the same ten points apply to every vendor, us included.
For point 2, an example sentence for a site that uses Chatbase, to adapt with your own adviser:
Our website chat is provided by Chatbase Inc., which processes your messages on our behalf in the United States. This transfer is covered by the European Commission's standard contractual clauses. You can ask us for a copy at (your privacy contact address).
The rest of the notice, from what the chat stores to how long it is kept, is covered in our chatbot privacy notice template.
Questions about Chatbase and the GDPR
Does Chatbase sign a DPA?
As of 25 October 2026, Chatbase publishes a Data Processing Addendum that supplements its Terms of Service. You enter into it by accepting those terms, which also counts as signing the EU standard contractual clauses inside it. Chatbase acts as your processor, or your sub-processor when you serve clients. If your law requires the clauses as a separate document, the DPA says Chatbase will sign them on request. No version date for it was found on its public pages as of 25 October 2026, so keep a dated copy.
Where does Chatbase store my data?
In the United States. As of 25 October 2026, its DPA says its primary processing takes place there, and its privacy policy names AWS us-east-1 for the database and the application, managed by Supabase and Vercel. Of the 20 sub-processors in its Trust Center, the 8 that carry a location all say United States. Chatbase's own comparison says its public documentation lists no EU data-residency option.
Is Chatbase safe to use in the EU?
Safe is not a legal test, so it depends on your requirements. As of 25 October 2026, Chatbase publishes a DPA with the standard contractual clauses, and its security page says it holds SOC 2 Type II, encrypts data at rest and in transit, and does not train models on customer data. It processes data in the United States. If you need EU-only storage, no such option was found on its public pages as of 25 October 2026; otherwise your open work is the transfer assessment and your privacy notice.
Does Chatbase train on my data?
Chatbase says it does not. Its pricing page states that customer data is not used to train, retrain or fine-tune any AI model, on any plan, and its security page says it uses model providers' APIs without opting into their data-sharing programmes (both read 25 October 2026). It lists zero data retention as an Enterprise feature. If training matters to your review, ask which clause of the contract covers it.
Can I use Chatbase and stay GDPR compliant?
It can be done: the GDPR allows a processor in the United States when the transfer rules of Chapter V are met, and Chatbase's DPA, as read on 25 October 2026, includes the standard contractual clauses for that. The rest is on your side: a lawful basis, a privacy notice that names the US transfer and its safeguard, a documented transfer assessment, a chat that collects no more than it needs, and a way to answer access and erasure requests. No vendor does those parts for you.
What are the alternatives to Chatbase?
If EU storage is a requirement, compare vendors that keep data in the EU. ChatterLab stores conversations, sources and files in the EU and names the two steps that run in the United States: search vectors and e-mail. Whichever vendor you consider, put the same ten questions to it, because an EU host does not settle sub-processors, training or deletion by itself. Our comparison page sets prices and features side by side.
Sources
- Data Processing Addendum, Chatbase, read on 25 October 2026.
- Privacy Statement, Chatbase, last updated 18 October 2026, read on 25 October 2026.
- Terms of Service, Chatbase, read on 25 October 2026.
- Secure AI customer service, from data to deployment, Chatbase, read on 25 October 2026.
- Chatbase's Trust Center: Subprocessors and Resources, Chatbase, read on 25 October 2026.
- Pricing, Chatbase, read on 25 October 2026.
- Channels, Settings and HIPAA compliance, Chatbase documentation, read on 25 October 2026.
- Chatbase is now GDPR compliant, Chatbase, 18 March 2024, last updated 4 September 2026, read on 25 October 2026.
- Chatbot GDPR Compliance: What to Configure Before You Launch, Chatbase, 1 October 2026, last updated 8 October 2026, read on 25 October 2026.
- 7 Best GDPR-Compliant AI Customer Service Platforms in 2026, Chatbase, 3 September 2026, last updated 1 October 2026, read on 25 October 2026.
- Regulation (EU) 2016/679 (General Data Protection Regulation), Official Journal of the European Union, read on 25 October 2026.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act), Official Journal of the European Union, read on 25 October 2026.
- Standard Contractual Clauses (SCC), European Commission, read on 25 October 2026.
- EU-US data transfers, European Commission, read on 25 October 2026.
- Commission Implementing Decision (EU) 2023/1795 (EU-US Data Privacy Framework), Official Journal of the European Union, read on 25 October 2026.
- Case T-553/23, Latombe v Commission, General Court, judgment of 3 September 2025, read on 25 October 2026.
- Case C-703/25 P, Latombe v Commission, Court of Justice of the European Union, read on 25 October 2026.
- Data Privacy Framework List, US Department of Commerce, searched on 25 October 2026.
- Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, European Data Protection Board, version 2.0 of 18 June 2021, read on 25 October 2026.
How this was made: drafted with AI, then checked against how ChatterLab actually works and against the sources listed in the article. Spotted an error? Write to management@sri-group.eu.