Building AI applications that connect to external tools and services is complex enough without worrying about data privacy regulations. Yet for any team serving European customers, GDPR compliance isn't optional—it's the price of admission to the market.
We're excited to announce that Klavis AI has achieved full GDPR compliance. This milestone represents months of infrastructure work, security audits, and architectural decisions that fundamentally changed how we handle customer data.
Here's what changed, why it matters for your AI applications, and what you need to know about data privacy in the MCP ecosystem.
The Infrastructure Migration That Made It Possible
GDPR compliance isn't just about privacy policies and consent forms. For a platform like Klavis AI that processes customer data through over 80 MCP server integrations, it required a complete rethinking of where and how we store information.
The biggest change? We migrated our entire primary data infrastructure from US-based hosting to EU-region providers. This wasn't a simple lift-and-shift operation—it involved:
- Moving production databases to Google Cloud Platform EU regions
- Transitioning authentication systems to Supabase EU
- Rearchitecting data flows to minimize cross-border transfers
- Implementing geographic routing for API requests
The result? The vast majority of data from European customers never leaves EU jurisdiction. When international transfers are necessary (for example, payment processing through Stripe or analytics), we now use Standard Contractual Clauses (SCCs) with additional security measures like end-to-end encryption and EU-based access proxies.
Breaking Down Our Compliance Framework
GDPR has 99 articles covering everything from legal grounds for processing to data subject rights. The Probo assessment evaluated Klavis AI across nine core requirement areas. Here's how we stack up:
| GDPR Requirement | Status | Key Implementation |
|---|---|---|
| Accountability & Governance | ✅ Compliant | Complete Record of Processing Activities (RoPA) |
| Lawful Basis for Processing | ✅ Compliant | Contract performance, legitimate interests, consent |
| Transparency | ✅ Compliant | Comprehensive privacy policy |
| Data Subject Rights | ✅ Compliant | Documented procedures for access, deletion, portability |
| International Transfers | ✅ Compliant | EU hosting + SCCs with Transfer Impact Assessment |
| Security of Processing | ✅ Compliant | SOC 2 Type 2 certified controls |
| Processor Relationships | ✅ Compliant | DPAs with GCP, Supabase, Stripe, and all vendors |
| Breach Notification | ✅ Compliant | 72-hour incident response procedures |
What makes this particularly relevant for developers: every one of these requirements applies to your application if you're using Klavis AI to connect to tools that process European user data. Our compliance status gives you a strong foundation, but you still need to handle your application layer appropriately.
The Five Data Processing Categories at Klavis AI
Understanding what data we process—and why—is central to GDPR compliance. The Probo assessment identified five distinct processing categories in our platform:
1. AI MCP Integrations
This is the core of what Klavis AI does: facilitating connections between your AI agents and external services. When your agent accesses GitHub, Gmail, or Linear through our MCP servers, we process:
- OAuth tokens and API credentials
- Request/response metadata
- Integration configuration data
- Usage logs for rate limiting
2. Customer Support and Communications
Standard business communications through email and our Discord community. This includes:
- Support ticket contents
- Feature requests and bug reports
- Community discussion participation
3. Payment Processing
We handle subscriptions through Stripe, which means processing:
- Billing email addresses
- Transaction records
- Subscription status
4. Analytics and Monitoring
Service performance tracking to maintain reliability:
- API usage patterns
- Error rates and system logs
- Performance metrics
SOC 2 Type 2: The Security Foundation
GDPR Article 32 requires "appropriate technical and organizational measures" to protect personal data. That's deliberately vague—what's "appropriate" depends on the risks involved.
For Klavis AI, we backed up our security claims with a SOC 2 Type 2 audit, which validates that our controls don't just exist on paper—they're actually working as intended over time. The audit covered:
Technical Controls:
- Encryption in transit (TLS) and at rest
- Multi-factor authentication for all admin access
- Role-based access controls following least-privilege principles
- Comprehensive logging and monitoring
- Regular vulnerability scanning and patch management
Organizational Controls:
- Documented security policies and procedures
- Employee security training programs
- Vendor security assessment processes
- Formal incident response plans
- Regular security reviews and updates
Here's something most compliance assessments won't tell you: achieving SOC 2 compliance took us 8 months from kick-off to audit completion. It wasn't just about implementing controls—it was about proving they work consistently over a 6-month observation period.
Understanding Data Subject Rights (And How We Handle Them)
One of GDPR's most powerful features is the rights it gives individuals over their personal data. Articles 15-22 establish seven core rights, and organizations must respond within one month (extendable to three in complex cases).
Here's what we built to handle these requests at Klavis AI:
| Right | Article | What It Means | How We Handle It |
|---|---|---|---|
| Access | Art. 15 | Get a copy of your data | manual review for complex requests |
| Rectification | Art. 16 | Correct inaccurate data | Self-service account settings + support ticket system |
| Erasure | Art. 17 | Delete your data | Account deletion triggers cascading erasure across all systems (30-day completion) |
| Portability | Art. 20 | Export data in machine-readable format | JSON export includes all user-created content and metadata |
| Object | Art. 21 | Stop processing based on legitimate interests | Opt-out mechanisms + support review |
What International Data Transfers Actually Mean
This is where things get complicated. Klavis AI is a US-based company. GDPR restricts transferring EU personal data outside the European Economic Area unless specific safeguards are in place.
Before our infrastructure migration, nearly all customer data flowed through US servers. Now, the picture looks like this:
Data Staying in the EU:
- User account information (Supabase EU)
- MCP server credentials and tokens (Supabase EU)
- Integration metadata and logs (GCP EU)
- Most application data
Data Transferred to the US (with SCCs):
- Payment processing (Stripe)
- Internal communications (Slack, Google Workspace)
How Klavis AI's Compliance Helps Your Application
If you're building AI applications with Klavis AI, our GDPR compliance provides several concrete benefits:
1. Simplified Vendor Due Diligence
When your customers ask "Are your vendors GDPR compliant?", you can point to:
- Our independently verified compliance assessment
- Our SOC 2 Type 2 report
2. Reduced Data Transfer Complexity
Because our primary infrastructure is EU-hosted, your European customer data stays in the EU when using Klavis MCP servers. This dramatically simplifies your own transfer mechanisms.
3. Built-in Security Controls
Our SOC 2 controls cover the infrastructure layer, meaning you inherit:
- Encryption at rest and in transit
- Access controls and monitoring
- Incident response procedures
- Regular security assessments
FAQs
Do I need my own GDPR compliance even if Klavis AI is compliant?
Yes. Klavis AI's compliance covers our role as a data processor for your application. You're still the data controller, responsible for:
- Getting valid consent from your users
- Having your own privacy policy
- Handling data subject rights requests
- Maintaining your own security controls
Think of it as layers: we handle the infrastructure layer, you handle the application layer.
What happens if there's a data breach involving Klavis AI?
Our incident response plan requires us to:
- Assess the breach within 24 hours
- Notify affected customers within 72 hours
- Provide detailed information for your own notification obligations
- Assist with your breach response as needed
You're still responsible for notifying your users and relevant supervisory authorities based on the risks involved.
Can I use Klavis AI MCP servers with non-EU hosted applications?
Absolutely. We provide on prem solutions and also cloud-hosted MCP servers globally.
Ready to build privacy-first AI applications? Explore our 80+ GDPR-compliant MCP servers, or talk to our team about enterprise deployment options.