Personnel files, legal matters and health information are the data GDPR protects most. Before a team puts that kind of data from the EEA, the UK or Switzerland into a workspace, go through this list. It covers what GBrain lets a workspace control. It is not a certificate: your own data protection officer still decides whether the workspace is right for the data, and Subprocessors says where each company processes it today.
1. Give the team its own organization
Follow A workspace for a sensitive team: a separate organization, with only the team in it. Everything below is set on that team’s workspace.
2. Use an EU model or your own, and only that
- Add the endpoint. In the organization’s AI models, under Your own endpoints, an admin adds an AI endpoint in the EU or on your own servers. Your own endpoints carry chat only for now.
- Set AI routing to Only approved. On the workspace’s Settings, then Data protection, an admin opens AI routing, chooses Only approved and approves those endpoints. From then on GBrain refuses every AI call from the workspace to anywhere else before it leaves GBrain’s servers, and it refuses the optional tools below too.
- Decide about memory search. Memory search finds notes by meaning using embeddings, which run on OpenAI and can’t go to your own endpoint yet. Under Only approved those calls are refused unless you also approve OpenAI, which processes in the United States under its data processing agreement and the EU Standard Contractual Clauses. Leave OpenAI off and new memory isn’t indexed for search by meaning.
- Check where calls went. The same Data protection page shows where each recent AI call was processed.
3. Leave these off
Only approved already refuses the first five. Leave them off anyway, so nobody turns them back on by changing the rule. The last two need turning off by hand, because they reach their own services directly.
- Particle (the Particle-1 model). Don’t pick it as the workspace’s model. Particle has no data processing agreement with us, isn’t in the EU-US Data Privacy Framework, and its terms limit its use to the United States.
- ZeroEntropy (older memory search). Workspaces made before memory search moved to OpenAI may still send their notes to ZeroEntropy to index them. There’s no data processing agreement in place yet, and we haven’t confirmed where it processes data. If the workspace is that old, ask us at support@gbrain.io to move it before the data goes in.
- Crustdata. Take it off in Tools. It looks people up by their LinkedIn address, which is exactly the profiling an HR team must not do by accident, and there’s no data processing agreement or transfer safeguard for it.
- Happenstance. Take it off in Tools. It searches people and their networks, and calls itself the controller of what it receives, so we can’t give you the processor terms GDPR expects. No transfer safeguard either.
- Firecrawl. It fetches web pages, and the pages and addresses it fetches can carry personal data. It processes everything in the United States, and it offers a data processing agreement only on a plan we don’t have. Check the workspace’s Tools and take it off if it is there.
- iMessage (Photon). Disconnect it in the workspace’s Integrations, then Messaging. Photon has no data processing agreement with us, and its own terms forbid health, union, religious and the other special categories of data.
- Telegram. Disconnect it in Messaging too. Telegram acts for itself as a controller of its users’ messages and signs no processor terms, and the workspace’s bot talks to Telegram directly, outside AI routing.
4. Know what stays in the United States
AI routing decides where the AI models run. It doesn’t move the rest:
- Every AI call passes through GBrain’s servers in Chicago on its way to the endpoint you approved.
- The workspace’s memory, chats and files are stored in the United States. An EU home for a workspace isn’t available yet.
- Accounts people connect, such as Google or Microsoft, are read and written through GBrain’s servers too, under your own terms with those companies.
We transfer this data under the EU Standard Contractual Clauses in our Data Processing Addendum. A data protection officer who wants our transfer impact assessment can ask for it at support@gbrain.io.
5. Keep the rest tidy
- Owner approval. On the Data protection page, turn on owner approval, so a colleague’s connected account, such as their mailbox, is used only once they approve.
- Slack. Connect it only if everyone Slack lets message the workspace belongs on the team. Slack also reaches its own service directly, outside AI routing.
- Staff access. The Data protection page lists each time someone at GBrain opened the workspace, and why.
- Email. Don’t ask the workspace to email HR or health details: our email provider’s certification under the Data Privacy Framework doesn’t cover HR data.
Only approved refuses every optional tool on Subprocessors, including the ones with a transfer safeguard such as Exa and Perplexity. A workspace can’t approve one tool on its own yet, so those stay off too while the rule is on.