Personnel files, legal matters and health information are the data GDPR
protects most. Before a team puts that kind of data from the EEA, the UK or
Switzerland into a workspace, go through this list. It covers what GBrain
lets a workspace control. It is not a certificate: your own data protection
officer still decides whether the workspace is right for the data, and
[Subprocessors](/trust/subprocessors) says where each company processes it
today.

## 1. Give the team its own organization

Follow [A workspace for a sensitive team](/docs/workspace/sensitive-teams):
a separate organization, with only the team in it. Everything below is set
on that team's workspace.

## 2. Use an EU model or your own, and only that

- **Add the endpoint.** In the organization's **AI models**, under **Your
  own endpoints**, an admin adds an AI endpoint in the EU or on your own
  servers. Your own endpoints carry chat only for now.
- **Set AI routing to Only approved.** On the workspace's **Settings**,
  then **Data protection**, an admin opens **AI routing**, chooses **Only
  approved** and approves those endpoints. From then on GBrain refuses every
  AI call from the workspace to anywhere else before it leaves GBrain's
  servers, and it refuses the optional tools below too.
- **Decide about memory search.** Memory search finds notes by meaning
  using embeddings, which run on OpenAI and can't go to your own endpoint
  yet. Under Only approved those calls are refused unless you also approve
  OpenAI, which processes in the United States under its data processing
  agreement and the EU Standard Contractual Clauses. Leave OpenAI off and
  new memory isn't indexed for search by meaning.
- **Check where calls went.** The same Data protection page shows where
  each recent AI call was processed.

## 3. Leave these off

Only approved already refuses the first five. Leave them off anyway, so
nobody turns them back on by changing the rule. The last two need turning off
by hand, because they reach their own services directly.

- **Particle (the Particle-1 model).** Don't pick it as the workspace's
  model. Particle has no data processing agreement with us, isn't in the
  EU-US Data Privacy Framework, and its terms limit its use to the United
  States.
- **ZeroEntropy (older memory search).** Workspaces made before memory
  search moved to OpenAI may still send their notes to ZeroEntropy to index
  them. There's no data processing agreement in place yet, and we haven't
  confirmed where it processes data. If the workspace is that old, ask us at
  [support@gbrain.io](mailto:support@gbrain.io) to move it before the data
  goes in.
- **Crustdata.** Take it off in **Tools**. It looks people up by their LinkedIn address, which is
  exactly the profiling an HR team must not do by accident, and there's no
  data processing agreement or transfer safeguard for it.
- **Happenstance.** Take it off in **Tools**. It searches people and their networks, and calls
  itself the controller of what it receives, so we can't give you the
  processor terms GDPR expects. No transfer safeguard either.
- **Firecrawl.** It fetches web pages, and the pages and addresses it
  fetches can carry personal data. It processes everything in the United
  States, and it offers a data processing agreement only on a plan we don't
  have. Check the workspace's **Tools** and take it off if it is there.
- **iMessage (Photon).** Disconnect it in the workspace's
  **Integrations**, then **Messaging**. Photon has no data processing
  agreement with us, and its own terms forbid health, union, religious and
  the other special categories of data.
- **Telegram.** Disconnect it in **Messaging** too. Telegram acts for
  itself as a controller of its users' messages and signs no processor
  terms, and the workspace's bot talks to Telegram directly, outside AI
  routing.

## 4. Know what stays in the United States

AI routing decides where the AI models run. It doesn't move the rest:

- Every AI call passes through GBrain's servers in Chicago on its way to the
  endpoint you approved.
- The workspace's memory, chats and files are stored in the United States.
  An EU home for a workspace isn't available yet.
- Accounts people connect, such as Google or Microsoft, are read and
  written through GBrain's servers too, under your own terms with those
  companies.

We transfer this data under the EU Standard Contractual Clauses in our
[Data Processing Addendum](/trust/dpa). A data protection officer who
wants our transfer impact assessment can ask for it at
[support@gbrain.io](mailto:support@gbrain.io).

## 5. Keep the rest tidy

- **Owner approval.** On the Data protection page, turn on owner
  approval, so a colleague's connected account, such as their mailbox, is
  used only once they approve.
- **Slack.** Connect it only if everyone Slack lets message the
  workspace belongs on the team. Slack also reaches its own service
  directly, outside AI routing.
- **Staff access.** The Data protection page lists each time someone at
  GBrain opened the workspace, and why.
- **Email.** Don't ask the workspace to email HR or health details: our
  email provider's certification under the Data Privacy Framework doesn't
  cover HR data.

Only approved refuses every optional tool on
[Subprocessors](/trust/subprocessors), including the ones with a transfer
safeguard such as Exa and Perplexity. A workspace can't approve one tool on
its own yet, so those stay off too while the rule is on.