Six features of a GDPR-compliant AI service
- Contract: the provider offers a data processing agreement under Art. 28 GDPR.
- Location: data is processed within the European Economic Area; there is no transfer to third countries (Art. 44 et seq. GDPR).
- Purpose: content is not used to train models.
- Retention: documents are stored only as long as the translation requires (Art. 5(1)(e) GDPR).
- Security: data is encrypted (Art. 32 GDPR).
- Transparency: all sub-processors are disclosed (Art. 28(2) and (4) GDPR).
Many free consumer translation services do not meet these features, or cover them only in their terms of use. A tool for translating official documents should meet them from the start.
How Lingverra meets these features
- Contract: the data processing agreement under Art. 28 GDPR is published and applies automatically to every account — no separate request needed.
- Location: servers are hosted by netcup in Germany and Austria. AI translation runs via Opper (Sweden) on Amazon Bedrock in Sweden; a contractually bound fallback channel is in Frankfurt (AWS). Processing outside the EEA is technically blocked.
- Purpose: your documents are not used to train models; Opper keeps no copies of requests; on Amazon Bedrock, requests and responses of the Claude models used are not stored and are not passed to the model developer.
- Retention: source and translation are deleted automatically 72 hours after delivery — or manually at any time.
- Security: every document is encrypted with AES-256-GCM using a separate key per document, destroyed when the document is deleted; the keys are protected by AWS KMS in Frankfurt.
- Transparency: the full list of sub-processors with purpose, location and contractual basis is public.
For your records
You can link to or file the data processing agreement and the list of sub-processors directly — for example in your record of processing activities, or when a client asks how their documents are handled. Both are listed below under sources.
Read next: AI translation for sworn translators — opportunities and limits
Read also: Where your client's document goes when you translate with Lingverra
Read also: Sworn translators and the GDPR: are you a controller or a processor?