The platform is not the problem.

When people say GDPR, they mean the platform. The risk sits in the model.

In reviews with IT security and data protection officers, one question always comes up first: Does it run on our servers? As soon as the answer is yes, the platform is considered solved and the discussion jumps to licensing. That is understandable, but this is where the real risk is overlooked.

An AI platform consists of two layers. One contains prompts, uploaded documents, user permissions, protocols, knowledge sources, and configuration. You can keep this layer entirely in-house, both technically and contractually. The other layer is the language model that generates the actual answer. This is where it is decided whether content leaves the company, which region it goes to, how long it is stored there, and whether a provider may train on it.

The productive question is therefore not whether it runs on our systems, but which model sees which data at which level. This is exactly the question that can be answered in a structured way with auraHub as a self-hosted AI platform, because platform and model are cleanly separated architecturally. The legal basis is provided by the General Data Protection Regulation, whose obligations apply differently depending on the level.

Two layers. A clear separation.

auraHub runs entirely in your own environment—either on-premises on your servers, in your private cloud, or air-gapped, i.e., without an internet connection. This means all platform-side data remains physically with you. At this layer, there is no transfer to a third country, no cloud lock-in, and no shift into external responsibility.

What stays with you

Specifically, the following remains in your infrastructure: prompts and inputs, uploaded documents, user and permission management, protocols and logs, connected knowledge sources, and the entire platform configuration. From a data protection perspective, this layer is the non-critical part. You have full control, no third-country transfer at platform level, and no cloud lock-in.

What the language model sees

As soon as a prompt needs to be processed, auraHub calls the configured language model. This is exactly where content may potentially leave the infrastructure—depending on the level: not at all (local model), to an EU region (Azure OpenAI Service with EU data residency), or to the US via Standard Contractual Clauses (OpenAI or Anthropic directly). This level can be set per use case, not as a blanket setting for the entire system. You may be familiar with a comparable architecture from our auraIR setup for Investor Relations, which follows the same logic.

Local, EU, or safeguarded. You choose per use case.

The three levels do not differ in auraHub’s feature set, but in what happens outside your organization. The choice is made individually for each use case and can vary between use cases without rebuilding the platform.

Quick terminology clarification

DPA refers to the data processing agreement under Article 28 GDPR, in which the cloud provider commits to processing your data only on your behalf and according to your instructions. SCC stands for Standard Contractual Clauses, a set of contractual clauses issued by the European Commission to safeguard the transfer of personal data to third countries. With a local model, neither applies because no data leaves the organization.

How long your inputs are stored outside your organization.

Even if the language model is not trained on your data, inputs may be stored by the provider for a limited time, usually for abuse detection. Retention periods vary by provider and have been systematically decreasing in recent years. For particularly sensitive data, there is the premium option Zero Data Retention (ZDR), under which no storage takes place at all.

Premium option: Zero Data Retention

For particularly sensitive processing—such as finance and investor-relations data (as in our auraIR setup for listed companies)—Anthropic offers Zero Data Retention as part of an enterprise agreement. Inputs and outputs are then no longer stored after the response, are not written to abuse logs, and are not subjected to human review. Processing takes place purely in memory.

This level must be requested separately and is tied to a qualifying contract. Microsoft (Azure) and OpenAI offer ZDR in a similar way for enterprise or Microsoft customer agreements. A practical note: with Anthropic, the results of security classifiers are still retained even under ZDR—this should be considered in the risk model.

Six building blocks. A consistent review.

The following six building blocks cover the GDPR-relevant obligations when using auraHub and can be answered consistently in any audit question.

One platform. Tiered model selection per use case.

The decisive lever for assessment in your organization is tiered model selection per use case. Highly sensitive cases run on a local model with no data leaving the organization. Standard business data runs via Azure in the EU. Non-critical workloads run via the direct API.

Where cloud models touch particularly sensitive data, Zero Data Retention safeguards processing without any storage. This allows each use case to be set to the appropriate protection level individually, without having to move the entire operation to the maximum security level. This reduces costs where they do not buy additional protection, and concentrates effort where it has an effect.

What that means for your assessment

Three questions are enough to arrive at the right level per use case. First: which data category is processed—for example personal data under Article 9 GDPR, trade secrets, or non-critical data? Second: which regulatory requirement applies—for example professional confidentiality, an industry-specific requirement, or GDPR in general? Third: how frequently does the use case run, and does the operating model justify a local model, or is the cloud option sufficient? If you need an initial assessment of your cases, we support this as part of our AI consulting.

How to arrive at the right level selection.

• 01

  Collect use cases

  List between three and ten concrete use cases in which auraHub is to be used. Examples: summarizing press coverage, reviewing contract drafts, categorizing customer inquiries, pre-structuring patient letters.

• 02

  Assign a data category

  For each use case: does it involve particularly sensitive data under Article 9 GDPR, standard personal data, trade secrets, or non-critical public data? This assignment directly determines the level selection.

• 03

  Select the level

  Level 1 local for highly sensitive data and professional confidentiality. Level 2 Azure EU for standard business data with an EU requirement. Level 3 direct API for non-critical workloads. Enable ZDR as soon as sensitive data touches cloud models.

• 04

  Conclude contracts

  Conclude a DPA with all relevant providers (Microsoft, OpenAI, Anthropic). Request ZDR explicitly where applicable. Review Standard Contractual Clauses where third-country transfer takes place.

• 05

  Configuration and audit

  Configure auraHub per use case to the selected level. Assign roles and permissions according to the use case. Document data flows once in full, then review them regularly.