GDPR, data residency, and the EU AI Act: what EU teams should ask an AI app builder

Every EU procurement conversation about an AI app builder now includes two questions that used to be niche: "is this GDPR compliant?" and, more recently, "does the EU AI Act apply to this?" Neither question has a one-word answer, and any vendor that gives you one is oversimplifying. Here is a straight, sourced answer for Vibely, plus the questions worth asking any tool in this category.

"GDPR compliant" is not a single certificate

There is no such thing as a "GDPR certification" a vendor can hold up and hand you. GDPR compliance for a SaaS vendor is a combination of things: a documented lawful basis for processing, a Data Processing Agreement (DPA) you can sign or review, contractual protection for cross-border transfers, and technical controls (encryption, access control, breach handling) that back it up. When you evaluate an AI app builder, ask for the DPA and the lawful basis, not a badge.

For Vibely specifically: our lawful basis for processing EEA and UK users' personal data is contract performance (to provide the service you signed up for), legitimate interests (to improve and secure the platform), and consent for optional communications. A GDPR Data Processing Agreement is available for enterprise review, covering privacy terms for in-scope workloads. Full detail is in our privacy policy and security page.

Where is your data actually hosted?

This is the question that matters most in practice, and it deserves a direct answer rather than marketing language. Vibely is hosted on managed cloud infrastructure in the US (AWS us-east-1) today. EU and India regions are on our roadmap. In the meantime, customer data is stored in the US and never moves across regions — there is no silent replication to a second geography. If your organization has a hard EU-data-residency requirement today, that is worth knowing up front rather than discovering during a security review.

For users accessing Vibely from the EEA or the UK, these transfers are made under Standard Contractual Clauses (SCCs) approved by the European Commission — the standard mechanism for lawfully moving personal data outside the EEA/UK under GDPR.

Is there a Data Processing Agreement?

Yes. A GDPR DPA is available for enterprise review, and it covers the small, deliberate set of subprocessors Vibely uses (cloud hosting, AI inference, payments, observability, email) under their own data protection agreements. The current subprocessor list is public at /subprocessors; the DPA-backed schedule itself is shared under NDA on request.

What about SOC 2 and ISO 27001?

Here is where we would rather under-claim than over-claim. Vibely's SOC 2 program is in progress — a Type I audit first — and is not yet complete; reports are shared under NDA as they become available. ISO 27001 controls are mapped across access, encryption, change management, and incident response, and certification is in progress, also not yet complete. If a competing AI app builder tells you it is "SOC 2 compliant" without specifying Type I vs Type II and without an audit date, ask to see the report — the distinction matters more than the acronym.

Does the EU AI Act apply to an AI app builder?

The EU AI Act's obligations for high-risk AI systems began enforcement on August 2, 2026, and this is the question we get asked most since. The short answer for a tool like Vibely: it is a general-purpose AI development tool, not a high-risk AI system under the Act. The apps you build with Vibely are your own products, and whether any specific app you ship falls under the AI Act's high-risk categories — and what obligations follow from that — is your own compliance responsibility as the deployer, not Vibely's. What Vibely does control is the platform itself, where we follow GDPR data protection practices as described above (lawful basis, DPA, encryption, subprocessor governance).

We are not claiming any EU AI Act certification here, because none applies to a general-purpose builder in the way it would to a deployed high-risk system. If you are building something that could plausibly qualify as high-risk under the Act — biometric identification, credit scoring, employment screening, and similar categories are the classic examples — that assessment belongs to you and your legal counsel for the app you ship, not to the tool you built it with.

Technical controls that back all of this up

• Encryption. TLS 1.3 in transit, AES-256 at rest.
• No training on your data by default. Vibely does not use customer prompts, code, or project data to train models by default, and model providers are contractually restricted from training or retaining customer data.
• Isolation. Vibely is multi-tenant with strict logical isolation between workspaces and projects, including row-level security on shared databases.
• Secrets. Encrypted at rest, scoped to specific environments, and never round-tripped through the model in plaintext.

FAQ

Is Vibely GDPR compliant?

Vibely supports GDPR with a documented lawful basis for EEA/UK processing, SCCs for the US transfer, and a Data Processing Agreement available for enterprise review. SOC 2 (Type I first) is in progress and not yet complete; reports are shared under NDA as they become available.

Is Vibely ready for the EU AI Act?

Vibely is a general-purpose AI development tool, not a high-risk AI system under the EU AI Act — the apps you build with it are your own products and your own compliance responsibility. Vibely follows GDPR data protection practices for the platform itself.

Where is my data stored if I build on Vibely from the EU?

In the US (us-east-1) today, under SCCs for the transfer. EU and India regions are on the roadmap, and we will update our privacy policy before changing where data is stored.

Can I get a signed DPA?

Yes — a GDPR Data Processing Agreement is available for enterprise review. Contact us to start that process.

The bottom line

"GDPR compliant" and "EU AI Act ready" are both claims worth interrogating rather than accepting at face value, for any vendor — including us. What we can tell you, sourced directly from our own security and privacy pages: US hosting today with EU on the roadmap, a DPA available for review, SCCs for EEA/UK transfers, and SOC 2 and ISO 27001 both honestly labeled "in progress." If those specifics work for where your project is today, start building on Vibely.