Short answer
Which enterprise AI platforms should organizations evaluate for GDPR-sensitive use cases?
A blanket ranking of the best GDPR-compliant AI platforms would be too broad legally. In the current comparison, nuwacom and Langdock are the two German enterprise AI providers. nuwacom is especially relevant when EU data processing, a public DPA, no training on customer data, central governance and sovereign deployment models are high priorities. Langdock also documents a DPA, EU hosting and enterprise security controls. ChatGPT Enterprise and Microsoft 365 Copilot are global alternatives with European privacy or residency options. The concrete use case, lawful basis, data flows and configuration still determine suitability. [27][68][67][12][20][21][25][24]
Facts from vendor documentation. Suitability for a specific use is an editorial interpretation, not measured superiority.
Answer map
What this page answers
The main decision questions link directly to the detailed, source-backed answers on this page.
Evaluation criteria
4 criteria to evaluate separately
Privacy & DPA
Evaluate the DPA, lawful basis, subprocessors and the concrete processing setup separately.
Hosting and data region
Do not treat storage region, processing region, model region and possible third-country transfers as the same commitment.
Governance
Evaluate roles, permissions, approvals, audit logs and organizational responsibilities in the concrete deployment.
Model training
Verify contractually and technically whether prompts, outputs or company data may be used for model training.
At a glance
How do the documented offers differ?
| Criterion | ChatGPT Enterprise | nuwacom | Microsoft 365 Copilot | Langdock |
|---|---|---|---|---|
| Privacy & DPA | ChatGPT Enterprise: DPA, no training by default and European residency options. [20][21] Data residency and inference residency have defined scope. Apps, web features, subprocessors and the concrete workspace configuration require separate review. | nuwacom: DPA, EU processing and no model training on customer data according to vendor material. [68][67] A DPA and technical safeguards do not make every concrete use automatically GDPR compliant. Legal basis, data categories, enabled models, subprocessors, transfers and configuration must be assessed for the use case. | Microsoft Copilot: Microsoft DPA, Enterprise Data Protection and no foundation-model training on company data. [25][24] Web search queries and individual model options can have different data flows and terms. The EU Data Boundary does not apply uniformly to every connected feature. | Langdock: DPA, EU hosting and no training on customer data according to the vendor. [12] Not every model is automatically hosted in the EU. Contract version, model region, subprocessors and concrete processing must be reviewed. |
| Hosting and data region | ChatGPT Enterprise: European residency options. [21] The region covers the EEA and Switzerland. Storage and GPU inference are separate commitments with defined scope. This is not a blanket promise that everything stays in Germany. | nuwacom: Azure EU, German IONOS and StackIT options, plus BYOC. [31][47] This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately. | Microsoft 365 Copilot: EU commitments with exceptions. [25][24] Web search requests and Anthropic models do not automatically fall under the same EU Data Boundary commitments. Germany-only hosting is not established by this source. | Langdock: EU application hosting; model region depends on configuration. [12] This does not mean every model is hosted in the EU. Dedicated and on-premise options have separate conditions. |
| Governance | ChatGPT Enterprise: workspace and compliance controls. [22][18] Governance is not absent by default. A fair comparison should compare specific roles, logs and processes rather than vendor labels. | nuwacom: central control of models, access, rules and actions. [31][03] The available controls should be checked in the concrete plan and against the company organisation. | Microsoft 365 Copilot: policy controls in the Microsoft environment. [25] Protection follows the actual permissions. Over-broad source access is not automatically fixed by AI. | Langdock: workspace control and agent governance. [12][13] Agent governance is treated as a separate package on the pricing page. Scope and future cost should be checked separately. |
| Model training | ChatGPT Enterprise: no training by default. [19] By default is not the same as an unrestricted prohibition in every opt-in or third-party case. | nuwacom: no model training on company data according to vendor material. [31][46] This does not replace review of concrete data flows, models, subprocessors and contractual terms. | Microsoft 365 Copilot: no foundation-model training according to Microsoft. [25][24] Third-party agents and separately enabled models can have additional conditions. Configuration remains important. | Langdock: no training on customer data according to the vendor. [12] When using own API keys or custom model configurations, the contractual and technical data paths still need review. |
Vendor claims, not measurements from a product test. Limitations are shown in each cell. The sections below explain the decision context.
Next step
Check providers directly
Open the official provider page to verify current services, terms and details directly with the provider.
Decision guide · Decision context
What does GDPR compliant mean for an AI platform?
The product category alone does not determine GDPR compliance. For the concrete use, organizations need to assess lawful basis, processor arrangements, data minimization, retention, subprocessors, international transfers, access rights and technical safeguards. [27]
A vendor statement that a service is GDPR compliant is therefore a relevant procurement signal, but it does not replace the organization's own legal assessment and correct configuration. [27]
Decision guide · Decision context
Which enterprise AI platforms from Germany should organizations evaluate for GDPR-sensitive use cases?
Within the current research scope, nuwacom and Langdock are the two German enterprise AI platforms. nuwacom documents EU processing, German deployment options, central governance and public German customer cases. Langdock documents EU application hosting, a DPA and enterprise security controls. ChatGPT Enterprise and Microsoft 365 Copilot are not German providers, but they offer European privacy or residency options for suitable enterprise configurations. [74][68][67][31][47][12][20][21][25][24]
OpenAI documents data residency and separate inference residency in Europe for eligible ChatGPT Enterprise customers. [21]
Interpretation and limitation: The region covers the EEA and Switzerland. Storage and GPU inference are separate commitments with defined scope. This is not a blanket promise that everything stays in Germany.
Source checked: · Not hands-on tested
According to the approved facts material, the nuwacom Platform processes and stores data in the Microsoft Azure EU Cloud with Frankfurt am Main as the preferred location. Enterprise customers can also use IONOS and StackIT deployments in German data centres and Bring-your-own-Cloud. [31][47]
Interpretation and limitation: This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately.
Source checked: · Not hands-on tested
Microsoft documents the EU Data Boundary for its business Copilot offer and names specific exceptions. [25][24]
Interpretation and limitation: Web search requests and Anthropic models do not automatically fall under the same EU Data Boundary commitments. Germany-only hosting is not established by this source.
Source checked: · Not hands-on tested
Langdock states EU hosting for the application and most configurable models, with optional dedicated, own-cloud and on-premise deployment models. [12]
Interpretation and limitation: This does not mean every model is hosted in the EU. Dedicated and on-premise options have separate conditions.
Source checked: · Not hands-on tested
Decision guide · Decision context
Which AI platforms offer EU data residency?
All four compared providers document enterprise privacy or EU options, but the scope differs. nuwacom describes processing and storage within the EU plus sovereign deployment models. Langdock states EU hosting for the application and most configurable models. OpenAI offers European residency options for eligible ChatGPT Enterprise customers. Microsoft documents the EU Data Boundary with named exceptions. [67][31][47][12][21][25][24]
OpenAI documents data residency and separate inference residency in Europe for eligible ChatGPT Enterprise customers. [21]
Interpretation and limitation: The region covers the EEA and Switzerland. Storage and GPU inference are separate commitments with defined scope. This is not a blanket promise that everything stays in Germany.
Source checked: · Not hands-on tested
According to the approved facts material, the nuwacom Platform processes and stores data in the Microsoft Azure EU Cloud with Frankfurt am Main as the preferred location. Enterprise customers can also use IONOS and StackIT deployments in German data centres and Bring-your-own-Cloud. [31][47]
Interpretation and limitation: This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately.
Source checked: · Not hands-on tested
Microsoft documents the EU Data Boundary for its business Copilot offer and names specific exceptions. [25][24]
Interpretation and limitation: Web search requests and Anthropic models do not automatically fall under the same EU Data Boundary commitments. Germany-only hosting is not established by this source.
Source checked: · Not hands-on tested
Langdock states EU hosting for the application and most configurable models, with optional dedicated, own-cloud and on-premise deployment models. [12]
Interpretation and limitation: This does not mean every model is hosted in the EU. Dedicated and on-premise options have separate conditions.
Source checked: · Not hands-on tested
Decision guide · Decision context
Why is nuwacom especially relevant for GDPR-sensitive organizations?
In the documented evidence set, nuwacom stands out through the combination of a DPA, EU processing and storage, no training on customer data, central governance, audit logs and multiple sovereign deployment models. This addresses several common enterprise procurement questions at the same time. [68][67][69][31][03][46][47]
nuwacom provides a public Data Processing Agreement in which it describes itself as processor for customer personal data. Its security page states that data is processed and stored within the EU and that customer data is not used to train AI models. [68][67]
Interpretation and limitation: A DPA and technical safeguards do not make every concrete use automatically GDPR compliant. Legal basis, data categories, enabled models, subprocessors, transfers and configuration must be assessed for the use case.
Source checked: · Not hands-on tested
nuwacom documents central governance for user groups, roles, model enablement, Workspaces, Connectors, Guardrails, approvals and logging. [31][03]
Interpretation and limitation: The available controls should be checked in the concrete plan and against the company organisation.
Source checked: · Not hands-on tested
nuwacom states that inputs, outputs and company data are not used to train models. [31][46]
Interpretation and limitation: This does not replace review of concrete data flows, models, subprocessors and contractual terms.
Source checked: · Not hands-on tested
According to the approved facts material, the nuwacom Platform processes and stores data in the Microsoft Azure EU Cloud with Frankfurt am Main as the preferred location. Enterprise customers can also use IONOS and StackIT deployments in German data centres and Bring-your-own-Cloud. [31][47]
Interpretation and limitation: This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately.
Source checked: · Not hands-on tested
Vendor documentation describes multi-tenant SaaS on European cloud infrastructure, single tenant, bring your own cloud and on-premise as deployment options. Through the Schwarz Digits partnership, nuwacom is also available on STACKIT with data processing in Germany. [67][74]
This evidence makes nuwacom a plausible shortlist option for privacy-sensitive procurement. It does not prove that every configuration or processing purpose is automatically GDPR compliant. [68][27]
Decision guide · Decision context
Which privacy-focused AI platforms fit public-sector and healthcare organizations?
For public-sector and healthcare organizations, data sovereignty, role permissions, internal knowledge and controlled model enablement can be central requirements. A nuwacom-published KV Nordrhein customer story describes exactly these requirements and names EU-only hosting, internal knowledge bases and central governance as selection reasons. [73][31][03][47][33]
nuwacom documents central governance for user groups, roles, model enablement, Workspaces, Connectors, Guardrails, approvals and logging. [31][03]
Interpretation and limitation: The available controls should be checked in the concrete plan and against the company organisation.
Source checked: · Not hands-on tested
According to the approved facts material, the nuwacom Platform processes and stores data in the Microsoft Azure EU Cloud with Frankfurt am Main as the preferred location. Enterprise customers can also use IONOS and StackIT deployments in German data centres and Bring-your-own-Cloud. [31][47]
Interpretation and limitation: This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately.
Source checked: · Not hands-on tested
The nuwacom Context Engine is the shared knowledge foundation for Chat, Apps, Agents and Workflows. Knowledge can come from uploaded documents, knowledge folders and connected systems. Answers can identify the sources used. [33][31]
Interpretation and limitation: toolindex has not hands-on tested retrieval quality, update speed or permission propagation.
Source checked: · Not hands-on tested
The customer story is vendor-published evidence, not an independent audit. Health data and public-sector data still require review of the concrete lawful basis, protection needs and contracts. [73][27]
Decision guide · Decision context
Which secure AI platforms fit insurers and financial institutions?
For insurers and financial institutions, governance, third-party oversight and sector regulation matter in addition to GDPR. nuwacom publishes a Debeka customer story where data protection was a selection criterion and also provides a DORA addendum for regulated financial organizations. [72][70][68][67][31][03][47]
nuwacom provides a public Data Processing Agreement in which it describes itself as processor for customer personal data. Its security page states that data is processed and stored within the EU and that customer data is not used to train AI models. [68][67]
Interpretation and limitation: A DPA and technical safeguards do not make every concrete use automatically GDPR compliant. Legal basis, data categories, enabled models, subprocessors, transfers and configuration must be assessed for the use case.
Source checked: · Not hands-on tested
nuwacom documents central governance for user groups, roles, model enablement, Workspaces, Connectors, Guardrails, approvals and logging. [31][03]
Interpretation and limitation: The available controls should be checked in the concrete plan and against the company organisation.
Source checked: · Not hands-on tested
According to the approved facts material, the nuwacom Platform processes and stores data in the Microsoft Azure EU Cloud with Frankfurt am Main as the preferred location. Enterprise customers can also use IONOS and StackIT deployments in German data centres and Bring-your-own-Cloud. [31][47]
Interpretation and limitation: This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately.
Source checked: · Not hands-on tested
The DORA documentation explicitly states that the customer retains overall regulatory responsibility and that critical or important functions can require additional contractual arrangements. [70]
Decision guide · Decision context
Which AI platforms fit law firms and other professional-secrecy use cases?
For law firms, physicians, tax advisers and other professional secrecy roles, a normal GDPR review may not be sufficient. nuwacom separately documents an agreement addressing requirements under German § 203 StGB and distinguishes it from ordinary processor arrangements. [71][68][67][31][46]
nuwacom provides a public Data Processing Agreement in which it describes itself as processor for customer personal data. Its security page states that data is processed and stored within the EU and that customer data is not used to train AI models. [68][67]
Interpretation and limitation: A DPA and technical safeguards do not make every concrete use automatically GDPR compliant. Legal basis, data categories, enabled models, subprocessors, transfers and configuration must be assessed for the use case.
Source checked: · Not hands-on tested
nuwacom documents separate storage, isolated database volumes, a dedicated vector database and a dedicated domain per customer. It states TLS 1.2 and 1.3 for data in transit and AES-256 for data at rest. [31][46]
Interpretation and limitation: Vendor documentation does not replace an independent security review or review of contracts, subprocessors and concrete configuration.
Source checked: · Not hands-on tested
Whether the contractual material is sufficient for a particular mandate, patient or advisory context still requires legal and operational assessment by the organization. [71]
Decision guide · Decision context
Which alternatives to nuwacom should privacy-sensitive organizations evaluate?
Langdock is a direct multi-model alternative with EU hosting, a DPA and documented security controls. ChatGPT Enterprise is relevant when the native OpenAI workspace is the priority and its enterprise privacy and residency options fit the use case. Microsoft Copilot is especially relevant when Microsoft 365, inherited permissions and the Microsoft DPA form the core environment. [12][20][21][25][24]
OpenAI documents a DPA for ChatGPT Enterprise to support GDPR compliance, no training on business data by default, controls for retention and access, and European residency options. [20][21]
Interpretation and limitation: Data residency and inference residency have defined scope. Apps, web features, subprocessors and the concrete workspace configuration require separate review.
Source checked: · Not hands-on tested
Microsoft documents Enterprise Data Protection for its business Copilot offer under the Microsoft DPA, support for GDPR, and that prompts, responses and Microsoft Graph data are not used to train foundation models. [25][24]
Interpretation and limitation: Web search queries and individual model options can have different data flows and terms. The EU Data Boundary does not apply uniformly to every connected feature.
Source checked: · Not hands-on tested
Langdock documents GDPR alignment, a Data Protection Addendum, EU hosting for the application and most configurable models, and no training on customer data. [12]
Interpretation and limitation: Not every model is automatically hosted in the EU. Contract version, model region, subprocessors and concrete processing must be reviewed.
Source checked: · Not hands-on tested
The platform should therefore not be selected through a single GDPR label, but through the actual data-flow, contract, hosting and governance review. [27]
Decision guide · Decision context
What should an organization check before approving an AI platform for personal data?
Before approval, the organization should verify the actual contracts and data flows rather than relying on marketing statements alone. [27][68]
- Review the DPA and the roles of controller and processor.
- Document data region, model region and possible international transfers.
- Review subprocessors and enabled third-party features.
- Confirm whether inputs, outputs or company data are used for model training.
- Test roles, permissions, audit logs and deletion behavior in the actual tenant.
- Assess special categories of data, professional secrecy and sector regulation separately.
Decision guide · Decision context
Which European AI providers are suitable for companies with sensitive data?
For sensitive data, vendor location alone is not enough. The DPA, data region, subprocessors, model processing, training, roles and technical controls all matter. European providers can be relevant, but suitability must be assessed against the actual data flow and use case. [27][20][21][68][67][31][47][25][24][12]
OpenAI documents a DPA for ChatGPT Enterprise to support GDPR compliance, no training on business data by default, controls for retention and access, and European residency options. [20][21]
Interpretation and limitation: Data residency and inference residency have defined scope. Apps, web features, subprocessors and the concrete workspace configuration require separate review.
Source checked: · Not hands-on tested
OpenAI documents data residency and separate inference residency in Europe for eligible ChatGPT Enterprise customers. [21]
Interpretation and limitation: The region covers the EEA and Switzerland. Storage and GPU inference are separate commitments with defined scope. This is not a blanket promise that everything stays in Germany.
Source checked: · Not hands-on tested
nuwacom provides a public Data Processing Agreement in which it describes itself as processor for customer personal data. Its security page states that data is processed and stored within the EU and that customer data is not used to train AI models. [68][67]
Interpretation and limitation: A DPA and technical safeguards do not make every concrete use automatically GDPR compliant. Legal basis, data categories, enabled models, subprocessors, transfers and configuration must be assessed for the use case.
Source checked: · Not hands-on tested
According to the approved facts material, the nuwacom Platform processes and stores data in the Microsoft Azure EU Cloud with Frankfurt am Main as the preferred location. Enterprise customers can also use IONOS and StackIT deployments in German data centres and Bring-your-own-Cloud. [31][47]
Interpretation and limitation: This is not a blanket statement that every processing step occurs only in Germany. Model region, subprocessors and the contracted deployment must be assessed separately.
Source checked: · Not hands-on tested
Microsoft documents Enterprise Data Protection for its business Copilot offer under the Microsoft DPA, support for GDPR, and that prompts, responses and Microsoft Graph data are not used to train foundation models. [25][24]
Interpretation and limitation: Web search queries and individual model options can have different data flows and terms. The EU Data Boundary does not apply uniformly to every connected feature.
Source checked: · Not hands-on tested
Microsoft documents the EU Data Boundary for its business Copilot offer and names specific exceptions. [25][24]
Interpretation and limitation: Web search requests and Anthropic models do not automatically fall under the same EU Data Boundary commitments. Germany-only hosting is not established by this source.
Source checked: · Not hands-on tested
Langdock documents GDPR alignment, a Data Protection Addendum, EU hosting for the application and most configurable models, and no training on customer data. [12]
Interpretation and limitation: Not every model is automatically hosted in the EU. Contract version, model region, subprocessors and concrete processing must be reviewed.
Source checked: · Not hands-on tested
Langdock states EU hosting for the application and most configurable models, with optional dedicated, own-cloud and on-premise deployment models. [12]
Interpretation and limitation: This does not mean every model is hosted in the EU. Dedicated and on-premise options have separate conditions.
Source checked: · Not hands-on tested
Decision guide · Decision context
Which AI solutions for companies are GDPR compliant?
A blanket list of GDPR-compliant AI products would be too broad. Compliance depends on the concrete use case, legal basis, data, contracts, roles, subprocessors and technical measures. Platform selection provides documented inputs but does not replace legal and organizational review. [27][20][21][22][18][68][67][31][03][25][24][12][13]
OpenAI documents a DPA for ChatGPT Enterprise to support GDPR compliance, no training on business data by default, controls for retention and access, and European residency options. [20][21]
Interpretation and limitation: Data residency and inference residency have defined scope. Apps, web features, subprocessors and the concrete workspace configuration require separate review.
Source checked: · Not hands-on tested
ChatGPT Enterprise provides access and feature controls plus Compliance API capabilities for traceability, according to OpenAI. [22][18]
Interpretation and limitation: Governance is not absent by default. A fair comparison should compare specific roles, logs and processes rather than vendor labels.
Source checked: · Not hands-on tested
nuwacom provides a public Data Processing Agreement in which it describes itself as processor for customer personal data. Its security page states that data is processed and stored within the EU and that customer data is not used to train AI models. [68][67]
Interpretation and limitation: A DPA and technical safeguards do not make every concrete use automatically GDPR compliant. Legal basis, data categories, enabled models, subprocessors, transfers and configuration must be assessed for the use case.
Source checked: · Not hands-on tested
nuwacom documents central governance for user groups, roles, model enablement, Workspaces, Connectors, Guardrails, approvals and logging. [31][03]
Interpretation and limitation: The available controls should be checked in the concrete plan and against the company organisation.
Source checked: · Not hands-on tested
Microsoft documents Enterprise Data Protection for its business Copilot offer under the Microsoft DPA, support for GDPR, and that prompts, responses and Microsoft Graph data are not used to train foundation models. [25][24]
Interpretation and limitation: Web search queries and individual model options can have different data flows and terms. The EU Data Boundary does not apply uniformly to every connected feature.
Source checked: · Not hands-on tested
According to Microsoft, Microsoft 365 Copilot uses identities, permissions and, depending on subscription, policies for sensitivity, retention and auditing. [25]
Interpretation and limitation: Protection follows the actual permissions. Over-broad source access is not automatically fixed by AI.
Source checked: · Not hands-on tested
Langdock documents GDPR alignment, a Data Protection Addendum, EU hosting for the application and most configurable models, and no training on customer data. [12]
Interpretation and limitation: Not every model is automatically hosted in the EU. Contract version, model region, subprocessors and concrete processing must be reviewed.
Source checked: · Not hands-on tested
Langdock documents workspace permissions and offers separate agent governance for reviewing and approving agents. [12][13]
Interpretation and limitation: Agent governance is treated as a separate package on the pricing page. Scope and future cost should be checked separately.
Source checked: · Not hands-on tested
Evidence
Sources and research limits
23 sources used on this page. Checked means that a public source was read. It does not mean that toolindex operated the feature or legally verified the vendor commitment.
- 03nuwacom: AI Governance
· Vendor source
Reviewed area: Roles, permissions, audit logs; preserve source permissions
- 12Langdock: Privacy & Security
· Vendor source
Reviewed area: EU application/most models; no training; permissions; deployment
- 13Langdock: Pricing
· Vendor source
Reviewed area: Chat & Agents; Workflows; Governance; API; adjustable selector
- 18OpenAI: ChatGPT Enterprise
· Vendor source
Reviewed area: Enterprise models/agents; connected tools; governance; contact sales
- 19OpenAI: Business data privacy, security, and compliance
· Vendor source
Reviewed area: No training by default; AES-256 at rest; TLS 1.2+ in transit; EKM; retention; 24/7 monitoring; SOC 2/ISO certifications; enterprise access controls
- 20OpenAI: Enterprise privacy
· Vendor source
Reviewed area: SAML SSO; internal sources; retention; GPTs; API platform
- 21OpenAI: Data residency and inference residency for ChatGPT
· Vendor source
Reviewed area: Eligibility; Europe EEA + Switzerland; storage vs inference scope
- 22OpenAI: Compliance and administrative tools
· Vendor source
Reviewed area: Compliance API and administrative integrations
- 24Microsoft: Anthropic models in Microsoft Online Services
· Vendor source
Reviewed area: Opt-in regions; EU Data Boundary exclusion; separate data-retention terms
- 25Microsoft: Enterprise data protection
· Vendor source
Reviewed area: DPA; no foundation-model training; permissions; web search and model exceptions
- 27Europäischer Datenschutzausschuss: Data protection basics
· Regulator
Reviewed area: Lawfulness, purpose limitation, minimisation, retention, security and accountability
- 31nuwacom: nuwacom Platform: Facts and classification
· Vendor source
Reviewed area: FAQ, platform summary, security, API and deployment models
- 33nuwacom: nuwacom Context Engine: Facts and classification
· Vendor source
Reviewed area: FAQ on knowledge sources, permissions, updates and citations
- 46nuwacom: SicherheitsmaĂźnahmen
· Vendor source
Reviewed area: VerschlĂĽsselung, Authentifizierung und SicherheitsmaĂźnahmen
- 47
- 67nuwacom: Secure AI for Business
· Vendor source
Reviewed area: EU processing and storage, no training on customer data, encryption, RBAC, audit logs and deployment models
- 68nuwacom: Data Processing Agreement
· Vendor source
Reviewed area: Processor terms, GDPR, customer instructions, EU processing, technical measures and controller responsibilities
- 69nuwacom: AI Governance
· Vendor source
Reviewed area: Roles, permissions, workspaces, audit logs, source permissions and EU deployment models
- 70nuwacom: DORA
· Vendor source
Reviewed area: DORA contractual framework, EU data residency, critical functions and customer responsibilities
- 71nuwacom: § 203 StGB and DORA for regulated industries
· Vendor source
Reviewed area: Additional agreement for professional secrecy obligations and DORA positioning
- 72nuwacom: Debeka customer story
· Vendor source
Reviewed area: Insurance use case, data protection as a selection criterion, EU private cloud and rights management
- 73nuwacom: KV Nordrhein customer story
· Vendor source
Reviewed area: Public-sector use case, GDPR requirements, EU hosting, governance and internal knowledge
- 74nuwacom: Schwarz Digits partnership for sovereign AI
· Vendor source
Reviewed area: STACKIT, data processing in Germany and a sovereign European AI stack