Ashby All-in-One and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. The AI Terms say neither Ashby nor its AI providers (OpenAI, AWS Bedrock, Google Gemini) will use customer data to train machine learning models. AI tools are opt-in.

Vendor's wording: “Neither Ashby nor any of the Third-Party AI Services will use Customer Data to train machine learning models.”

Source: ashbyhq.com3. No Training on Customer DataChecked on 19 October 2026

United States. Ashby stores and processes data in the US, on Amazon Web Services infrastructure.

Vendor's wording: “Ashby stores and processes data in the United States.”

Source: ashbyhq.comData Transfer and StorageChecked on 19 October 2026

DPA on request.

Yes, on request. Ashby offers a Data Processing Agreement that includes the standard contractual clauses; it is not a click-through part of the terms.

Vendor's wording: “Ashby offers a Data Processing Agreement on request, which includes the “standard contractual clauses” typically recommended for sub-processor agreements.”

Source: ashbyhq.comData Processing AgreementChecked on 19 October 2026

On the list.

Active (Ashby; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Ashby'Checked on 19 October 2026

Customer sets custom retention periods using activity- or consent-based rules, and can export, delete or anonymise candidates. Ashby may erase customer data once an account is delinquent, suspended or terminated for 30 days or more. AI providers do not retain data beyond the processing session.

Vendor's wording: “Ashby’s data privacy tools provide custom data retention periods using activity or consent-based rules.”

Source: ashbyhq.comCandidates have the right to be notified of data collectionChecked on 19 October 2026

1 named: SOC 2 Type 2, audited annually. No ISO certificate named on the readable pages; the Trust Center was not readable.

Vendor's wording: “Ashby is SOC2 compliant and Type 2 audited annually.”

Source: ashbyhq.comIntroductionChecked on 19 October 2026

Yes in effect: the AI tools apply only to features the customer specifically opts into, and the AI Notetaker can be disabled. The terms do not say which role switches them on.

Vendor's wording: “artificial intelligence tools and functionality that Ashby makes available to Customer in connection with the Ashby Service and that Customer specifically opts into using”

Source: ashbyhq.comPreambleChecked on 19 October 2026