Free
FreeTrains on your data unless you switch it off
No EU hosting · DPA in the terms
Price: Free
Data
Automation tools and the GDPR: 9 checked
9 tools, 2 of which don't train on your data, keep it in the EU and include a DPA. From the vendors' own pages.
Checked on
Tools
Which automation tool is GDPR compliant?
Each tool's business plan where there is one, against your five rules. 4 tools without a page of their own open their answers with “Show answers”.
The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.
Tool · PlanVerdictYour five rules
- Activepieces
Team · $200 / mo
Says it doesn't train on your dataEU hosting available · DPA not stated
✓✓??✕
- Bardeen
Premium · $50 / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA not stated
????✕
Show answers
- Where data is stored by default
Not fixed: the privacy policy says data can be processed and stored anywhere in the world, including the United States. The security page says app data stays in the browser and only automations and connected-app settings are stored on Bardeen servers.
“All personal information processed by us may be transferred, processed, and stored anywhere in the world, including, but not limited to, the United States”
Source: bardeen.ai · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'Bardeen'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Kept while you use the service or as needed for legal and business purposes; you can remove all data from the settings page, and data from third-party APIs is not retained.
“for as long as you use our Services, or as necessary to fulfill the purpose(s) for which it was collected”
Source: bardeen.ai · Checked on
- Security certifications
Two named: SOC 2 Type 2 (since 1 April 2024) and CASA Tier 2 and Tier 3; a GDPR checklist is also mentioned.
“As of April 1, 2024, we are proud to announce our compliance with the AICPA SOC 2 Type 2 standards”
Source: bardeen.ai · Checked on
- IFTTT
Pro+ · $8.99 / mo
Doesn't say whether it trains on your dataNo EU hosting · DPA not stated
?✕??✕
Show answers
- Where data is stored by default
United States: the service is hosted and operated in the US by IFTTT and its service providers.
“The Service is hosted and operated in the United States”
Source: ifttt.com · Checked on
- EU hosting on this plan
No EU hosting.
No EU option stated; the policy says personal data is provided to IFTTT in the US and hosted on US servers.
“is being provided to IFTTT in the U.S. and will be hosted on U.S. servers”
Source: ifttt.com · Checked on
- EU–US Data Privacy Framework
Not listed.
No listing found for search term 'IFTTT'
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Personal data is kept while the account is open (longer where law requires). You can delete the account from your profile ('delete my account') or by request form.
“We retain Personal Data about you for as long as you have an open account with us”
Source: ifttt.com · Checked on
- Make
Teams · $29 / user / mo
Doesn't say whether it trains on your dataEU hosting available · DPA on request
?✓✓✓✓
Show answers
- Where data is stored by default
Chosen per organisation at creation: EU (Ireland; Germany for Enterprise) or US; it cannot be changed later
Source: help.make.com · Checked on
- EU hosting on this plan
EU hosting available.
Yes, when the organisation is created
Source: help.make.com · Checked on
- Data processing agreement (DPA)
DPA on request.
Yes. Celonis DPA for Make (last modified 3 May 2024) forms part of the agreement
Source: make.com · Checked on
- Sub-processors (companies that handle the data for them)
12 listed.
Public (effective 12 Dec 2025): 18 third parties; AI services OpenAI, Anthropic, Google and Groq (US hosting) and Microsoft (France), used for customers who use AI features
Source: assets.ctfassets.net · Checked on
- EU–US Data Privacy Framework
On the list.
Active (Celonis Inc; EU-US, Swiss-US, UK Extension); Make itself is run by Celonis entities in the EU
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Log data is stored for 30 days by default; longer storage is offered on Enterprise. Run history length depends on the plan
Source: make.com · Checked on
- Security certifications
SOC 2 Type II and SOC 3 audits completed; GDPR adherence. No ISO certification listed
Source: make.com · Checked on
- Microsoft Power Automate
Premium · €13.00 / user / mo
Doesn't train on your dataEU hosting available · DPA in the terms
✓✓✓?✓
- n8n Cloud
Pro · €50 / mo
Doesn't train on your dataData in the EU by default · DPA on request
✓✓✓✓✓
- Pipedream
Startup · $99 / mo
Doesn't say whether it trains on your dataEU hosting not documented · DPA in the terms
??✓✓–
Show answers
- Where data is stored by default
United States: hosted on Amazon Web Services in the us-east-1 region.
“Pipedream is hosted on the Amazon Web Services (AWS) platform in the us-east-1 region.”
Source: pipedream.com · Checked on
- Data processing agreement (DPA)
DPA in the terms.
Yes. A Data Protection Addendum with Standard Contractual Clauses is part of the standard Terms of Service.
“includes a Data Protection Addendum as part of our standard Terms of Service.”
Source: pipedream.com · Checked on
- Sub-processors (companies that handle the data for them)
11 listed.
Public list at https://pipedream.com/docs/subprocessors: 11 entries (updated 20 Aug 2025). AI providers: Anthropic and OpenAI (AI services), Langfuse (AI application monitoring).
“Below, you’ll find a list of Pipedream’s Subprocessors in our capacity as a Processor”
Source: pipedream.com · Checked on
- EU–US Data Privacy Framework
Parent company listed.
Not listed under its own name (Pipedream, Inc.); its parent Workday, Inc. is active (EU-US DPF, Swiss-US DPF, UK Extension)
Source: dataprivacyframework.gov · Checked on
- How long data is kept
Code and configuration are kept until you delete them; event data and logs follow the retention rules on your account; backups of deleted customer data are cleared within 30 days.
“Pipedream deletes customer data in backups within 30 days.”
Source: pipedream.com · Checked on
- Security certifications
One named: SOC 2 Type 2 (report on request). GDPR compliance is also stated; no ISO certification is named.
“Pipedream has demonstrated SOC 2 compliance and can provide a SOC 2 Type 2 report upon request”
Source: pipedream.com · Checked on
- Tray.ai
Pro · Quote only
Doesn't train on your dataEU hosting not documented · DPA in the terms
✓?✓✓✓
- Zapier
Team (+1) · From €63.09 / mo
Trains on your data unless you switch it offNo EU hosting · DPA in the terms
✕✕✓✓✓
Example
Zapier, plan by plan
Team
BusinessTrains on your data unless you switch it off
No EU hosting · DPA in the terms
Price: From €63.09 / mo
Shortlist
Which automation tool keeps data in the EU?
- Activepieces · EU available
- Make · EU available
- Microsoft Power Automate · EU available
- n8n Cloud · EU by default
- All tools
Browse
Other questions and types of tool
Which tools train on your dataWhich keep data in the EUWhich include a DPAWho else handles your dataWho is on the Data Privacy Framework
AssistantsWriting and emailMeetings and notesPhone and voiceWorkspace and projectsSales, marketing and supportCode and app buildersDesign, images and videoDocuments, HR and financeResearch, forms and storage
No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.
Need something your tools can't do?
We design and build what your team is missing, around the way you already work and the data rules you set.
FAQ
Frequently asked questions
1 of 9 train on your data on the plan shown, unless someone switches it off: Zapier.