Basecamp and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. 37signals says it does not use your content to train AI models, and the AI providers it works with are contractually barred from training on it.

Vendor's wording: “we don’t use your content to train AI models. The AI providers we work with are also contractually prohibited from training their models on your content.”

Source: 37signals.comPrivacy Policy, Artificial intelligenceChecked on 19 October 2026

United States. The policy says products are primarily housed in the U.S. and that data from the EU or UK is transferred to and stored there. Hosting provider not named.

Vendor's wording: “Our products and other web properties are primarily housed in the United States.”

Source: 37signals.comPrivacy Policy, data transfersChecked on 19 October 2026

DPA on request.

Yes. 37signals has a Data Processing Addendum with Standard Contractual Clauses, published as PDF, HTML and Markdown, and it takes precedence over the main terms.

Vendor's wording: “37signals has adopted a data processing addendum with Standard Contractual Clauses to help ensure this protection.”

Source: 37signals.comPrivacy Policy, international transfersChecked on 19 October 2026

Published.

Yes, public at https://37signals.com/policies/privacy/basecamp-subprocessors: 12 entries. AI providers listed: Anthropic and OpenAI, described as AI assistant tools used by staff.

Vendor's wording: “The following is a list of personal data subprocessors we use.”

Source: 37signals.comBasecamp SubprocessorsChecked on 19 October 2026

Not listed.

No listing found for search term '37signals'

Source: dataprivacyframework.govSearch '37signals' returned 'Query returned no results'Checked on 19 October 2026

Content is kept while the account is active. Trashed items stay accessible about 25 days and may remain on servers 30 more days; if you cancel, content is inaccessible at once and purged within 60 days, with backups also holding copies for a limited time.

Vendor's wording: “If you choose to cancel your account, your content will become immediately inaccessible and should be purged from our systems in full within 60 days.”

Source: 37signals.comPrivacy Policy, What happens when you delete contentChecked on 19 October 2026

No security certification such as SOC 2 or ISO 27001 is named. The security page names a PCI DSS compliance certificate (card payments, SAQ A self-assessment) and a published CSA CAIQ v4.1 self-assessment.

Vendor's wording: “Our current PCI DSS Certificate of Compliance (PDF), issued by SecurityMetrics on our SAQ A self-assessment, is renewed annually.”

Source: 37signals.comSecurity policy, billing informationChecked on 19 October 2026

Not applicable: the policy says the products do not include built-in AI features that process your content, so there is no AI switch. Optional AI-assistant connectors exist (basecamp.com/ai).

Vendor's wording: “Our products don’t include built-in AI features that process your content”

Source: 37signals.comPrivacy Policy, Artificial intelligenceChecked on 19 October 2026