Data

Candis and the GDPR: AI training, data location and DPA

Basis: Doesn't train on your data. No EU hosting · DPA in the terms.

Vendor: Candis GmbHDocuments, HR and financeChecked on How we check

Verdict

Is Candis GDPR compliant?

Basis

Business

Doesn't train on your data

No EU hosting · DPA in the terms

Price: From €389 / mo

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Candis train on your data?

Trains on your data by default?

Checked

Doesn't train on your data.

No training across customers. Candis says its AI works only on your own invoice data with no cross-company training; the data processing contract bars use of your data for general AI/LLM training.

Vendor's wording: “Es findet kein unternehmensübergreifendes Training statt”

Source: candis.ioCandis KI FAQSecond source: candis.ioChecked on

Location

Where does Candis store your data?

Where data is stored by default

Checked

Germany: AWS hosting in the Frankfurt data zone.

Vendor's wording: “Hosting in der Datenzone Frankfurt in”

Source: candis.io7.3 SubunternehmerChecked on

EU hosting on this plan

Checked

No EU hosting.

EU only by contract: the AVV says the service is provided exclusively within an EU or EEA state and moving it to a third country needs the customer's prior consent.

Vendor's wording: “Die vertraglich vereinbarte Dienstleistung wird ausschließlich in einem Mitgliedsstaat der Europäischen Union”

Source: candis.io7.4Checked on

Contract

Does Candis sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA in the terms.

Yes. Candis publishes its data processing contract (AVV) as a PDF; it applies to all activities under the usage agreement and AGB.

Vendor's wording: “Sie findet Anwendung auf alle Tätigkeiten, die mit dem Vertragsverhältnis in Zusammenhang stehen”

Source: candis.ioPräambelChecked on

Processors

Who else handles Candis data?

Sub-processors (companies that handle the data for them)

Checked

Published.

Yes, inside the published AVV PDF (section 7.3): 4 entries, 4 companies: Amazon Web Services EMEA Sàrl (hosting), Gini GmbH (reading data from PDFs and scans), Mailjet SAS (notification emails), Google Cloud EMEA (automatic document-type detection). AI-related: Gini, Google Cloud.

Vendor's wording: “werden unter Einschaltung folgender Subunternehmer durchgeführt”

Source: candis.io7.3 SubunternehmerChecked on

EU–US Data Privacy Framework

Checked

EU or Swiss vendor.

Not applicable (EU-based vendor, Candis GmbH, Berlin, Germany)

Vendor's wording: “Candis GmbH CityQuartier DomAquarée Karl-Liebknecht-Straße 5 10178 Berlin”

Source: candis.ioImpressumChecked on

Retention

How long does Candis keep your data?

How long data is kept

Checked

After you give notice of cancellation you can download your content for six weeks (or until the contract ends, if later), then Candis deletes it. Extensions are possible per month for the monthly fee. Retention of AI inputs not stated.

Vendor's wording: “Der Kunde gibt sein Eiverständnis, dass die gespeicherten Inhalte und Dokumente danach durch Candis gelöscht werden.”

Source: candis.io7.3 Vertragsende, Datenaufbewahrung und -löschungChecked on

Price

What does Candis cost?

Price, as shown in Germany

Checked

From €389 / mo.

From €389 per month for Basis, rising with the number of invoices; unlimited users and companies included; VAT treatment not stated. Plus from €599, Max from €789 per month.

Vendor's wording: “ab 389 € pro Monat Berechne deinen Preis je nach Rechnungsanzahl”

Source: candis.ioUnsere Pakete: BasisChecked on

The vendor doesn't say: certifications, admin controls.

Alternatives

Candis alternatives that don't train on your data

Other documents, hr and finance tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • iLovePDF

    Premium · €5 / mo

    Doesn't train on your dataEU hosting available · DPA on request

    ✓✓✓✓✓

  • Pleo

    Build · €14 / user / mo

    Says it doesn't train on your dataData in the EU by default · DPA in the terms

    ✓✓✓✓✓

  • Teamtailor

    subscription by quote · Quote only

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • Tellent Recruitee

    Advance · See details

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓✓✓

  • HiBob

    Bob platform, quote-based · Quote only

    Doesn't train on your dataEU hosting not documented · DPA on request

    ✓?✓✓✓

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices