Evernote Enterprise and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Evernote says it does not use what you put into AI features, or the results, to train its own or third-party AI models.

Vendor's wording: “We do not use your Input or Output to train our artificial intelligence models or tools, or those of third-party AI model providers.”

Source: evernote.comPrivacy Policy, AI FeaturesSecond source: evernote.comChecked on 19 October 2026

United States: the security page says all Evernote data resides inside the US, hosted on Google Cloud Platform.

Vendor's wording: “All Evernote data resides inside the United States.”

Source: evernote.comSecurity page, data hostingChecked on 19 October 2026

No EU hosting.

No selectable EU region is described. The DPA commits Evernote to process and retain Customer Personal Data within the EEA only to the extent EU data protection law requires; the Terms and security page say data is stored in the United States.

Vendor's wording: “To the extent required under Applicable Data Protection Law, Processor shall process and retain Customer Personal Data within the EEA”

Source: evernote.comDPA, data location clauseChecked on 20 October 2026

DPA in the terms.

Yes. An Enterprise Data Processing Addendum is incorporated into the Evernote Enterprise Agreement and applies where Evernote processes personal data for the customer.

Vendor's wording: “is incorporated into the Evernote Enterprise Agreement (“Agreement”). This Addendum applies to the extent that Processor processes Customer Personal Data”

Source: evernote.comEnterprise Data Processing Addendum, opening paragraphChecked on 19 October 2026

Published.

Yes: https://evernote.com/privacy/vendors lists 11 vendors (Bird, Calendly, Datadog, Fastly, Google Cloud, Google Analytics, hCaptcha, Invision Power Boards, OpenAI, Sentry, Zendesk). OpenAI is the only AI provider, shown with country Ireland.

Vendor's wording: “Invision Power Boards United States Community OpenAI Ireland AI-powered processing”

Source: evernote.comVendors tableSecond source: evernote.comChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Bending Spoons S.p.A., Milan, Italy)

Vendor's wording: “Bending Spoons S.p.A. is the data controller. We’re an Italian tech company based in Via Nino Bonnet 10, Milan, MI 20154.”

Source: evernote.comEntity lineChecked on 19 October 2026

Content is kept until you delete it; backups may hold deleted content for up to 60 days. After the Enterprise agreement ends, Evernote has no duty to keep content and may delete it; the DPA deletes or returns data on written request.

Vendor's wording: “The Evernote Service’s back-up systems may retain residual copies of your deleted Content and attachments for up to 60 days”

Source: evernote.comPrivacy Policy, retentionSecond source: evernote.comChecked on 19 October 2026

1 certification: ISO 27001 (as of November 2025), plus an annual Google CASA Tier 2 security assessment. No SOC 2 named.

Vendor's wording: “Evernote is ISO 27001 certified, as of November 2025.”

Source: evernote.comSecurity pageChecked on 19 October 2026