Glean and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. The AI Addendum says Glean will not use customer data to train or fine-tune any AI model; for services using Glean's own model key, its model providers are contractually barred too.

Vendor's wording: “Glean will not use Customer Data to train, re-train, improve, or fine-tune any AI Models.”

Source: glean.comSection 3a No Training on Customer DataChecked on 19 October 2026

Not stated as one default. The sub-processor page lists every provider in the United States (AWS, Google and Microsoft carry a note that customers may select a different cloud provider and location).

Vendor's wording: “*Customers have discretion to select a different Cloud Service Provider and location.”

Source: glean.comSubprocessors table, footnoteChecked on 19 October 2026

DPA on request.

Yes. Glean publishes a form DPA with EU standard clauses; it takes effect when the customer signs it.

Vendor's wording: “This DPA becomes effective on the date that the Customer signs the DPA.”

Source: glean.comOpening paragraphChecked on 19 October 2026

Published.

Yes (https://www.glean.com/legal/subprocessors, updated July 28, 2026): 20 third-party entries plus 1 affiliate (Glean India). AI/model providers: OpenAI, Anthropic, Google, Microsoft, AWS, Baseten, Fireworks.ai, Groq, Modal, Snowflake.

Vendor's wording: “Anthropic PBC LLM Provider United States Baseten Labs, Inc. LLM Provider United States”

Source: glean.comSubprocessors tableChecked on 19 October 2026

On the list.

Active (Glean Technologies Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Glean Technologies'Checked on 19 October 2026

Glean mirrors the retention period the customer sets in its connected apps; its own metadata logs are kept up to 30 days. After termination Glean deletes customer personal data. Model providers keep nothing (zero-day retention) when Glean's own model key is used.

Vendor's wording: “Data importer mirrors the data retention period that data exporter has set as a policy in their respective applications”

Source: glean.comAnnex I.B retention criteriaSecond source: glean.comChecked on 19 October 2026

6 named on the security page: ISO 42001, ISO 27001, SOC 2 Type II, plus HIPAA, TX-RAMP Level 2 and GDPR.

Vendor's wording: “ISO 42001 HIPAA TX-RAMP Level 2 SOC 2 Type II ISO 27001 GDPR”

Source: glean.comEnterprise security and complianceChecked on 19 October 2026