Lokalise and the GDPR: AI training, data location and DPA

Trains on your data unless you switch it off.

Yes, unless you object: Lokalise may use your AI inputs and outputs to improve its AI features and train its own models (e.g. AI Scoring). Training of third-party LLMs on your data is not permitted.

Vendor's wording: “If you consent (or do not object) to Lokalise’s use of Input and Output to improve the AI Features”

Source: lokalise.com3. Use and Ownership of Input and OutputChecked on 19 October 2026

You can switch the training off.

Object to or withdraw consent: the AI Addendum promises 'reasonable means' to do so, and the AI statement says to email privacy@lokalise.com for requests about data use in AI. No admin menu path is published; withdrawing may limit AI features.

Vendor's wording: “Opt-out controls: Customers can opt out of AI training data use at any time via the AI Addendum.”

Source: lokalise.com6.2 Human Oversight and Control, Opt-out controlsChecked on 19 October 2026

EU: customer data is processed on EU-based AWS infrastructure (AWS Germany per sub-processor list).

Vendor's wording: “processes customer data on EU-based AWS infrastructure”

Source: lokalise.comLokalise security and complianceChecked on 19 October 2026

EU hosting not documented.

Default is EU-based AWS hosting for all customers; no separate region setting or plan option is described.

Vendor's wording: “processes customer data on EU-based AWS infrastructure”

Source: lokalise.comLokalise security and complianceChecked on 19 October 2026

DPA on request.

Yes: pre-signed DPA, incorporated into the Terms of Service; to countersign, download it, fill in the customer section and email privacy@lokalise.com.

Vendor's wording: “The Addendum has been pre-signed on behalf of Lokalise.”

Source: lokalise.comLokalise Data Processing AddendumChecked on 19 October 2026

Published.

Yes: https://lokalise.com/sub-processors/ (updated 1 Aug 2026) lists 49 entries incl. AWS, Google, Microsoft Translate, DeepL, OpenAI, Anthropic. A separate AI list at /ai-subprocessor-list/ has 7 rows (AWS Bedrock, OpenAI, Anthropic, Google, Microsoft, DeepL, Vertex AI).

Vendor's wording: “Lokalise may use the following Sub-processors to the Services to you:”

Source: lokalise.comList of Lokalise Sub-processorsChecked on 19 October 2026

On the list.

Active (Lokalise Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Lokalise'Checked on 19 October 2026

On contract end all customer data is automatically deleted, except where the law requires keeping it (no period given). Audit logs 12 months. AI provider retention: OpenAI prompts 30 days, AWS Bedrock none.

Vendor's wording: “Upon contract termination, all customer data is automatically deleted from Lokalise systems, except where retention is required by law.”

Source: lokalise.comFAQ: Lokalise data handlingChecked on 19 October 2026

SOC 2 Type II, ISO 27001 and ISO 27017 (3 certifications; ISO since Nov 2020). Not PCI DSS certified.

Vendor's wording: “Lokalise holds SOC 2 Type II, ISO 27001, and ISO 27017 certifications”

Source: lokalise.comLokalise holds the following certificationsChecked on 19 October 2026