Mural and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Mural does not use your content, or let others use it, to improve, train or develop machine-learning models. It may use anonymised, de-identified AI inputs to analyse usage and improve the AI features.

Vendor's wording: “Mural does not use your Content or permit others to use your Content to improve, train, or develop any machine learning models.”

Source: mural.coAI Addendum, 2. Customer Content, Ownership and UseSecond source: mural.coChecked on 19 October 2026

United States, hosted on Microsoft Azure.

Vendor's wording: “By default, Mural customer data is stored in the United States and hosted on Microsoft Azure.”

Source: mural.coTrust and security FAQ, Where is Mural data stored?Checked on 19 October 2026

No EU hosting.

Not on Business: regional data residency is offered to Enterprise plan customers, set per workspace.

Vendor's wording: “Mural's data residency capabilities enable Enterprise plan customers to designate the region where data is stored.”

Source: mural.coTrust and security FAQ, Does Mural support data residency?Checked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Addendum is part of the agreement and is incorporated by reference into the Mural agreement; questions go to privacy@mural.co.

Vendor's wording: “This Data Processing Addendum sets forth the parties’ obligations with respect to the Processing of Personal Data (definitions in the DPA) and is incorporated by reference into the Agreement.”

Source: mural.coData Processing Addendum, introductionChecked on 19 October 2026

Published.

Yes: https://www.mural.co/terms/subprocessors lists 14 sub-processors (Adobe, Amazon Web Services, Chorus, Databricks, Coresignal, Fivetran, Mandrill/Mailchimp, Microsoft Azure, MongoDB, Salesforce, Twilio Segment, Pendo, Amplitude, New Relic), all in the United States. No AI model provider is named.

Vendor's wording: “Microsoft Azure Cloud Service Provider United States”

Source: mural.coSubprocessors Disclosure tableChecked on 19 October 2026

On the list.

Active (Tactivos, Inc. DBA MURAL; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Tactivos'Checked on 19 October 2026

Content is kept during the subscription. After termination Mural may delete it under its standard data retention policies; no number of days is stated in the terms.

Vendor's wording: “may thereafter, unless legally prohibited, delete any associated Content in our systems or otherwise in our possession or under our control pursuant to our standard data retention policies and procedures.”

Source: mural.coTerms of Service, 4.5 What happens to your ContentChecked on 19 October 2026

4 named: SOC 2 Type 2, SOC 3, ISO 27001, ISO 42001; also Microsoft SSPA certified.

Vendor's wording: “Mural maintains SOC 2 Type 2, SOC 3, ISO 27001, ISO 42001, and other certifications and attestations”

Source: mural.coTrust and security, certificationsChecked on 19 October 2026