Nitro PDF and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Nitro says your inputs are never used to train OpenAI or other generative AI models; Nitro builds no models of its own.

Vendor's wording: “Your data is not used for training generative AI: Your inputs are never used to train OpenAI LLMs or other generative AI models.”

Source: gonitro.comData privacy and security at Nitro: Nitro's Document AssistantChecked on 19 October 2026

DPA on request.

Yes. An EU Data Processing Addendum applies to business customers and forms part of the Terms of Service as a single agreement; Order Forms are signed for the services.

Vendor's wording: “This Data Processing Addendum supplements and forms part of the Terms of Service, and together the Terms of Service and this Data Processing Addendum constitute a single legal agreement”

Source: gonitro.comIntroductionChecked on 19 October 2026

Published.

Yes, public list at https://www.gonitro.com/security-compliance/data-protection/subprocessors-and-subcontractors: 18 sub-processors for Nitro PDF. AI providers: Microsoft Azure (OpenAI hosted on Azure) and Amazon Comprehend (form and table extraction).

Vendor's wording: “Nitro uses certain sub-processors to provide services to its customers.”

Source: gonitro.comNitro PDF - All sub-processorsChecked on 19 October 2026

On the list.

Active (Nitro Software; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Nitro Software'Checked on 19 October 2026

AI Document Assistant: documents are processed temporarily and deleted when the task finishes. Other data is kept until you delete it or the contract ends, plus up to 30 days; you can have data deleted or returned at contract end.

Vendor's wording: “Documents are processed temporarily for the requested task and deleted once the task is complete.”

Source: gonitro.comData privacy and security at Nitro: Nitro's Document AssistantSecond source: gonitro.comChecked on 19 October 2026

SOC 2 Type 2 and ISO 27001:2022 are certified for Nitro PDF; HIPAA/HiTrust is assessed. 2 certifications (plus DPF participation and QTSP accreditation for Nitro Sign).

Vendor's wording: “We undergo independent third-party audits and maintain internationally recognized certifications, including ISO 27001, SOC 2, HIPAA, QTSP accreditation, and Data Privacy Framework certification”

Source: gonitro.comCompliance across Nitro solutionsChecked on 19 October 2026

Partly: Document Assistant requires opt-in for larger organisations, so it is not on by default. The pages do not describe an admin switch to turn it off afterwards.

Vendor's wording: “Document Assistant is enabled for individual online purchasers and requires opt-in for larger organizational users.”

Source: gonitro.comFAQ: Responsible AI at NitroChecked on 19 October 2026