Pleo and the GDPR: AI training, data location and DPA

Says it doesn't train on your data.

No, according to Pleo's MCP page FAQ: Pleo does not use your data (prompts, inputs or spend data) to train or retrain AI models. Product-page statement; the DPA and privacy policy say nothing on training.

Vendor's wording: “No. Pleo does not use your data - including prompts, inputs, or spend data - to train or retrain AI models.”

Source: pleo.ioFAQ: Does Pleo use my data to train AI models?Checked on 19 October 2026

Ireland: customer data is stored and processed in AWS data centres in Ireland (eu-west-1).

Vendor's wording: “Customer data is stored and processed at data centers located in Ireland (eu-west-1).”

Source: pleo.ioData StorageChecked on 19 October 2026

Data in the EU by default.

EU hosting is the default (AWS Ireland, EU/EEA data centres); no separate setting is described. The sub-processor list also shows US-based providers such as Anthropic (AI) and HubSpot.

Vendor's wording: “AWS data centres are located in the EU/EEA.”

Source: pleo.ioData StorageChecked on 19 October 2026

DPA in the terms.

Yes. The Data Processing Agreement is an integral part of the Master Service Agreement and is deemed executed when the MSA is executed.

Vendor's wording: “The DPA shall be deemed executed at the same time as the execution of the MSA.”

Source: pleo.io1. How to execute this DPAChecked on 19 October 2026

Published.

Yes, public at https://www.pleo.io/en/sub-processors (last updated 29.05.2025): the 'Pleo as a Processor' list has 10 entries, 10 companies (Enfuce, Saltedge, Google Cloud Platform, Microsoft Azure, AWS, Anthropic, Twilio, FreshWork/FreshDesk, HubSpot, Notion Labs). AI provider: Anthropic (US).

Vendor's wording: “Pleo as a Processor - Meet our Sub-Processors!”

Source: pleo.ioPleo as a Processor - Meet our Sub-Processors!Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Pleo Technologies A/S, Copenhagen, Denmark)

Vendor's wording: “Pleo Technologies A/S c/o Ravnsborg Tvaergade 5c, 4, 2200 (HQ) Copenhagen Denmark”

Source: pleo.ioPleo's Presence - Meet our Local Entities!Checked on 19 October 2026

On termination Pleo deletes or returns all customer data at the customer's election, except what the law requires it to keep; backups are isolated until deletion is possible. The customer exports transaction data itself. No fixed number of days is stated.

Vendor's wording: “Upon termination or expiration of the Agreement, Pleo shall (at Customer's election) delete or return to Customer all Customer Data (including copies)”

Source: pleo.io11. Return or deletion of dataChecked on 19 October 2026

PCI-DSS and Google's Cloud Application Security Assessment (CASA) are named (2), plus a HackerOne bug-bounty penetration test, a CAIQ self-assessment and GDPR adherence; no ISO 27001 or SOC 2 named.

Vendor's wording: “These include PCI-DSS for secure payment processing, Google's Cloud Application Security Assessment (CASA) for cloud security”

Source: pleo.ioRegulatory Compliance/CertificationsChecked on 19 October 2026

Yes for connecting outside AI tools: an admin can disable Pleo AI access at any time in Settings > General > Pleo AI, and users can revoke their own connections. Controls for Pleo's built-in AI features are not described.

Vendor's wording: “You can disable this at any time in Settings → General → Pleo AI .”

Source: pleo.ioA note on dataChecked on 19 October 2026

€14 / user / mo.

€14 per user per month (Build), billed yearly, minimum 3 users; VAT not shown (German price page).

Vendor's wording: “14 €Pro Nutzer:in/Monat Jährliche Zahlung Mindestens 3 Nutzer:innen”

Source: pleo.ioBuildChecked on 19 October 2026