Spendesk and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. The customer terms state that Customer Data is not made available to train or improve AI models, whether Spendesk's own or its providers'.

Vendor's wording: “Spendesk does not make Customer Data available for the purpose of training or improving artificial intelligence models, whether its own models or those of its third-party providers.”

Source: spendesk.comCustomers T&Cs, 6.3 'Use of Customer Data by artificial intelligence systems'Checked on 19 October 2026

EU. Personal data is hosted on secure servers in the European Union; the security page names AWS as the host. Transfers outside the EU use adequacy or SCCs.

Vendor's wording: “The Personal Data processed by Spendesk is hosted on secure servers within the European Union.”

Source: spendesk.comPrivacy policy, F 'Hosting and transfer of Personal Data'Checked on 19 October 2026

DPA on request.

Yes. Annex 3 to the Customers T&Cs is the data processing agreement and covers all platform and payment processing; it comes with the contract, not a separate signature.

Vendor's wording: “Spendesk acts as a data processor in accordance with the terms of Annex 3 (Data Processing Agreement)”

Source: spendesk.comCustomers T&Cs, section 15 and Annex 3 'Data Processing Agreement'Checked on 19 October 2026

Published.

Yes. 25 entries: 21 third-party companies plus 4 Spendesk group entities. AI providers on the list: Anthropic Ireland (Claude Enterprise), Google Cloud France (cloud hosting and AI) and Dust. The Terms (6.4) also name Google LLC (Gemini, OCR).

Vendor's wording: “Anthropic Ireland, Limited (Claude Enterprise)”

Source: spendesk.com'Third-party sub-processors' tableChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Spendesk SAS, Paris)

Vendor's wording: “Spendesk SAS - Data Protection Officer (DPO) - 51 rue de Londres, 75008 Paris, France”

Source: spendesk.comPrivacy policy, section G (DPO postal address)Checked on 19 October 2026

Export window of 30 days after termination, then data is kept under Spendesk's internal retention policy and legal rules. The DPA deletes or returns data on written request.

Vendor's wording: “Upon expiry of the thirty (30) day Recovery Period defined above, Spendesk shall deactivate the Customer's access to its data hosted on the Platform.”

Source: spendesk.comCustomers T&Cs, 18.8 'Post-termination data access' and Annex 3Checked on 19 October 2026

ISO/IEC 27001:2022 certified, with the certificate in the trust centre. The page also lists GDPR, PCI-DSS through partners, DORA and the SCA.

Vendor's wording: “Spendesk also holds the ISO 27001:2022 certification”

Source: spendesk.comSecurity page, 'ISO 27001:2022' sectionChecked on 19 October 2026