Taskade and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Taskade does not use workspace content to train generalized AI models, and its contracts bar its AI providers from training on it.

Vendor's wording: “Taskade does not use your workspace content to train generalized AI models, and our agreements with third-party AI providers prohibit them from using your content to train their general models.”

Source: taskade.comTerms of Service, AI Features and Processing, No Training on Customer ContentChecked on 19 October 2026

Amazon AWS, US East (single region). AI requests can also be processed by providers outside the US, EU and UK depending on the model chosen.

Vendor's wording: “Single AWS region (US East)”

Source: taskade.comSecurity page, Business continuityChecked on 19 October 2026

No DPA.

No. The security page says Taskade does not currently offer a signed Data Processing Agreement or Standard Contractual Clauses to customers.

Vendor's wording: “We do not currently offer a signed Data Processing Agreement or Standard Contractual Clauses to customers.”

Source: taskade.comSecurity page, Compliance and auditingChecked on 19 October 2026

Not public.

No public list. Taskade sends an AI sub-processor list on request by email; the privacy policy names OpenAI, Anthropic, Google, AWS and open-weight model makers as examples, not a complete list.

Vendor's wording: “We keep a current list of the AI providers your account can be routed to, and we will send it to you on request.”

Source: taskade.comPrivacy Policy, AI Service ProvidersChecked on 19 October 2026

Not listed.

No listing found for search term 'Taskade'

Source: dataprivacyframework.govSearch 'Taskade' returned 'Query returned no results'Checked on 19 October 2026

Workspace content is kept until you delete it or close the account; Taskade aims to remove account data within 30 days of deletion; AI interaction logs are kept normally no more than 30 days. Targets, not contractual periods.

Vendor's wording: “Workspace content: projects, documents, and messages are kept until you delete them or close your account.”

Source: taskade.comPrivacy Policy, Data RetentionChecked on 19 October 2026

None held. SOC 2 Type II and ISO 27001 are listed as in progress with no report; Google CASA assessment completed for Google API scopes (not a general certification).

Vendor's wording: “We have no SOC 2 report to hand you yet, and we are not on a fixed external audit cadence.”

Source: taskade.comSecurity page, Compliance & CertificationsChecked on 19 October 2026