Teamwork.com and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Teamwork.com does not train its own AI models on customer data, and its third-party AI providers may not train general-purpose models on it.

Vendor's wording: “Teamwork.com does not use Customer Data to train its own AI models.”

Source: teamwork.comAI policy, AI processing sectionChecked on 19 October 2026

Amazon Web Services servers in the US and the EU. The pages do not say which region is the default or how it is chosen. AI features can be processed outside the chosen region.

Vendor's wording: “Our servers are with Amazon Web Services AWS and are hosted within the US and the EU.”

Source: teamwork.comSecurity page FAQ: Where are your servers locatedChecked on 19 October 2026

EU hosting available.

Yes. US or EU data hosting is included in every plan, including Basics. AI processing is not yet region-bound: regional controls for AI are still planned.

Vendor's wording: “US & EU data hosting”

Source: teamwork.comPricing, Basics plan features and 'Included in every plan'Second source: teamwork.comChecked on 19 October 2026

DPA on request.

Yes. A Data Processing Agreement is incorporated into all customer agreements; it is published online and needs no separate signature.

Vendor's wording: “This Data Processing Agreement ("DPA") is incorporated into all agreements and contracts pursuant to which Teamwork Crew Limited”

Source: teamwork.comDPA, opening paragraphChecked on 19 October 2026

Published.

Yes: DPA Schedule 2 lists 10 service sub-processors (AWS, Mailgun, SendGrid, Datadog, DigitalOcean, Zapier, Clicktel, Sentry, LaunchDarkly, Pendo), plus a separate AI list: 5 rows (AWS, OpenAI, Anthropic, Google/Gemini, 'other approved providers').

Vendor's wording: “Large language model services Generation of A.I. responses based on user input”

Source: teamwork.comAI Sub-processors tableSecond source: teamwork.comChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Teamwork Crew Limited, Cork, Ireland)

Vendor's wording: “a company incorporated under the laws of Ireland, with registered number 313652”

Source: teamwork.comEntity lineChecked on 19 October 2026

Data is kept for the term of the agreement and deleted as soon as reasonably practicable after termination (customer can request the latest backup within 10 days). AI inputs not saved by the user are not retained beyond the request, apart from security logs.

Vendor's wording: “delete (or otherwise dispose of) the Personal Data of the Customer as soon as reasonably practicable unless Teamwork.com receives, no later than ten (10) days after the effective date”

Source: teamwork.comDPA, Termination or expiry (9.1)Second source: teamwork.comChecked on 19 October 2026

2 named: ISO/IEC 27001:2022 and SOC 2 Type 2.

Vendor's wording: “ISO/IEC 27001:2022SOC 2 Type 2 certified”

Source: teamwork.comSecurity page, Our security certificationsChecked on 19 October 2026

Partly. The AI policy says AI features only run through deliberate user actions, and a customer may switch off Desk AI features at any time; no organisation-wide switch for other AI features is described.

Vendor's wording: “The Customer may disable the applicable Desk AI functionality at any time through the available product controls.”

Source: teamwork.comAI policy, AI Functionality: TransparencyChecked on 19 October 2026