Data

Tray.ai and the GDPR: AI training, data location and DPA

Pro: Doesn't train on your data. EU hosting not documented · DPA in the terms.

Vendor: Tray.ai, Inc.AutomationChecked on How we check

Verdict

Is Tray.ai GDPR compliant?

Pro

Business

Doesn't train on your data

EU hosting not documented · DPA in the terms

Price: Quote only

No tool is GDPR compliant on its own: that depends on how your business uses it. This page shows the vendor's side, from its own pages. It is not legal advice.

Training

Does Tray.ai train on your data?

Trains on your data by default?

Checked

Doesn't train on your data.

No. The master subscription agreement says Tray will not use Customer Data to train large language models or AI systems.

Vendor's wording: “Tray will not use Customer Data to (i) train any large language models or artificial intelligence systems”

Source: tray.aiMerlin AIChecked on

Location

Where does Tray.ai store your data?

Where data is stored by default

Checked

United States on Amazon Web Services by default; EU (AWS Ireland) or APAC (Australia) only when that region is selected.

Vendor's wording: “Where an EU or APAC region has been selected, only the following will be used.”

Source: tray.aiCore Sub-processors / EU and APAC Core Sub-processorsChecked on

EU hosting on this plan

Checked

EU hosting not documented.

Available but not shown as included in Pro: the pricing page lists 'Regional hosting' on the Enterprise card and among the paid add-ons. The trust page says customers choose US, EU or APAC hosting.

Vendor's wording: “Advanced on-premise SSO, HIPAA, Regional hosting”

Source: tray.aiEnterprise plan cardChecked on

Contract

Does Tray.ai sign a data processing agreement?

Data processing agreement (DPA)

Checked

DPA in the terms.

Yes. A standard DPA with EU Standard Contractual Clauses is incorporated by reference into the customer agreement.

Vendor's wording: “This DPA shall be incorporated by reference into the agreement between Customer and Tray”

Source: tray.aiIntroductionChecked on

Processors

Who else handles Tray.ai data?

Sub-processors (companies that handle the data for them)

Checked

12 listed.

Public list at https://tray.ai/legal/sub-processors/ (updated 12 July 2024): 16 rows, 10 companies. AI provider: OpenAI, optional and opt-in only.

Vendor's wording: “In the course of running the Tray platform we will use a range of third party sub-processors to process customer’s personal data in their workflows.”

Source: tray.aiSub-processorsChecked on

EU–US Data Privacy Framework

Checked

On the list.

Active (Tray.ai; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Tray.ai'Checked on

Retention

How long does Tray.ai keep your data?

How long data is kept

Checked

Pro plan keeps logs for 7 days. On termination Tray deletes or returns personal data per the agreement (no day count given).

Vendor's wording: “7-day insights 7-day log retention 700+ connectors”

Source: tray.aiPro plan cardChecked on

Security

Which certifications and admin controls does Tray.ai have?

Security certifications

Checked

Two audited attestations named: SOC 1 Type 2 and SOC 2 Type 2 (examined by Schellman, 1 Aug 2024 to 31 Jul 2025); annual penetration tests. HIPAA, GDPR and CCPA are listed as privacy compliance; no ISO named.

Vendor's wording: “We complete SOC 1 and SOC 2 Type 2 audits, conduct annual penetration tests”

Source: tray.aiSecurity in every layer / AttestationsChecked on

Admin controls for AI

Checked

Yes. An administrative user can disable Merlin AI in the customer's account settings.

Vendor's wording: “Customer’s administrative user may disable Merlin AI in Customer’s account settings.”

Source: tray.aiMerlin AIChecked on

The vendor doesn't say: price.

Alternatives

Tray.ai alternatives that don't train on your data

Other automation tools whose business plan doesn't train on your data and includes a DPA.

The five marks, in order: No AI training · EU hosting · DPA · Sub-processors listed · DPF or EU vendor. ✓ meets it, ✕ doesn't, – partly, ? not stated.

Tool · PlanVerdictYour five rules
  • n8n Cloud

    Pro · €50 / mo

    Doesn't train on your dataData in the EU by default · DPA on request

    ✓✓✓✓✓

  • Microsoft Power Automate

    Premium · €13.00 / user / mo

    Doesn't train on your dataEU hosting available · DPA in the terms

    ✓✓✓?✓

Need something your tools can't do?

We design and build what your team is missing, around the way you already work and the data rules you set.

Book a callServices