GDPR-compliant project management and workspace tools: 34 checked

DPA on request.

Yes, on request: Lucid's Trust Center says Lucid will enter into a DPA. How it is requested or signed is not shown (the Terms page on lucid.co could not be read).

“Will enter into a DPA”

Source: trust.lucid.co · Checked on 19 October 2026

On the list.

Active (Lucid Software Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Trust Center shows 12 badges: SOC 2 Type II, ISO 27001:2022, ISO 27701, ISO 42001, FedRAMP Moderate, IRAP, PCI and TX-RAMP (8 audits/certifications), plus CSA, SIG, GDPR and CCPA. Company-wide.

“ISO 27001:2022 ISO 27701 ISO 42001 PCI SIG SOC 2 Type II TX-RAMP”

Source: trust.lucid.co · Checked on 19 October 2026

Yes. Admins on Team and Enterprise accounts can switch Lucid AI on or off for all users of the account (Admin menu, 'Enable Lucid AI' toggle). AI is on by default.

“Admins on Team and Enterprise accounts can control whether or not to give users on their account access to AI features.”

Source: help.lucid.co · Checked on 19 October 2026

On the customer's own servers or private cloud: Professional is a self-hosted licence, so Mattermost does not host the messages. A Mattermost-run cloud is described only for the Enterprise plan.

“Maintain full ownership of your data with deployment on your own infrastructure or private cloud.”

Source: mattermost.com · Checked on 19 October 2026

EU hosting available.

Yes, by choice of hosting: the customer can run the software in an EU data centre or private cloud. No Mattermost-run EU region is described for Professional.

“Maintain full ownership of your data with deployment on your own infrastructure or private cloud.”

Source: mattermost.com · Checked on 19 October 2026

DPA on request.

Yes. Mattermost offers a Data Processing Addendum that supplements the customer terms or master subscription agreement; an authorised person signs it via a link on the DPA page.

“Mattermost offers a Data Processing Addendum that supplements the Customer Terms of Service or any master subscription agreement.”

Source: mattermost.com · Checked on 19 October 2026

Published.

Yes, public: https://mattermost.com/subprocessors/ . 13 third-party subprocessors plus 4 Mattermost affiliates (last updated 23 Dec 2024). AI providers listed: Anthropic PBC and OpenAI Inc. (AI Services).

“Mattermost and its affiliates may engage third parties (each a “Subprocessor”) to process your Personal Data.”

Source: mattermost.com · Checked on 19 October 2026

On the list.

Active (Mattermost, Inc; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Kept in the customer's own database. By default deleted messages are only hidden (soft delete); retention rules that permanently delete after a set age (e.g. 30 or 90 days) are described for Enterprise customers; not stated for Professional.

“Mattermost Enterprise customers can set a global retention policy as well as custom retention policies”

Source: docs.mattermost.com · Checked on 19 October 2026

2 named: SOC 2 Type II (report 2025, bridge letter 2026) and ISO 27001 (2022 certificate).

“Mattermost ISO 27001 (2022) Certificate”

Source: trust.mattermost.com · Checked on 19 October 2026

Yes. The AI Agents plugin can be enabled or disabled system-wide by an admin, and it only works once an admin configures an LLM provider.

“toggle to enable or disable the plugin system-wide”

Source: docs.mattermost.com · Checked on 19 October 2026

In the geographic region of your Microsoft 365 organization (for example Americas, EMEA, APAC, or a country such as Germany for new tenants); the admin can see it under Settings > Organization profile > Data location.

“Data in Teams resides in the geographic region associated with your Microsoft 365 or Office 365 organization.”

Source: learn.microsoft.com · Checked on 19 October 2026

EU hosting available.

Yes, by tenant region: new tenants can have Teams data in countries such as France, Germany, Italy, Poland, Sweden; EMEA otherwise. The paid Multi-Geo add-on is not available to small-business subscriptions.

“Teams currently offers data residency in Australia, Brazil, Canada, France, Germany, India, Italy, Japan, Norway, Poland, Qatar, South Korea, South Africa, Sweden”

Source: learn.microsoft.com · Checked on 19 October 2026

DPA in the terms.

Yes. The Microsoft Products and Services Data Protection Addendum is the data processing and security terms for subscribed products, an addendum to the Product Terms.

“the data processing and security terms are defined in Microsoft Online Services Data Protection Addendum (DPA). The DPA is an addendum to the Product Terms site”

Source: microsoft.com · Checked on 19 October 2026

On the list.

Active (Microsoft Corporation; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

4 named: ISO 27001, ISO 27018, SOC 1 and SOC 2 (SSAE18). The same list also names HIPAA and EU Model Clauses.

“These standards are the compliance certifications Teams holds.”

Source: learn.microsoft.com · Checked on 19 October 2026

Wherever the customer (or the hosting partner they pick) runs the server: Enterprise is installed on the customer's own infrastructure, so Nextcloud has no default region.

“The actual compliance with regulations depends on the hosting solution used for Nextcloud Enterprise.”

Source: nextcloud.com · Checked on 19 October 2026

EU hosting available.

Yes by design: the customer chooses where the server runs, including a server in their own country; the compliance page says to keep the server location in your country.

“Legal compliance: Federal data protection and GDPR-compliant, protecting data sovereignty, keep the server location in your country.”

Source: nextcloud.com · Checked on 19 October 2026

No DPA.

Not needed in the usual setup: Nextcloud says Nextcloud GmbH has no access to customer data in self-hosted Enterprise, so no data processor agreement is required. A DPA would apply to a hosted setup, but none is published.

“Nextcloud is fundamentally designed so that Nextcloud GmbH does not have any access to customer data, removing the need for a data processor or controller agreement”

Source: nextcloud.com · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, Nextcloud GmbH, Stuttgart, Germany)

“Nextcloud GmbH (hereinafter collectively referred to as “the controller” or “Nextcloud” or “we” or “us”) as the operator of this website”

Source: nextcloud.com · Checked on 19 October 2026

Compliance page shows 7 badges: PCI DSS, ANSSI CSPN, Blauer Engel, ISO/IEC 27001, BSI C5, REUSE, OpenSSF Best Practices. It adds that Enterprise can only be certified together with a deployment, and Nextcloud Files is CSPN-certified.

“As we do not operate Nextcloud Enterprise for our customers nor control how they use it, as a on-premises hosted solution, Nextcloud Enterprise can only be certified as a whole in combination with a deployment.”

Source: nextcloud.com · Checked on 19 October 2026

Yes: AI features are optional and only run if an administrator installs the separate AI apps and connects a model back end; for example Mail's AI text processing is switched on under Administration settings > Groupware > Mail.

“All of these features are completely optional. If you want to have them on your server, you need to install them via separate Nextcloud Apps.”

Source: docs.nextcloud.com · Checked on 19 October 2026

€204.75 / user / yr.

€204.75 per user per year for Ultimate, minimum 100 users, sold by quote (no self-serve purchase). VAT treatment not shown.

“Starting at 100 users for 204.75€/user/year”

Source: nextcloud.com · Checked on 19 October 2026

The customer's own infrastructure (on-premises, private cloud or isolated) for Commercial; for Rocket.Chat-hosted workspaces the customer picks the location at onboarding (providers listed: OVH, AWS).

“The customer determines the location where an instance of our hosted offering is deployed during onboarding.”

Source: docs.rocket.chat · Checked on 19 October 2026

EU hosting available.

Yes. Self-managed deployments keep data wherever the customer hosts them, and for Rocket.Chat-hosted workspaces the customer determines the location at onboarding; specific EU regions are not named.

“The customer determines the location where an instance of our hosted offering is deployed during onboarding.”

Source: docs.rocket.chat · Checked on 19 October 2026

DPA on request.

Yes. A pre-signed Data Processing Agreement with EU Standard Contractual Clauses is available; the customer completes and signs it online (request via email code, sign through Zoho Sign). It covers the hosted offering and push/marketplace services.

“It is pre-signed and only needs to be signed from your end for your compliance purposes.”

Source: docs.rocket.chat · Checked on 19 October 2026

Published.

Yes, public: https://docs.rocket.chat/docs/subprocessors (effective 6 March 2025). 12 third-party rows (3 infrastructure, 7 service-specific, 2 innovation) plus 2 affiliates. No AI model providers listed.

“The list below identifies subcontractors (subprocessors) that Rocket.Chat may be used to process personal data while provisioning our services.”

Source: docs.rocket.chat · Checked on 19 October 2026

Not listed.

No listing found for search term 'Rocket.Chat'

Source: dataprivacyframework.gov · Checked on 19 October 2026

The customer can export all data and request deletion of accounts. After the agreement ends the customer must retrieve data within 30 business days, after which Rocket.Chat may delete it irrecoverably. Commercial adds granular retention policies.

“Customer will retrieve its Data or copies of its Data from Rocket.Chat within thirty (30) business days of the termination or expiration of this Agreement Terms.”

Source: docs.rocket.chat · Checked on 19 October 2026

Admins manage Rocket.Chat AI from Manage > Workspace > AI Center. AI is a paid add-on that needs the customer's own LLM connected, so it runs only if the customer sets it up.

“Administrators can manage Rocket.Chat AI from Manage > Workspace > AI Center.”

Source: docs.rocket.chat · Checked on 19 October 2026

Nothing to do for third-party training: Smartsheet says customer data is not used to train third-party foundation models. No setting or opt-out is described.

“No, your data never leaves your control, never mixes with other customers, and never trains third-party foundation models.”

Source: smartsheet.com · Checked on 19 October 2026

AWS in the United States (Virginia/Ohio) for the Commercial environment, which is the default.

“By default, customers are hosted in AWS East, with regional options available via Smartsheet Regions.”

Source: smartsheet.com · Checked on 19 October 2026

EU hosting available.

Yes: Smartsheet Regions lets customers host in the US, EU or Australia (the EU environment runs on AWS in Germany and Ireland); the pricing FAQ says to contact sales, and no official page names which plans include it.

“Smartsheet Regions lets you choose — US, EU, or Australia — so you can meet regional compliance requirements”

Source: smartsheet.com · Checked on 20 October 2026

DPA in the terms.

Yes. Smartsheet has a standard Data Processing Addendum that includes the EU Standard Contractual Clauses; it is linked from the legal pages.

“the SCCs are incorporated as part of Smartsheet’s standard DPA as detailed below.”

Source: smartsheet.com · Checked on 19 October 2026

On the list.

Active (Smartsheet Inc.; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

AI prompts and outputs are stored with the sheet data and deleted within 180 days after the contract ends; Smartsheet can keep them for support and abuse monitoring. AI providers do not store them beyond generating a response.

“Input prompts and generated outputs are deleted by”

Source: smartsheet.com · Checked on 19 October 2026

4 named: SOC 2, ISO 27001, ISO 27701 and FedRAMP; ISO 42001 (AI management) is stated as being pursued, not held. HIPAA use needs a BAA on Enterprise.

“Smartsheet adheres to leading security and compliance frameworks, including SOC 2, ISO 27001, ISO 27701, and FedRAMP.”

Source: smartsheet.com · Checked on 19 October 2026

Yes. System administrators choose which AI capabilities are activated for end users using AI activation controls in the admin center.

“system administrators can choose which AI capabilities are activated for end users using AI activation controls in the admin center.”

Source: smartsheet.com · Checked on 19 October 2026

€22 / user / mo.

Business: EUR 22 per member/month billed monthly, or EUR 17 billed yearly (page prints '2217€'); 3+ members; VAT not stated.

“2217€ per Member/month £1915 per Member/month ¥3,2002,500 per Member/month”

Source: smartsheet.com · Checked on 19 October 2026

Doesn't train on your data.

No, for Todoist's own use: the privacy policy says information collected, including via AI tools, is not used to develop, improve or train generalized or non-personalized AI or machine learning models. Training by its third-party LLM providers is not stated.

“However, we do not use information we collect from you, including via artificial intelligence tools, to develop, improve, or train generalized/non-personalized artificial intelligence or machine learning models.”

Source: todoist.com · Checked on 19 October 2026

Nothing to switch off: this plan doesn't train on your data.

Nothing to do for Todoist's own training: the privacy policy states it does not use collected information to train generalized AI or machine learning models.

“we do not use information we collect from you, including via artificial intelligence tools, to develop, improve, or train generalized/non-personalized artificial intelligence or machine learning models.”

Source: todoist.com · Checked on 19 October 2026

United States, on Amazon Web Services servers.

“We use Amazon Web Services (AWS) servers to host all user data.”

Source: todoist.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Doist'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Information is kept as long as needed for the stated purposes. When an account is deleted, data is removed from production systems and usually only an encrypted backup copy remains for 90 days. No retention setting for AI prompts is stated.

“upon deleting your account, all your Information will be removed from our production systems. Usually, only an encrypted copy of your Information will remain on our backup archives for 90 days”

Source: todoist.com · Checked on 19 October 2026

1 named: SOC 2 Type II (certified as of December 2025). Report is in the trust centre.

“Yes. Todoist is SOC2 Type II certified as of December 2025.”

Source: todoist.com · Checked on 19 October 2026