Writesonic and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No. Writesonic does not train or fine-tune general-purpose models on customer data (also for its model providers) unless the customer joins a separate training programme. It may use de-identified, aggregated data to improve the service.

Vendor's wording: “Writesonic does not use Customer Data to train or fine-tune any general-purpose, foundation, or large-language model offered by Writesonic or by any Model Provider”

Source: writesonic.com6.4 No Training on Customer DataChecked on 19 October 2026

United States: Microsoft Azure (primary) and Amazon Web Services for select workloads.

Vendor's wording: “Microsoft Azure Primary cloud hosting, storage, networking, compute United States”

Source: writesonic.comSchedule 3 Sub-processors, Cloud hosting and infrastructureChecked on 19 October 2026

DPA in the terms.

Yes. The DPA is part of the Terms of Service and applies automatically.

Vendor's wording: “Writesonic will process such personal data in accordance with the Data Processing Agreement, which is incorporated into and forms part of this Agreement.”

Source: writesonic.comCustomer Data sectionChecked on 19 October 2026

Published.

Yes, in Schedule 3 of the DPA (https://writesonic.com/legal/dpa): 44 entries, all listed as United States. AI providers: OpenAI, Anthropic, Microsoft Azure OpenAI, Azure Foundry for Anthropic, OpenRouter, Cohere, Google Cloud, plus Stability AI and ElevenLabs.

Vendor's wording: “The following Sub-processors may process Customer Personal Data to support the Services.”

Source: writesonic.comSchedule 3 Sub-processorsChecked on 19 October 2026

Not listed.

No listing found for search term 'Writesonic'

Source: dataprivacyframework.govSearch 'Writesonic' returned 'Query returned no results'Checked on 19 October 2026

Data is kept while the account is active. After termination it can be exported for 30 days, then deleted; the privacy policy says up to 30 days after account deletion. Backups are overwritten in the ordinary course.

Vendor's wording: “for thirty (30) days after termination, Writesonic will make Customer Data available for export through documented self-service mechanisms; thereafter Writesonic will delete Customer Data subject to the DPA and applicable law.”

Source: writesonic.comTerm and TerminationChecked on 19 October 2026

SOC 2 Type 2 (1 certification, per the DPA security schedule). The trust centre also shows GDPR and HIPAA marked "Compliant". No ISO certificate.

Vendor's wording: “Compliance certifications SOC 2 Type 2.”

Source: writesonic.comSchedule 2 Technical and Organizational Measures, Compliance certificationsSecond source: writesonic.trust.siteChecked on 19 October 2026