Security & Compliance
For law firms, tax advisors and medical practices — GDPR-compliant, DPA included. Your data lives technically isolated on servers in Germany — in an isolated container on a shared server on the Compliance plan (your own server only on the Dedicated plan). AI inference runs in the EU; a residual US CLOUD Act risk is disclosed transparently.
Provider comparison
A direct compliance comparison of the common AI platforms — for professions bound by statutory confidentiality, every detail counts.
| Criterion | ClapNClaw | ChatGPT Team | Copilot Business |
|---|---|---|---|
| Server location | Server in Germany | USA | USA / EU |
| CLOUD Act | Residual risk disclosed | ✗ Affected | ✗ Affected |
| §203 StGB | ✓ Supplementary agreement in the Compliance plan | ✗ Not possible | ✗ Not possible |
| DPA Art. 28 | ✓ Included | ~ On request | ~ On request |
| Isolated environment with its own database | ✓ On the Compliance plan | ✗ Shared cloud | ✗ Shared cloud |
| Audit logs | ✓ Complete | ~ Limited | ~ Limited |
| Price / user | from €29 | $30 | $30 |
Data flow architecture
From the browser to the AI model — servers in Germany, AI processing in the EU.
Your team
TLS-encrypted (in transit) and encrypted backups
Hetzner Germany
Routing & cache
Frankfurt · eu-central-1
Professional confidentiality
§203 StGB protects the professional secrets of lawyers, doctors and tax advisors. ClapNClaw is built so that your data is technically separated from every other customer. Access by ClapNClaw is limited strictly to operations and maintenance — contractually restricted and logged (data processing under Art. 28 GDPR).
Data protection documentation
The GDPR requires documentation. ClapNClaw delivers it with the product — prepared and ready to use right away.
Every ClapNClaw contract includes a complete data processing agreement. Subject matter, duration, nature and purpose of processing as well as the TOMs are documented and ready to use right away.
When processing special categories of personal data, a DPIA may be required. ClapNClaw supports you on request with technical documentation for your DPIA.
A complete overview: which data is processed, the legal basis, retention periods, sub-processors and TOMs — ready for your files.
For your files: every page can be saved as a PDF via your browser's print function.
Isolated environment
Your private AI runs in a technically isolated environment and is governed by declarative security policies (policy-as-code).
Security policy (YAML)
Security policies in YAML — versioned, auditable, reproducible. No manual intervention required.
Every file access, every network request, every token used is logged. 90-day retention.
Your data protection officer gets access to usage statistics, audit logs and the policy configuration.
Certifications & standards
ClapNClaw relies on infrastructure with recognized certifications — and delivers the compliance documents right along with it.
ISO 27001 certified data center. Isolated containers on the Team and Compliance plans, your own server on the Dedicated plan.
ISO 27001, BSI C5 and SOC 2 audited. AI inference in Frankfurt (eu-central-1), zero data retention.
Data processing agreement included in the contract. Ready to use right away.
Architecture designed for §203-compatible use. On the Compliance plan the §203 StGB supplementary agreement (confidentiality obligation) is included from day one, concluded via a checkbox at signup.
ISO 27001, BSI C5 and SOC 2 are certifications of our infrastructure providers (Hetzner, AWS). They attest to the security of the underlying data centers and AI infrastructure.
Frequently asked questions
ClapNClaw is built for GDPR compliance. All customer data is stored in technically isolated environments in the Hetzner data center in Germany (ISO 27001 certified) — in an isolated container on a shared server on the Compliance plan (your own server only on the Dedicated plan). AI inference runs via AWS Bedrock eu-central-1 without data storage. A data processing agreement (DPA) under Art. 28 GDPR is included in the contract.
Your data lives at Hetzner on servers in Germany — in a technically isolated container with its own database on the Team plan and a dedicated database instance on the Compliance plan, on a shared server in each case, on your own server on the Dedicated plan. AI inference runs via AWS Bedrock eu-central-1 (origin region Frankfurt; processing within the EU/EEA). A residual US CLOUD Act risk is disclosed transparently.
No. AWS Bedrock does not store inputs or outputs and does not use them for model training. Your chat history stays exclusively in your isolated environment on servers in Germany.
A data processing agreement (DPA) under Art. 28 GDPR governs how we handle your data as a processor. Yes — every ClapNClaw contract includes a complete DPA.
ClapNClaw's architecture is designed to create the technical conditions for use by professionals bound by confidentiality: on the Compliance plan your environment runs in an isolated container with a dedicated database instance on a shared server (your own server only comes with the Dedicated plan). Access by ClapNClaw is limited strictly to operations and maintenance — contractually restricted and logged (DPA under Art. 28 GDPR; the §203 StGB supplementary agreement is included in the Compliance plan from day one). The legal assessment remains the responsibility of the individual professional bound by confidentiality.
A DPIA (data protection impact assessment) under Art. 35 GDPR may be required if you process special categories of personal data (e.g. health data). ClapNClaw supports you on request with technical documentation for your DPIA.
Your data belongs to you and your team. Every customer organization runs in a technically isolated environment — a container with a dedicated data volume and its own database on the Team plan, plus a dedicated database instance on the Compliance plan, your own server only on the Dedicated plan. Access by ClapNClaw is limited strictly to operations and maintenance — contractually restricted and logged (data processing under Art. 28 GDPR). AWS Bedrock stores no data.
When the contract ends, your entire environment is deprovisioned and all data is permanently erased — container, data volume and database on the Team plan, plus the dedicated database instance on the Compliance plan; the whole server on the Dedicated plan. AWS Bedrock stores no data in the first place.
An isolated environment on servers in Germany — an isolated container on the Compliance plan. DPA from day one. Customer data stays in Germany.
Team: start free for 7 days ↗Setup in 5 minutes · DPA included · Data on servers in Germany · Cancel anytime