Skip to content

Data protection and data sovereignty

GDPR-compliant AI: your data in Germany and the EU.

FusionSystems builds AI applications so that your data remains under your control: servers in Germany or the EU, language models in European data centres or locally on your premises, regulated access and complete documentation.

Typical starting point

You want to use AI with company data: customer data, contracts, design documents or personnel information. For this you need certainty about where the data is located, who accesses it, and that its use stands up to data protection officers, customers and auditors.

What we do

  • Server location as you specify: Germany, the EU or your own data centre
  • Language models in EU data centres (for example Azure) or operated locally
  • User accounts, roles and an access log
  • Encrypted transmission, storage and backup
  • Filter for personal data before processing by a language model
  • Data flow and deletion concept as part of the documentation
  • Data processing agreement

What you receive

  • An AI environment whose data flows are described and verifiable
  • Documents for your data protection officer and for your customers
  • The assurance that your data is not used to train third-party models
  • Independence: model and provider can be changed

With AI, data protection is a question of architecture: where is the data located, where does the model run, who has access, what is logged? FusionSystems defines these points before the first application is built and sets up the environment accordingly.

Three operating models

Operating modelWhere the data is locatedWhere the language model runs
Servers in GermanyData centre in GermanyData centre in the EU or locally on the server
Cloud in the EUEU data centres, for example AzureEU data centres
On your premisesYour data centreYour data centre

The operating models can be combined: for example, data and knowledge search on a server in Germany and the language model in a European data centre.

What we ensure technically

  • Defined location: data and models are located in the regions you specify. The requirement is part of the environment description and is checked during set-up.
  • Regulated access: personal accounts, roles and an access log.
  • Data minimisation: a filter removes personal details before a text is passed to a language model, where the task permits.
  • No training with your data: your content is not used to train third-party models.
  • Encryption and backup: encrypted transmission and storage, daily encrypted backup, rehearsed recovery.
  • Separate environments: real data is processed only in production; development and test work with synthetic or anonymised data.

Documentation for data protection and audits

Every environment comes with documentation your data protection officer can work with: data flows, the services and regions involved, access rights, the deletion concept and the sub-processors used. We provide the technical basis and the documents; the legal assessment in the individual case is made by your data protection officer.

Data sovereignty without vendor lock-in

The environment is created as infrastructure as code and built to be provider-neutral. Language models are connected through a uniform interface; changing the model or the data centre is a matter of configuration. You receive source code, documentation and access credentials in full. How ongoing operation works is described under AI Operations.

Certified quality

FusionSystems is certified to DIN ISO 9001 for software development and IT services: view certificate (PDF, German).

Further topics

AI Services

AI Environments

The environment in which your AI is allowed to work: model access, data connection, access rights, and operations, as the foundation for every further application.

AI Services

AI Operations

Deployment, maintenance, and agreed operations: so that an AI application continues to run reliably after the pilot and can be developed further.

AI Services

AI Adoption

Getting started with artificial intelligence (AI) for medium-sized and large companies: AI consulting, workshop, a viable first use case and the technical path to it.

Solutions

Custom AI Applications

Your idea becomes a usable application: as a web application, assistance system, interface, or part of an overall technical system.

Solutions

Document and Knowledge Intelligence

Understanding documents instead of merely reading them: archives, files, and technical documentation become structured knowledge you can query.

Approach

How a privacy-compliant AI environment is built.

  1. Clarify the requirements

    Which data is processed, which rules apply, who may access what?

  2. Define location and models

    Data centre in Germany, EU cloud or your own premises; language models in the EU or local.

  3. Set up and document the environment

    Infrastructure as code, separate environments, data flow and deletion concept.

  4. Operate and verify

    Monitoring, backup, logs and regular review of the requirements.

Questions and answers

Frequently asked questions

Can AI be used in a company in compliance with the GDPR?

Yes. What matters is the place of processing, regulated access, a legal basis for personal data and complete documentation. We set up the technical environment for this and provide the documents for your data protection officer.

Where are the servers located?

Wherever you specify: in a data centre in Germany, in EU data centres (for example Azure) or on your own premises. The location is part of the environment description and can be verified.

Is our data used to train AI models?

No. We connect language models via business access under which inputs and results are not used to train the models, or we operate the models locally.

Can AI run entirely on our own premises?

Yes. Language models and embedding models can be operated on your own hardware. The data then does not leave your network.

What does the EU AI Act mean for us?

It classifies AI applications by risk and requires, among other things, transparency, human oversight and AI literacy among staff. We take these requirements into account in architecture, documentation and training.

Does FusionSystems conclude a data processing agreement?

Yes. Where we process personal data on your behalf, we conclude a data processing agreement with you in accordance with Art. 28 GDPR.

Are we tied to a cloud provider?

No. The environment is described as code and built to be provider-neutral. Model and data centre can be changed; a qualified third party can take over operation.

Would you like to use AI with your company data?

We discuss with you which data is processed and which operating model suits it.

Discuss your requirements