Chatbots and GDPR 2027: where 10 providers are based and store data
Whether a chatbot fits your data protection duties depends on questions every provider answers differently. Here is what ten providers state themselves: which company is behind the product, where the data is stored according to the provider and how you get the data processing agreement. No verdict, no legal advice. One of the ten is us, and it says so.
What this overview is, and what it is not
This is not legal advice and not a ranking. We repeat what the providers write on their own pages and do not rate it. Each provider shows the date we last checked.
A company seat or storage location outside the EU does not rule a product out. What counts then are the safeguards for the transfer, for example standard contractual clauses or a certification under the EU-US Data Privacy Framework. Whether that is enough in your case is a question for your data protection officer.
WebChatAgent is our own product. It comes first in the list and is labelled as our own. All others follow in alphabetical order.
Five questions for every provider
1. Who is your contracting party?
You will find it in the imprint or the terms. The brand name is not enough: your record of processing activities needs the company and its address.
2. Where are the conversations stored?
Many providers name the country or region of their servers. Where that is public, you will find it below.
3. Which AI services process the text?
The storage location is only half the answer. A visitor's question usually goes to an AI model, and that model can run at a different company and in a different region than the database. Ask for the list of sub-processors.
4. Do you get the data processing agreement before you start?
As soon as the chatbot processes your visitors' data on your behalf, Art. 28 GDPR requires such an agreement. Some providers publish it, others send it on request.
5. Is your content used for training?
Get it in writing whether conversations and uploaded documents are used to train AI models, by the provider itself and by its AI service providers.
The ten providers at a glance
The short version as a table first, then each provider with company, storage location and data processing agreement. All statements are the providers' own.
| Provider | Provider's statement on storage location | Internally reviewed |
|---|---|---|
| WebChatAgent (our own product) | Servers with netcup in Germany; nightly backups with Google Cloud in Frankfurt. | our own statement |
| Botpress | According to the provider's trust center, customer data is hosted on Amazon Web Services in the US-East region by default. | November 10, 2026 |
| Chatbase | According to the security page, database and application run on AWS infrastructure in the us-east-1 region. | November 10, 2026 |
| ChatBot by Text | According to the provider on servers in Ireland; relocation to another region is not currently available. | November 10, 2026 |
| Crisp | According to the provider on servers in the European Union: messaging data in the Netherlands, plugin data in Germany. | November 10, 2026 |
| Freshworks (Freshchat) | According to the provider almost all data resides in Amazon Web Services data centers; the sub-processor list names several regions for this, including the US and the EU. | November 10, 2026 |
| moin.ai | According to the provider the servers and the data stored on them are hosted in Germany. | November 10, 2026 |
| tawk.to | According to the privacy policy the provider is located in the United States and does all processing there. | November 10, 2026 |
| Tidio | According to the provider the services run on Amazon Web Services in data centers within the EU. | November 10, 2026 |
| Watermelon | According to the security page, database and application run on Google Cloud infrastructure (Europe-west-1b), MongoDB and Pinecone. | November 10, 2026 |
our own product
WebChatAgent
- Company and registered office
- WebChatAgent, Bielefeld, Germany.
- Provider's statement on storage location
- Servers with netcup in Germany; nightly backups with Google Cloud in Frankfurt.
- Data processing agreement
- Publicly available.
Botpress
- Company and registered office
- Botpress Inc, Newark, Delaware, USA.
- Provider's statement on storage location
- According to the provider's trust center, customer data is hosted on Amazon Web Services in the US-East region by default.
- Data processing agreement
- According to the privacy statement, the provider enters into a data processing agreement with customers.
Internally reviewed: November 10, 2026
Chatbase
- Company and registered office
- Chatbase Inc., San Francisco, California, USA.
- Provider's statement on storage location
- According to the security page, database and application run on AWS infrastructure in the us-east-1 region.
- Data processing agreement
- Publicly available as a supplement to the terms of service.
Internally reviewed: November 10, 2026
WebChatAgent and Chatbase side by sideChatBot by Text
- Company and registered office
- Text, Inc., Boston, Massachusetts, USA.
- Provider's statement on storage location
- According to the provider on servers in Ireland; relocation to another region is not currently available.
- Data processing agreement
- According to the provider an integral part of the agreement, with no separate signature.
Internally reviewed: November 10, 2026
WebChatAgent and ChatBot by Text side by sideCrisp
- Company and registered office
- Crisp IM SAS, Nantes, France.
- Provider's statement on storage location
- According to the provider on servers in the European Union: messaging data in the Netherlands, plugin data in Germany.
- Data processing agreement
- According to the provider part of the terms of service and downloadable from within the account.
Internally reviewed: November 10, 2026
WebChatAgent and Crisp side by sideFreshworks (Freshchat)
- Company and registered office
- Freshworks Inc., Delaware, USA.
- Provider's statement on storage location
- According to the provider almost all data resides in Amazon Web Services data centers; the sub-processor list names several regions for this, including the US and the EU.
- Data processing agreement
- Publicly available.
Internally reviewed: November 10, 2026
WebChatAgent and Freshworks (Freshchat) side by sidemoin.ai
- Company and registered office
- knowhere GmbH, Hamburg, Germany.
- Provider's statement on storage location
- According to the provider the servers and the data stored on them are hosted in Germany.
- Data processing agreement
- The provider offers a data processing agreement under Art. 28 GDPR.
Internally reviewed: November 10, 2026
WebChatAgent and moin.ai side by sidetawk.to
- Company and registered office
- tawk.to Inc., Las Vegas, Nevada, USA.
- Provider's statement on storage location
- According to the privacy policy the provider is located in the United States and does all processing there.
- Data processing agreement
- Publicly available; according to the provider part of the agreement.
Internally reviewed: November 10, 2026
WebChatAgent and tawk.to side by sideTidio
- Company and registered office
- Tidio LLC, San Francisco, California, USA; according to the privacy policy jointly responsible with Tidio Poland Sp. z o.o., Szczecin, Poland.
- Provider's statement on storage location
- According to the provider the services run on Amazon Web Services in data centers within the EU.
- Data processing agreement
- According to the provider included in the terms and conditions.
Internally reviewed: November 10, 2026
WebChatAgent and Tidio side by sideWatermelon
- Company and registered office
- Watermelon B.V., Utrecht, the Netherlands.
- Provider's statement on storage location
- According to the security page, database and application run on Google Cloud infrastructure (Europe-west-1b), MongoDB and Pinecone.
- Data processing agreement
- According to the provider an integral part of the agreement; available via the platform or on request.
Internally reviewed: November 10, 2026
WebChatAgent and Watermelon side by sideThis is a commercial first-party comparison by WebChatAgent, not an independent product test. WebChatAgent is not affiliated with the providers named here. Named trademarks belong to their respective owners. Products and prices may change; review each provider’s current offer before making a decision.
How the selection came about
The selection is our own: providers for which we maintain comparison pages or which we have come across while watching the market. It is not complete. Providers change their statements; what counts is what the provider currently commits to.
Is something no longer correct? Write to hello@webchatagent.com and we will fix it.
What WebChatAgent states
This section is advertising for our own product, with statements you can check. Our servers are in Germany. You can read the data processing agreement publicly. Your content is not used to train the AI models through WebChatAgent.
Which AI services process a message depends on the model you choose; the service providers and their locations are listed in the agreement. The phone assistant speaks through OpenAI, where processing can take place worldwide, in particular in the United States. Our privacy policy says the same. More on the page AI chatbot and GDPR.
Try it with your own content
Create a chatbot on the free plan, connect your website and read the data processing agreement before you go live.
Frequently asked questions
Not as a blanket rule. The GDPR allows transfers to countries outside the EU under conditions, for example with standard contractual clauses or when the provider is certified under the EU-US Data Privacy Framework. Whether that is enough in your case is a question for your data protection officer.
Yes, as soon as the chatbot processes personal data of your visitors on your behalf. Art. 28 GDPR then requires an agreement with the provider.
No. A visitor's question usually goes to an AI model that can run at a different company and in a different region than the database. So also ask about the AI services and the list of sub-processors.
No. It is published by WebChatAgent, one of the providers named, and only repeats what the providers publish themselves, each with a check date.
Each provider shows the date of our last check. What counts is what the provider currently commits to. We correct errors after a message to hello@webchatagent.com.