GDPR-compliant AI

• Data minimization (Art. 5(1)(c)) — Process only personal data that is adequate, relevant, and limited to what is necessary. Tokenization sends zero personal data to the model.

• Privacy by design (Art. 25) — Controllers must implement technical measures that integrate data protection from the design phase. A tokenization proxy is exactly that.

• Cross-border transfers (Chapter V) — Sending personal data to US-based AI vendors triggers SCCs or DPF requirements. Tokenized surrogates aren't personal data — the transfer obligation thresholds shift.

• Right to erasure (Art. 17) — Delete a project in Cypherz and the per-project vault key is destroyed; all tokenization mappings become unrecoverable.

• European hosting available — Cypherz runs in Hetzner's Helsinki and Falkenstein DCs. Data never leaves the EU at the proxy layer.

• EU-specific detectors — IBAN, EU passport numbers, postal codes for UK/DE/FR/IT/ES, IPv6, GDPR-classed names and addresses.

• DPA available — Standard Data Processing Agreement on every paid tier; we sign as your processor.

• Self-host in your own region — Deploy on Hetzner, Scaleway, OVH, or any EU-resident infra you trust.

GDPR compliance is your responsibility as controller. Cypherz provides infrastructure that supports key obligations but does not certify compliance.