Langdock procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ As a general rule, we process personal data on servers within the European Union. In rare cases, particularly when services are not available in the EU or when you are located outside the EU and contact us, data may be transferred to “third countries” outside the EU or the European Economic Area. Such data transfers only take place if appropriate safeguards for the data transfer under the GDPR have been implemented, meaning that at least one of the following conditions is met: The European Commission has determined that the respective third country ensures an adequate level of data protection comparable to that of the EU (adequacy decision). The provider has joined a legal framework that the European Commission has determined provides an adequate level of data protection comparable to that of the EU (e.g., EU-U.S. Data Privacy Framework). The application of standard contractual clauses provided by the European Commission for the protection of personal data has been agreed upon between the provider and us. If you have questions about a specific international transfer or would like to receive a copy of the safeguards used (e.g., standard contractual clauses), please feel free to contact us at any time at support@langdock.com.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Langdock has generally enabled data residency in the EU for the models available via Google. For the use of these models, Google contractually commits to storing and processing Customer Data exclusively in the selected region (EU). Certain AI Models, which must be actively selected by Langdock customers, are only made available by Google on a “global” basis. For these AI Models, the processing of prompts and responses for inference may take place worldwide, including outside the EU. Google is certified under the EU–U.S. Data Privacy Framework to ensure, in such cases, a level of protection for personal data equivalent to that within the EU. In addition, the EU Standard Contractual Clauses have been agreed as a fallback.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Langdock uses OpenAI with data residency in Europe to ensure that the processing of Customer Data takes place within the EU.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “In the Data Processing Addendum, AWS has further committed to storing and processing data only in the selected region. In the case of Langdock, the selected region is the EU, unless a model is explicitly designated as a “global deployment.” When a customer actively selects a model with “global deployment” on the Langdock platform, the Data Processing Addendum with AWS ensures that transfer of Customer Data to third countries only takes place with adequate transfer mechanisms under the GDPR in place, in particular through the application of the EU Standard Contractual Clauses.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The controller within the meaning of the GDPR for the data processing described in this Privacy Notice is:” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “Email: support@langdock.com We have appointed an external data protection officer. Our data protection officer is: heyData GmbH” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “Certain AI Models, which must be actively selected by Langdock customers, are only made available by Microsoft as a “global” deployment. For these AI Models, the processing of prompts and responses for inference may take place worldwide, including outside the EU. In such cases, the data protection provisions of the GDPR for data transfers to third countries apply. In addition, Microsoft is certified under the EU–U.S. Data Privacy Framework to ensure a level of protection for personal data equivalent to that within the EU and, as a fallback, the EU Standard Contractual Clauses apply. Even when using “global” models, Customer Data at rest (data-at-rest) is stored exclusively in Langdock’s selected data centers within the EU.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Langdock processes personal data on behalf of the Customer as a data processor within the meaning of Art. 28 GDPR. Upon conclusion of this contract, the Data Processing Agreement available at https://langdock.com/dpa is automatically concluded between the parties and hereby incorporated into the contract. ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ When you use the Langdock platform as a user within a workspace (e.g., for chats or workflows), Langdock processes your data solely as a processor. This means that the respective company providing you with the workspace (typically your employer, not Langdock) is the controller responsible for your data under data protection law. The basis for this is the data processing agreement entered into between Langdock and the company. Your content (e.g., chats and projects) is processed by us exclusively for the purpose of providing the contracted services. We are obligated under the data processing agreement not to use the content for any other purpose. Your data is not used for training AI models. Independently of the content data, Langdock collects anonymized telemetry data and aggregated usage statistics as a controller in order to detect errors early, ensure the operation of the platform, and further develop it. This includes:” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Bank details or other payment data for the settlement of commissions Additional data that you provide during the registration process, where applicable (e.g., a promo code) The purpose of this processing is to operate our partner program and settle commissions. The legal basis for this processing is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in the efficient administration of our partner program (Art. 6 (1) (f) GDPR). We delete this data after the end of the partnership, once the statutory commercial and tax law retention periods have expired, typically after 10 years.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ The purpose of this processing is to communicate with you. The legal basis for this processing is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in public corporate communications (Art. 6 (1) (f) GDPR). We delete this data after the expiration of the statutory retention periods for business communications. For our social media channels, the platform operators provide us with aggregated statistical data on the use of our channels (so-called insights). According to the case law of the Court of Justice of the European Union, we are jointly responsible with the respective platform operator for this processing. We use insights exclusively in aggregated, non-personal form to further develop our communications. For all further data processing by social media platforms, in particular the processing of your profile and usage data, the respective operators are solely responsible. You can find their privacy policies here: LinkedIn: www.linkedin.com/legal/privacy-policy YouTube (Google): policies.google.com/privacy X: www.x.com/privacy ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ The purpose of this processing is billing and payment processing. The legal basis for this processing is the performance of a contract (Art. 6 (1) (b) GDPR). We delete this data after the expiration of the statutory commercial and tax law retention periods, typically after 10 years.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Notes from interviews and information that you share with us during the application process The purpose of this processing is to conduct the application process, in particular to assess your suitability for the advertised position, to communicate with you, and to decide on establishing an employment relationship. The legal basis for this processing is pre-contractual measures (Art. 6 (1) (b) GDPR in conjunction with Section 26(1) of the German Federal Data Protection Act (BDSG) ). If no employment relationship is established, we delete your application documents six months after the end of the application process. The legal basis for this retention is our legitimate interest in maintaining records of the proper conduct of the application process to defend our rights (Art. 6 (1) (f) GDPR).” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Langdock uses only Mistral API endpoints with data residency in the EU. In addition, Zero Data Retention has been agreed and enabled for Langdock, so that Prompts and Outputs are neither logged nor stored by Mistral.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Langdock has agreed with Google on an exception for abuse logging for the models provided via Google Cloud. Prompts and Outputs are therefore not logged on Google’s servers (Zero Data Retention).” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “The legal basis for this processing is our legitimate interest in properly informing those technically responsible about relevant settings, as well as in the security of the workspace users (Art. 6 (1) (f) GDPR). You may object to receiving further newsletters at any time by sending an email to support@langdock.com or by clicking the opt-out link in the email; this does not affect the lawfulness of processing carried out prior to the withdrawal. We delete this data as soon as the underlying workspace is deleted.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Error messages or session-specific information, where applicable, particularly when errors occur The purpose of this processing is to operate, secure, stabilize, and further develop our website, as well as to detect and prevent attacks. The data is used in particular to display website content in the correct language and to ensure proper rendering on your device. The legal basis for this processing is our legitimate interest in the uninterrupted provision of the website (Art. 6 (1) (f) GDPR). Server log files are deleted at regular intervals. ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ The purpose of this processing is to handle your inquiry and communicate with you. The legal basis for this processing is the performance of a contract or pre-contractual measures (Art. 6 (1) (b) GDPR) and our legitimate interest in responding to inquiries (Art. 6 (1) (f) GDPR). We delete this data after the expiration of the statutory retention periods for business communications. Following the completion of contact and support inquiries, we send automated short satisfaction surveys by email in order to measure and continuously improve the quality of our customer service. Participation in these surveys is voluntary. You may object to receiving such surveys at any time by sending an email to support@langdock.com. The legal basis for this processing is our legitimate interest in quality assurance and improvement of our support (Art. 6 (1) (f) GDPR). ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “In addition, Zero Data Retention has been separately agreed with OpenAI and activated for Langdock. As a result, Customer Data transmitted via the OpenAI API is neither logged nor stored and not subject to human review. The standard 30-day retention period for API data therefore does not apply to Langdock. One exception applies as required by law: image and file inputs are automatically scanned for child sexual abuse material and, only if such material is detected, manually reviewed.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “Langdock hosts data in Frankfurt and has enabled the EU Data Boundary for Microsoft Azure Services. As a result, Customer Data is generally stored and processed by Microsoft exclusively within the EU and does not leave the agreed Azure region (EU). For the models provided via Microsoft Azure, Langdock has enabled Modified Abuse Monitoring . As a result, storage of Prompts and Outputs for abuse monitoring and their human review by Microsoft are disabled (Zero Data Retention).” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Langdock uses AWS Bedrock on the basis of a Customer Agreement concluded with Amazon Web Services EMEA SARL as well as the AWS Service Terms . Langdock has also entered into a Data Processing Addendum with AWS, which governs the processing of personal data by AWS.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Hosting of the Langdock platform; provision of AI Models (currently models from OpenAI, Meta, Mistral, DeepSeek) Langdock uses Microsoft Azure on the basis of the Customer Agreement concluded with Microsoft Ireland Operations Ltd. as well as the Product Terms for Azure. Langdock has also entered into a Data Processing Agreement with Microsoft, which governs the processing of data by Microsoft.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Payment processing is handled by the payment service provider Stripe ( https://stripe.com/privacy ). We therefore do not store any payment data such as credit card or account numbers ourselves. For billing purposes, we store:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ When you use our mobile app on your phone, additional data (e.g., during download) may be transmitted to the operator of the app store from which you download our app (e.g., Apple, Google). Please review their privacy notices for more details. In all other respects, our privacy notice for the Langdock platform also applies to the use of our mobile app.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We engage carefully selected third-party providers who process personal data on our behalf. These third-party providers operate on the basis of a data processing agreement with us, which prohibits them from using the data for their own purposes and obligates them to comply with the high European data protection standards. The processors used in the Langdock platform can be found in our list of sub-processors in our Trust Center . For our own processing, we use third-party providers in the following areas in particular: Cloud and infrastructure providers (e.g., Microsoft) Email and communication services (e.g., Google) as well as video and webinar platforms Payment providers (e.g., Stripe) and accounting/tax tools” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Authentication data when using single sign-on, where applicable (e.g., Microsoft Entra ID, Google Workspace) For paid subscriptions: address data, payment data, and additional data that you provide during the registration process (e.g., a promo code) The purpose of this processing is to provide and manage your user account on the Langdock platform and to authenticate users. In addition, we may use this data to detect and prevent misuse of our services and fraud, in particular to prevent multiple registrations or spam. The legal basis for this processing is the performance of a contract (Art. 6 (1) (b) GDPR) and our legitimate interest in preventing misuse of our services (Art. 6 (1) (f) GDPR). We delete your user account and associated data upon request or no later than within 30 days after termination of the contractual relationship, unless statutory retention obligations apply.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ The Customer is permitted to use the Platform for the agreed contract term. The contract renews automatically (i) in the case of a monthly contract, for successive periods of one month, unless either party gives notice of termination at least 7 days before the end of the then-current term, and (ii) in the case of a contract with a term of one year or more, for successive periods of 12 months, unless either party gives notice of termination at least 14 days before the end of the then-current term. Upon renewal, the then-current list price for new customers shall apply for the renewal term, provided that any discounts agreed with the Customer shall continue to apply. Langdock will notify the Customer of any price changes by email at least 30 days before the end of the applicable notice period for termination. The right of either party to terminate for cause remains unaffected. Cause for termination by Langdock exists, in particular, if the Customer (i) is in default with a payment and fails to cure such default within 30 days of notice, (ii) repeatedly or persistently breaches material obligations under this contract despite having been requested to cease such breach, (iii) becomes insolvent or over-indebted, or (iv) if an application for the opening of insolvency proceedings over Customer’s assets is filed or such opening is refused for lack of assets. Notices of termination must be given in text form (e.g. by post or email) or via the function provided within the Platform. Upon expiry of the contract, Customer’s right to use the Platform ceases.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ The Customer may use the Platform free of charge for a limited period of time with a limited scope of functions (“ Trial Period ”). Unless otherwise agreed, the Trial Period shall last for one week. Upon expiry of the Trial Period, the right to use the Platform shall end automatically without the need for a termination notice, unless the Customer enters into a contract for the paid use of the Platform. If the parties agree on a paid pilot period (“ Pilot Period ”), the Customer is entitled to use the Platform for the agreed duration and within the agreed scope. Upon expiry of the Pilot Period, the right to use the Platform shall end automatically without the need for a termination notice, unless the Customer enters into a contract for the paid use of the Platform. During the Pilot Period, termination for convenience is excluded for both parties. The right to terminate for good cause remains unaffected.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “Langdock will notify the Customer of any price changes by email at least 30 days before the end of the applicable notice period for termination. New features or additional services shall only become part of the contract if they are made available to new customers within the subscribed plan at no additional charge, or if separately agreed between the parties. All amounts are stated in EUR and without tax. To the extent that usage-based costs are invoiced to Langdock by the respective provider of an AI Model in USD or another foreign currency, conversion into EUR shall be made on the basis of the daily market exchange rate at the time of the respective usage event (e.g., API call). Unless otherwise agreed, invoices shall be issued to the Customer in electronic form (e.g., by email). Invoices are payable within 14 days of the invoice date. The Customer may only set off claims that are undisputed or have been finally and bindingly established by a court.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Fees consist of a license fee which depends on the number of Users, the selected contract term, and the chosen product and add-ons, as well as a usage-based fee if the Customer uses features subject to usage-based billing (e.g., API calls). The agreed license fee is due at the beginning of the respective billing period. Any usage-based fees are billed monthly in arrears, unless otherwise agreed. Langdock may require a prepayment for usage-based services; in such case, usage is set off against the prepaid amount. Once the amount has been used up, Langdock may suspend the provision of usage-based services until a further prepayment is made. Any unused prepayment shall be refunded to the Customer upon termination of the contract. If the Customer adds Users during a billing period, the additional fee payable for such Users will be charged on a pro rata basis for the current billing period, taking into account the applicable volume pricing tiers and any Customer discounts. Where a maximum number of Users has been agreed, the Customer may not exceed this number without a separate agreement. If the Customer books an add-on during a billing period, the fee payable for the add-on will be charged on a pro rata basis for the current billing period. If the contract renews automatically, the then-current list price for new customers shall apply for the renewal term, provided that any discounts agreed with the Customer shall continue to apply. ” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.