diff --git a/documentation/src/content/docs/configuration/engine-authentication.md b/documentation/src/content/docs/configuration/engine-authentication.md
index 6fd0c36..87bc9cf 100644
--- a/documentation/src/content/docs/configuration/engine-authentication.md
+++ b/documentation/src/content/docs/configuration/engine-authentication.md
@@ -54,7 +54,7 @@ Optional Anthropic-compatible provider harnesses have their own API-key and base
 The engine login decides two things ChannelGate does not control: which provider contract covers the prompts, and where inference runs. Work folders, memory, files and conversation history stay on your host, but every turn sends prompt and context to the selected provider, as described in [privacy and data flow](/docs/privacy). The provider facts below come from the providers' own documentation as of October 2026. Check the current terms before relying on them, and treat this section as orientation for your own assessment rather than legal advice.
 
 :::caution[What this page does and does not cover]
-This section lists the login options the providers offer; it is not a recommendation for your situation. The contract for each route, including the data processing addendum, retention, training and residency commitments, is between your organization and the AI provider. Makeitfuture and ChannelGate are not party to it, do not verify the provider's compliance with it, and accept no responsibility for the provider's data handling or for the output and actions of the models. Review the current provider terms with your data protection officer before placing customer data in a conversation, and see the [platform terms](https://channelgate.dev/terms) for the limits of what ChannelGate itself provides.
+Our reading of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) is that it does not require servers in the EU: it requires a processor contract under Article 28 and a lawful basis for any transfer outside the EEA under Chapter V, such as an adequacy decision or the Standard Contractual Clauses that the providers' addenda incorporate. An EU-resident route removes the transfer question; the other commercial routes rely on those transfer mechanisms. This is our interpretation, not legal advice. This section lists the login options the providers offer; it is not a recommendation for your situation. The contract for each route, including the data processing addendum, retention, training and residency commitments, is between your organization and the AI provider. Makeitfuture and ChannelGate are not party to it, do not verify the provider's compliance with it, and accept no responsibility for the provider's data handling or for the output and actions of the models. Review the current provider terms with your data protection officer before placing customer data in a conversation, and see the [platform terms](https://channelgate.dev/terms) for the limits of what ChannelGate itself provides.
 :::
 
 ### Internal work without customer data