From 9f20f97fc4b6f3de4866c67ebdf374085b074696 Mon Sep 17 00:00:00 2001 From: makeitfutureDev <144107855+makeitfutureDev@users.noreply.github.com> Date: Wed, 14 Oct 2026 21:17:28 +0300 Subject: [PATCH] docs: note GDPR transfer basis in the European login section Add our reading that the GDPR requires an Article 28 processor contract and a Chapter V transfer basis rather than EU servers, mark it as an interpretation and not legal advice, and link the regulation text. Co-Authored-By: Claude Fable 5.1 Signed-off-by: makeitfutureDev <144107855+makeitfutureDev@users.noreply.github.com> --- .../src/content/docs/configuration/engine-authentication.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/documentation/src/content/docs/configuration/engine-authentication.md b/documentation/src/content/docs/configuration/engine-authentication.md index 6fd0c36..87bc9cf 100644 --- a/documentation/src/content/docs/configuration/engine-authentication.md +++ b/documentation/src/content/docs/configuration/engine-authentication.md @@ -54,7 +54,7 @@ Optional Anthropic-compatible provider harnesses have their own API-key and base The engine login decides two things ChannelGate does not control: which provider contract covers the prompts, and where inference runs. Work folders, memory, files and conversation history stay on your host, but every turn sends prompt and context to the selected provider, as described in [privacy and data flow](/docs/privacy). The provider facts below come from the providers' own documentation as of October 2026. Check the current terms before relying on them, and treat this section as orientation for your own assessment rather than legal advice. :::caution[What this page does and does not cover] -This section lists the login options the providers offer; it is not a recommendation for your situation. The contract for each route, including the data processing addendum, retention, training and residency commitments, is between your organization and the AI provider. Makeitfuture and ChannelGate are not party to it, do not verify the provider's compliance with it, and accept no responsibility for the provider's data handling or for the output and actions of the models. Review the current provider terms with your data protection officer before placing customer data in a conversation, and see the [platform terms](https://channelgate.dev/terms) for the limits of what ChannelGate itself provides. +Our reading of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj) is that it does not require servers in the EU: it requires a processor contract under Article 28 and a lawful basis for any transfer outside the EEA under Chapter V, such as an adequacy decision or the Standard Contractual Clauses that the providers' addenda incorporate. An EU-resident route removes the transfer question; the other commercial routes rely on those transfer mechanisms. This is our interpretation, not legal advice. This section lists the login options the providers offer; it is not a recommendation for your situation. The contract for each route, including the data processing addendum, retention, training and residency commitments, is between your organization and the AI provider. Makeitfuture and ChannelGate are not party to it, do not verify the provider's compliance with it, and accept no responsibility for the provider's data handling or for the output and actions of the models. Review the current provider terms with your data protection officer before placing customer data in a conversation, and see the [platform terms](https://channelgate.dev/terms) for the limits of what ChannelGate itself provides. ::: ### Internal work without customer data