Infobip AgentOS

GDPR overview

GDPR compliance is claimed openly and supported by published documents. The AgentOS pages advertise SOC 2, ISO 27001, GDPR compliance and AES-256 encryption, and the product FAQ describes the platform as SOC 2 Type II compliant and GDPR ready. The Privacy Notice, last updated on 22 January 2026, names Infobip Limited, 181 Queen Victoria Street London EC4V 4EG, registration number 7085757, as controller, and gives data-protection-officer@infobip.com for its Data Protection Officer. That EU-based DPO is also designated as the EU Representative, though neither an organisation nor a person is named. In customer relationships the customer is controller and Infobip processor, with a pre-signed Data Processing Agreement published as a PDF. Transfers outside the EU rely on Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

Who owns the data?

Under the Terms and Conditions the customer stays the controller of end-user personal data and Infobip acts as processor, handling it only on the customer's instructions. Infobip keeps ownership of its own software, applications and intellectual property, granting a non-exclusive, non-transferable licence for the life of the contract. The customer separately assigns to Infobip, unconditionally and irrevocably, all rights in what the terms call Resultant Data: anonymised, aggregated information about how the services are used. That category expressly excludes anything identifying the customer or an individual, and excludes confidential information. Infobip states it will not disclose a customer's or an end-user's data to any other customer.

Reuse rights

Customers hold a personal, non-exclusive, non-transferable and non-sublicensable licence, usable only in connection with the services themselves. They may not reverse engineer, decompile, modify, translate, create derivative works from, rent, lease, resell or sublicense the platform, and website content may not be exploited commercially without prior written consent. Those rights end with the contract, at which point software and applications must be destroyed and use must stop. Customers can export their own communication logs and reports from the platform tools, and retention periods can be shortened free of charge or extended at extra cost. On Infobip's side, the terms authorise reuse of anonymised Resultant Data and of traffic data - duration, timing, type, source and destination - to improve and develop its products and for any other legally permitted purpose. The sub-processors page adds a firmer promise: customer data is never used to train, fine-tune or improve any AI model, whichever LLM provider is selected, and is processed in an isolated tenancy. Readers should note that the AI agents product page says the opposite in marketing language, claiming every interaction becomes training data.

Data retention & training

Hosting summary

Infobip runs more than forty data centres worldwide and lets customers choose where their data lives. The published default is firm: unless otherwise agreed in writing, customer data is stored and processed in Infobip data centres inside the European Union, and any transfer to a data centre outside the EU requires an explicit customer instruction. An EU region-locked data centre is available on request, and with it the support model can be restricted so that only staff in the EU and in countries with adequate protection may access the data. Otherwise a twenty-four-hour follow-the-sun support model applies, in which engineers outside the EU access data in its original location without moving it to another jurisdiction. One documented exception covers complex email or voice troubleshooting handled from Bosnia and Herzegovina, after a transfer impact assessment. Sub-processors and their locations are published in full, including Microsoft Ireland, Google, OpenAI in Ireland for EU customers, Deepgram and Oracle, with Standard Contractual Clauses or the EU-U.S. Data Privacy Framework as transfer mechanisms. No individual hosting country is named.