Abacus.AI

GDPR overview

Implementation is documented but self-declared. The security page states that Abacus.AI maintains a compliance program aligned with SOC 2 Type II, ISO/IEC 27001, HIPAA, GDPR and CCPA, and a data processing agreement can be downloaded. Because the company has no establishment in the European Union, it has appointed an Article 27 representative: Thodoris Petropoulos, Drakou 16, Athens 11742, Greece, eurep@abacus.ai. A data protection officer is named, Ajit Deshpande, reachable at dpo@abacus.ai, while rights requests go to privacy@abacus.ai. The privacy policy lists the rights to information, access, rectification, erasure, restriction, objection, portability, freedom from automated decision-making and consent withdrawal, with a separate CCPA section answered within 45 days. Two weaknesses: the policy still invokes the Privacy Shield framework, invalidated in 2020, and carries no effective or last-updated date.

Who owns the data?

Ownership stays with the customer. The terms provide that, as between the parties, the customer holds all intellectual property rights in Customer Data and in any Application or Project built on the platform, while Abacus.AI keeps the rights to its own Services and Software. Inputs and outputs therefore remain the customer's, as do any models fine-tuned on the customer's proprietary data. Customer Data is additionally treated as the customer's confidential information. Operationally, records are logically segregated by a unique key, and a fully isolated database can be provisioned on request. Abacus.AI's own use of the data is limited to operating the service the customer has asked for.

Reuse rights

Because the customer owns its inputs and outputs, it may reuse, publish, sell or build on whatever it generates without asking Abacus.AI for permission; the terms grant the vendor no reuse rights beyond running the service. On the vendor's side, the privacy policy states that no personal information, Google user data or customer-provided content, including prompts, uploads and API data, is used to develop, improve or train any generalized or proprietary AI or ML model. Data serves only the requests and tasks the user initiates. A zero data retention agreement covers every foundation and third-party model integrated into the product, so exchanges with them are transient, encrypted and deleted after processing, while open-source models are hosted by Abacus.AI on US servers. Google Workspace data is handled under the Google API Limited Use Requirements. Secondary uses are limited to operating and improving the service, security and fraud prevention, legal compliance and service messages, with contracted service providers for payment, emailing and support. Personal data is never sold or rented, and Health Data is never sold, shared, used for advertising or used for training. Customers should still validate what they publish, since the terms place testing and consequences on them.

Data retention & training

Hosting summary

Abacus.AI runs on public cloud infrastructure, primarily Amazon Web Services, with Microsoft Azure and Google Cloud Platform also available, in the USA region. Customers may choose the provider and the region, and the company states that it does not move customer data between regions: a customer selecting a region in the USA has its data stored and processed there. Open-source models offered on the platform are hosted by Abacus.AI entirely within secure US-based servers. Data is encrypted with AES-256 at rest and with TLS 1.2 or above in transit, keys being managed through AWS KMS. Availability rests on real-time synchronous replication across several geographically distributed data centers, with daily backups kept in the local region and seven days of backup retention per database. Production, staging and development environments are separated, and production data is never copied into a lower environment. No European or other non-US residency option is documented, and customer-supplied encryption keys are not supported.