Glean

GDPR overview

Glean's legal index states that it is "GDPR compliant" and that customer personal information is maintained in accordance with the Regulation. The Privacy Statement, last updated on 1 April 2026, sets out the rights available in the EEA, the UK and Switzerland: objection, restriction, portability, withdrawal of consent and complaint to a local supervisory authority. A Data Protection Officer is named, Michael Moore of the Legal Department, and requests go to privacy@glean.com or the Privacy Department in San Francisco. Glean is certified under the EU-U.S. Data Privacy Framework, its UK extension and the Swiss-U.S. DPF, and is subject to FTC oversight; European Commission Standard Contractual Clauses and a UK Addendum cover transfers. Cooperation is declared with EU authorities, the UK ICO and the Swiss Commissioner. CCPA/CPRA and LGPD are covered too, and a corporate DPA is published. No EU representative under Article 27 is named anywhere.

Who owns the data?

Section 3.1 of the Terms, "Rights in Customer Data", is explicit: the customer or its licensors retain all right, title and interest, including every intellectual property right, in Customer Data and in any modification made while the Service runs, and that expressly covers both Input and Output. Glean retains ownership of the Service itself and its underlying technology under section 4.1. Roles are split in section 9 of the Privacy Statement: Glean is the controller for its own website, and the processor for the Solutions delivered through a customer's employer. That processing is governed by a signed DPA, with the EU Standard Contractual Clauses and a UK Addendum covering cross-border transfers.

Reuse rights

Customer Data remains the customer's to reuse as it sees fit, Output included, and Glean takes no reuse right beyond operating the Service. Clause 3.a.i of the AI Addendum states that Glean will not use Customer Data to train, re-train, improve or fine-tune any AI model, and clause 3.a.ii imposes the same prohibition contractually on model providers whenever Glean's own model key is used. Clause 3.b adds zero-day retention at those providers, except where the law or trust-and-safety obligations require otherwise, and clause 3.c commits Glean to regulatory compliance, naming the EU AI Act; the AI management system is certified ISO/IEC 42001:2023. Under section 2 of the Terms, data reaches a model only when a generative feature is explicitly used. Permissions are mirrored from the source systems, no Glean employee sees customer content, and only sanitized logs are kept. Glean does not sell personal information. One reservation matters: if the customer brings its own model key, Glean guarantees neither zero-day retention nor the no-training commitment.

Data retention & training

Hosting summary

Glean runs as an isolated single-tenant deployment, hosted either by Glean or inside the customer's own cloud account. AWS, Azure and GCP are all supported, and section 1.2 of the Terms leaves the choice of supported provider and region to the customer, so residency can be set in AMER, EMEA or APAC. No hosting country is imposed: the location is a customer decision. The published subprocessor list shows cloud and model vendors under "United States*", with a note that the customer may select a different provider and a different location. One affiliate, Glean Search Technologies India Private Limited, holds remote access from India for support, security and debugging purposes. Data is encrypted at rest with AES-256 through a FIPS 140-2 validated cryptographic module, and in transit with TLS 1.2 or above.