WeTransform

GDPR overview

GDPR compliance is claimed explicitly and repeatedly: WeTransform describes itself as fully GDPR compliant and GDPR-native by design, with EU data residency at rest and during processing, the AI layer included. A Data Processing Agreement is said to be part of the standard contract terms rather than granted on request, and the right to erasure is claimed to cover data in transit. Being established in Belgium, the company needs no Article 27 representative. The gaps are documentary rather than technical: the published privacy policy is a generic website notice that never addresses product data, the terms of service cover website use only and name no governing law, no legal notice page exists, no DPO or privacy address is published, and the sub-processor list the vendor says it maintains could not be found on the public site. ISO 27001 is in progress, not obtained.

Who owns the data?

WeTransform positions itself as a data processor and its customer as the data controller: the files uploaded through the importer remain the customer's. The customer sets the retention window from account settings, and data is deleted automatically once that window expires. The vendor states that the right to erasure applies to data in transit and during processing, not only to stored data. Access is governed by role-based permissions, and staging and production environments stay separated. One caveat matters: the published privacy policy is a generic website notice covering comments and cookies, so these commitments come from the security page and a blog article rather than from a contractual document.

Reuse rights

Uploaded files are received, parsed, mapped onto the customer's target schema, cleaned, validated and transformed, then handed back either as a time-limited signed file URL or through a webhook. Every processing step, the AI mapping included, is stated to run inside the EU. WeTransform states plainly that customer data is never used to train AI models. A mapping defined once is reused for later files and across clients, and AI actions consume plan credits. Every file received, transformation applied and output generated is logged. Nothing on the site restricts what the customer then does with their own transformed data inside their own system.

Data retention & training

Hosting summary

All data processed by WeTransform is hosted exclusively within the European Union, on Hetzner infrastructure, with Frankfurt, Germany named as the location on the security page. The vendor states there is no data transfer outside the EU, no multi-region routing to non-EU zones and no dependency on US-based cloud providers. The claim covers processing as well as storage: file intake, field mapping, AI transformation and validation are all said to run inside the EU boundary, which the publisher presents as the difference between merely storing data in Europe and being GDPR-native. Data is encrypted in transit over TLS and at rest with AES-256 at table level, while sensitive fields (personal data, emails, billing information, integration secrets, 2FA credentials) are additionally encrypted at the application layer with AES-256-CBC, using HMAC-SHA256 blind indexes where a field must stay searchable. An independent technical check is consistent with the claim: the site's own IP address resolves to Hetzner Online GmbH in Germany. Jurisdiction is Belgian, the publisher being established in Brussels.