GDPR-first AI product management
Specky is an AI-native PM workspace built EU-first: the current EU deployment uses Supabase Frankfurt, every GDPR right (Art. 15–20) is self-serviceable from settings, a standard Art. 28 DPA is available on request, and workspace data is not used to train AI models. Below is the checklist EU teams should run against any AI tool — with Specky's answers filled in.
EU data residency
The current EU deployment uses Supabase Frankfurt. AI inference is processed in the US; the boundary is documented plainly.
Never trains on your data
Contractual no-training, no-storage position for AI inference — not a vague “improve our services” clause.
Rights are self-service
Export, erasure, portability, and consent — Art. 15–20 handled from Settings, no email required.
DPA + SOC 2 alignment
Art. 28 DPA on request, SCCs supported, controls mapped to SOC 2 (Type II certification in progress).
The EU checklist for AI PM tools — with our answers
“It's GDPR-ready” on a marketing page isn't enough. These are the checks EU teams should run against any AI tool before signing — including this one.
| Check | What “good” looks like | Specky's answer |
|---|---|---|
| Data residency | Personal data stored and processed in the EEA | Workspace data is hosted in the configured Supabase region, currently Frankfurt for the EU deployment. AI inference uses Google Gemini in the US; the security page documents the boundary. |
| Data sovereignty | Honest disclosure of who has jurisdictional control — an EU region of a US provider is residency, not sovereignty | Specky is an EU (Austria) company. Database infrastructure runs on Supabase's Frankfurt region; Supabase is US-headquartered — we disclose that rather than blur residency into sovereignty. |
| Sub-processors | Named, jurisdiction disclosed, changes notified in advance | The security page names the current processors: Supabase, Vercel, Google Generative AI, PostHog, and Stripe, with their purposes and regions. Each receives only the data needed for the enabled service; Google receives prompt data for inference and does not train on it. |
| Trains on your data? | An explicit “your data never trains our models” — not “we may use data to improve our services” | Your data never trains a model. Prompt data is not stored by Google and is not used for training under our business agreement. |
| GDPR rights (Art. 15–20) | Self-serviceable, not email-and-wait | Access, erasure (30-day grace period), portability (JSON export), and consent management — all self-service from workspace Settings → Privacy & Data. |
| DPA (Art. 28) | Standard DPA available immediately; SCCs supported for transfers | Standard GDPR Art. 28 DPA available on request; custom DPAs and additional SCCs supported for enterprise. Email security@specky.space. |
| EU AI Act (Annex III) | Vendor states its conformity posture in writing | Specky's AI features draft documents and organise product signals — they don't score, rank, or decide anything about natural persons (the hiring/credit/biometrics use cases Annex III covers). Written posture statement available on request. |
| Breach notification | 72-hour customer notification commitment (Art. 33/34) | Affected customers notified within 72 hours of confirming a breach, including nature of the incident, data affected, and remediation steps. |
Every claim above is documented in full on the security page and privacy policy.
The AI-specific questions, answered plainly
Where does AI inference happen? AI inference (Google Gemini) is processed in the US. Prompt data is not stored by Google and is not used for training under our business agreement. EU-only AI processing is not a self-serve capability today.
Residency vs. sovereignty — the distinction most vendors blur. Residency is where the bytes sit; sovereignty is who has jurisdictional control. Specky is an EU (Austria) company and workspace data sits in Frankfurt — but our database provider, Supabase, is US-headquartered. We'd rather disclose that plainly than sell residency as sovereignty. Ask any vendor the same question.
What about the EU AI Act? Specky's AI features draft documents, synthesise signals, and generate tickets — they operate on artefacts, not on scoring or decisions about people (the hiring/credit/biometrics territory Annex III covers). A written conformity posture statement is available on request.
GDPR & EU compliance — frequently asked questions
Does Specky support GDPR requirements for AI product management?
Specky is an AI-native product management workspace built EU-first: the current EU deployment uses Supabase Frankfurt, every GDPR data-subject right (Art. 15–20) is self-serviceable from settings, a standard Art. 28 DPA is available on request, and workspace data is not used to train AI models.
Where does Specky store my data?
Workspace data is hosted in the configured Supabase region, currently Frankfurt for the EU deployment. AI inference (Google Gemini) is processed in the US under a no-storage, no-training business agreement. EU-only AI processing is not a self-serve capability today.
Does Specky train AI models on my data?
No. Your data never trains a model. Prompt data sent for AI inference is not stored by the provider and is not used for training under our business agreement — an explicit contractual position, not a “we may use data to improve our services” clause.
Does Specky sign DPAs?
Yes. A standard Data Processing Agreement (GDPR Art. 28 compliant) is available immediately on request, and enterprise customers can arrange custom DPAs with additional standard contractual clauses (SCCs) for international transfers.
How do I exercise my GDPR rights in Specky?
Self-service, from workspace Settings → Privacy & Data: right of access (data export), right to erasure (account deletion with a 30-day grace period), right to data portability (JSON export), and per-purpose consent management. You don't need to email anyone.
Is Specky in scope for the EU AI Act's high-risk categories?
Specky's AI features draft documents, synthesise product signals, and generate tickets — they operate on artefacts, not on decisions about people. Annex III's high-risk categories cover use cases like hiring, credit scoring, and biometrics. A written statement of Specky's conformity posture is available on request via security@specky.space.
This page is general information, not legal advice. Verify compliance requirements against primary regulation (GDPR, EU AI Act) and your own DPO or legal counsel.
Compliance as a non-issue, not a project
Subscribe now — the current EU deployment uses Frankfurt, a DPA is available on request, and workspace data is not used to train AI models. Or send this page to your DPO and let them run the checklist.