GDPR-compliant hosting for AI-built internal tools
Someone on your team built a tool the whole company now runs on. We find it, secure it, and put a named, accountable engineer behind it.
Get a free inventory-and-risk auditWhat you get
A signed DPA
A real data processing agreement, backed by a UK/EU-reachable entity with a rehearsed breach-response runbook, not a template PDF.
EU data residency
Your own Postgres database, hosted in the EU, with tested backups — a straightforward answer to your next security questionnaire.
A named human
One accountable engineer for every tool we take on — not a rotating support queue nobody in your org can name.
How it works for an SME team
- 1. Free inventory-and-risk audit. We check one vibe-coded tool your team already relies on: the same 15-point production audit we run for individual founders, applied to your internal tool.
- 2. Enterprise Shadow-App Cleanup. If you have more than one such tool, our fixed-scope rescue inventories all of them, fixes what's broken, and produces GDPR records-of-processing documentation and a signed DPA. See rescue services.
- 3. Ongoing managed hosting. Each tool converts to its own flat-rate subscription — see pricing.
FAQ
What is a shadow AI app?
An internal tool someone on your team vibe-coded with an AI tool like Lovable or Bolt, that your IT department never reviewed, provisioned, or signed off on. It runs on someone else's hosting, with someone else's idea of security.
Do we need a DPA for an internal tool?
If the tool processes any personal data (customer records, employee data, anything identifiable), yes. A data processing agreement is required under UK/EU GDPR wherever a processor handles that data on your behalf.
What does "EU data residency" actually mean here?
Your database and backups are hosted on EU servers, not routed through a US platform's default region. That matters for GDPR data-transfer rules and for straightforward answers to a customer's security questionnaire.