The GDPR problem hiding in your tech stack
Most AI engineering teams select their data APIs based on performance, pricing, and ease of integration. GDPR compliance rarely appears on the evaluation checklist until a legal review or a procurement conversation with an enterprise customer surfaces it. By then, the API is already in production and the data has already been flowing.
For companies operating under GDPR, the search API you use in your AI pipeline is not a neutral infrastructure decision. It is a data transfer decision. And if you are sending queries that contain personal data to a US-based API, you are making a third-country transfer under Article 44 of GDPR, which comes with specific legal obligations that most teams have not satisfied.
What counts as a personal data transfer
A search query becomes a personal data transfer when it contains, or could reasonably identify, a natural person. In AI search pipelines, this happens more often than teams realise:
- Name lookups. Queries like "Dr. Elena Fischer oncology" or "who are the leading experts on CRISPR" sent with a user's name or email in the request context become personal data once attached to an identifiable individual.
- Professional profile searches. Looking up an expert by name, company, or topic to enrich a contact or verify credentials involves personal data about a third party.
- Agentic pipelines. AI agents that browse, search, and retrieve on behalf of users often pass user-supplied terms, including names, downstream to search APIs without explicit sanitisation.
The determining factor is not whether your query is labelled "personal data". It is whether the data you are sending relates to an identified or identifiable natural person. Under GDPR, the burden of proof sits with you.
Why US-based APIs create compliance risk
GDPR Article 44 prohibits transfers of personal data to third countries outside the European Economic Area unless specific safeguards are in place. For most US-based APIs, the applicable mechanism is Standard Contractual Clauses (SCCs) under Commission Implementing Decision 2021/914.
SCCs are not a box to tick: they require a Transfer Impact Assessment (TIA). You must evaluate the laws and practices of the destination country (the US), assess whether they undermine the protections in the SCCs, and document your conclusion. Following the Schrems II ruling in 2020, US surveillance law (FISA 702, EO 12333) means TIAs for US transfers require meaningful analysis and often additional supplementary measures.
For a startup or a mid-size product team calling a US search API, this is not a theoretical risk. Enterprise customers increasingly require documented evidence of GDPR compliance in their vendor assessments. Data Protection Authorities across the EU have issued fines for undocumented transfers. And the cost of a DPA inquiry (legal fees, management time, potential fine) dwarfs the marginal cost of choosing a European infrastructure from the start.
The infrastructure question
Many European SaaS companies assume that choosing a vendor with a "GDPR-compliant" label or a DPA agreement is sufficient. It is often not. The relevant question is not whether the vendor has signed a DPA: it is where the data actually flows. If the vendor processes data on AWS us-east-1 or Azure eastus, personal data is inside US jurisdiction regardless of what the contract says.
True GDPR compliance for data transfers means no personal data leaves the EEA at the infrastructure level. This requires the vendor to process exclusively on European-hosted compute, use European-hosted AI inference, and store data only on European-hosted storage. A contract is not a substitute for geography.
What Amygdala's infrastructure looks like
Amygdala was designed as a European-infrastructure-first product. Every component in the stack sits within the EEA:
- Compute and storage. Hetzner Cloud (Nuremberg, Germany and Helsinki, Finland). No US hyperscaler involvement at the infrastructure level.
- AI inference. Mistral AI (Paris, France). No data sent to OpenAI, Anthropic, or other US-based model providers.
- Vector database. Weaviate (Amsterdam, Netherlands). Semantic search runs in-region.
- CDN and DNS. European providers. No Cloudflare Workers or AWS CloudFront processing personal data.
When you call the Amygdala API from within the EU, your data does not leave the EEA. There is no third-country transfer to document, no TIA to write, no FISA 702 exposure to assess. See the full architecture breakdown on our European infrastructure page.
What to check in your current stack
If you are building an AI application in the EU and are unsure about your current exposure, run through this checklist:
- List every external API your pipeline calls. For each, identify the company's HQ and the physical location of their data processing infrastructure (not just their DPA checkbox).
- Identify which calls could carry personal data. User-supplied search terms, name lookups, profile enrichment requests.
- Check your DPAs. A DPA without SCCs is not a valid transfer mechanism for US vendors. If SCCs are in place, locate your TIA.
- Talk to your DPO. If you do not have a DPO, talk to external counsel before onboarding enterprise customers with data residency requirements.
The procurement angle
Beyond regulatory risk, GDPR compliance is increasingly a sales requirement. Enterprise procurement teams in Germany, France, the Netherlands, and the Nordics routinely include data residency questions in vendor security questionnaires. Public sector contracts in many EU member states now explicitly require European infrastructure.
Being able to answer "all data stays in the EU, no US transfers, here is our infrastructure breakdown" is not just a compliance answer, it is a sales answer. It removes a blocker for the procurement teams, legal teams, and CISOs who would otherwise flag your product as a risk.
Bottom line
If you are building AI in the EU, your search API is a GDPR decision. Defaulting to the most popular US-based API because it has a free tier and good documentation creates compliance debt that becomes expensive to unwind once enterprise customers start asking questions. Starting with European infrastructure costs you nothing in terms of and removes a category of legal risk that you should not be carrying.
European infrastructure, no US transfers