Not "we have a server in Frankfurt" compliance. Need actual DPA, data location guarantees, subprocessors listed, the whole thing. Running inference workloads for a healthcare client and their legal team is *picky*.
Tried two hosts so far. One sent me their "privacy policy" which was just a WordPress page. The other said "GDPR compliant" but couldn't tell me if backups replicate to US nodes. Lol no.
Need:
- EU entity
- Signed DPA
- Data stays in EU including backups and logs
- Right to audit
Bonus if they know what a TOM is without me explaining.
Any actual experiences? Not marketing fluff. Ngl I've burned a week on this already.