ISMS CopilotWhy EU compliance teams cannot run client data through US AI
Schrems II, the US Cloud Act, and sectoral rules like HDS, SecNumCloud and KRITIS make American AI a real audit risk for compliance work. ISMS Copilot always stores data in the EU (AWS Frankfurt), and its Advanced Data Protection setting runs AI only on Mistral AI, an EU-headquartered provider, in Frankfurt.
Sending client compliance data through OpenAI or Anthropic is an audit finding waiting to happen.
Schrems II struck down the EU-US Privacy Shield. The replacement Data Privacy Framework is already being challenged in court. The US Cloud Act gives American authorities reach into any US-headquartered cloud or AI provider's data, regardless of where it is physically stored. ISO 27001 control A.5.14 expects you to evaluate that exposure before you transfer. ISMS Copilot always stores data in the EU (AWS Frankfurt), and its Advanced Data Protection setting, off by default, runs AI only on Mistral AI (EU-headquartered). AWS is a US-headquartered sub-processor, so include it in that evaluation.
What's the legal risk, exactly?
GDPR Chapter V (Articles 44–50) governs international data transfers. The Schrems II ruling (CJEU, July 2020) struck down the EU-US Privacy Shield. The current EU-US Data Privacy Framework is the third attempt at a US adequacy decision, and is already under legal challenge. Until that's resolved, every transfer of personal data — including the personal data of staff, contractors and clients buried inside compliance evidence — to a US-headquartered AI provider sits on contested legal ground. The harder problem is the US Cloud Act (2018): even when a US-headquartered provider hosts data in Frankfurt or Dublin, US federal authorities can compel disclosure. Storage location is not the same as legal jurisdiction. For compliance professionals handling client data, that's not a hypothetical — it's the exact thing your clients hire you to know about.
Why your auditor cares about your AI tooling
- ISO 27001 Annex A.5.14 (information transfer) — you must evaluate the protection of information transferred outside the organisation, including to AI processors.
- ISO 27001 Annex A.5.23 (information security for use of cloud services) — controls and supplier management apply to cloud-based AI.
- GDPR Article 28 — you remain responsible for the data processors you choose, including AI vendors.
- GDPR Chapter V — any personal data leaving the EEA needs a valid transfer mechanism, and the current ones are contested.
- DORA Article 28 (in-scope financial entities) — ICT third-party risk obligations extend to AI suppliers.
- NIS 2 Article 21 — supply chain security covers AI vendors as part of your supply chain.
- Sectoral rules (HDS for French health data, SecNumCloud for sovereign cloud, KRITIS for German critical infrastructure, and parts of TISAX) go further than GDPR and can restrict US-headquartered providers in the data path. Check your setup against the regime that applies to you.
What ISMS Copilot does differently
ISMS Copilot's Advanced Data Protection routes every prompt and every uploaded document through European AI infrastructure. AI inference runs only on Mistral, the French AI company headquartered in Paris, hosted in Frankfurt. Database and file storage are always on AWS in Frankfurt, with encrypted backups in Amsterdam, whether or not the setting is on. Turn it on in Settings → Data Protection. There is no upgrade gate, no enterprise contract, no minimum seat count. Advanced Data Protection is available on every plan, including the free trial.
What's covered by Advanced Data Protection
AI inference: Mistral models hosted in Frankfurt (EU)
Always on, whatever the setting: storage on AWS Frankfurt (EU), encrypted backups in Amsterdam
Off by default. Turn it on in Settings → Data Protection
Available on every plan, including the free trial
No training on customer data, regardless of mode
Retention you set, from 1 day to 7 years
Documented in our DPA, with a data flow diagram you can hand to an auditor
ISMS Copilot with Advanced Data Protection vs. using ChatGPT or Claude on client data
| Feature | ISMS Copilot | Other |
|---|---|---|
| AI processor | Mistral (France), hosted in Frankfurt | OpenAI / Anthropic on US infrastructure |
| Data storage | AWS Frankfurt, EU only | US data centres by default; EU regions only on enterprise tiers |
| Where AI processing and storage run | Mistral AI (EU-headquartered) for processing; AWS Frankfurt (EU) for storage | US-headquartered vendors; processing and storage regions depend on the plan |
| ISO 27001 A.5.14 audit defence | Documented flow: Mistral AI (EU-headquartered) for processing; AWS Frankfurt (EU) for storage | Requires DPIA, SCCs, and case-by-case justification |
| Sectoral fit (HDS, SecNumCloud, KRITIS) | Mistral AI (EU-headquartered) for processing; AWS Frankfurt (EU) for storage; check against the regime that applies to you | Often restricted; check the regime |
| Cost | Included on every plan, including free trial | Enterprise contract typically needed for EU residency |
What about other GRC platforms?
Most US-headquartered GRC platforms (Vanta, Drata, Secureframe) host customer data in US AWS regions and use OpenAI as the AI backbone. Some now offer EU regions for enterprise customers, but the AI layer often remains US-based regardless of the storage region. The result: the policy text, control descriptions, and risk register entries you generate inside those platforms are processed by an OpenAI endpoint that's both Cloud Act-exposed and contested under Schrems II. ISMS Copilot is built EU-first: storage is always in the EU (AWS Frankfurt), and with Advanced Data Protection on (off by default), an EU-headquartered AI provider (Mistral) handles inference. Advanced Data Protection is available on every plan, not as an enterprise upsell.
See the ISMS Copilot vs ChatGPT comparison →Founded in France, built EU-first
ISMS Copilot was founded in France by an ISO 27001 consultant who got tired of explaining to clients why their compliance evidence shouldn't run through an American chatbot. Advanced Data Protection isn't a feature flag bolted on for the European market. It's how the product was designed from day one. The founder works inside the audit reality every week, and EU data residency is part of the product brief, not an afterthought.
EU data residency is half the answer
Where compliance data flows is one part of the case for ISMS Copilot. The other half is what compliance work actually needs from an AI tool — workflow, framework depth by clause, audit-shaped outputs, sectoral regime coverage, and product decisions made by people who still run audits. A specialised compliance AI is more than a chatbot in EU clothing.
Frequently Asked Questions
Is Advanced Data Protection an extra cost?
No. Advanced Data Protection is available on every plan, including the free trial. There is no upgrade gate, no enterprise contract, and no minimum seat count.
Is Advanced Data Protection on by default?
No. Advanced Data Protection is off by default. Turn it on in Settings → Data Protection. It is available on every plan.
Doesn't the EU-US Data Privacy Framework solve this?
The DPF is the third attempt at a US adequacy decision (after Safe Harbor and Privacy Shield, both struck down). It is already under legal challenge in the CJEU. Storage is always in the EU (AWS Frankfurt; encrypted backups in Amsterdam); with Advanced Data Protection on, prompts and documents are also processed only by Mistral AI, an EU-headquartered provider, in Frankfurt.
Why Mistral specifically?
Mistral is a French AI company headquartered in Paris, with no US parent. Advanced Data Protection runs on its Frankfurt hosting. It's also competitive with US frontier models for compliance work, so turning it on does not cost you output quality.
Can I prove Advanced Data Protection is on for an audit?
Yes. Settings → Data Protection shows its status, and our DPA includes the data flow diagram showing Mistral and AWS storage, both in Frankfurt. Both are auditor-friendly artefacts.
Is ISMS Copilot a US-headquartered company?
No. ISMS Copilot is a French company. Some of its sub-processors are US-headquartered: AWS stores data in its Frankfurt region, and with Advanced Data Protection off, AI runs on open-source models via OpenRouter (US). Transfers to the US AI providers are covered by Standard Contractual Clauses, and the data flow is documented in our DPA.
What if I'm a US-based consultant with EU clients?
Turn on Advanced Data Protection in Settings → Data Protection for those engagements. Many US-based consultants keep it on whenever the work involves EU client data. It is an account setting, available on every plan.
What about TISAX, HDS, SecNumCloud, KRITIS?
These sectoral regimes go further than GDPR and can restrict US-headquartered providers in the data path, even those offering EU regions, because the parent entity is still subject to US law. Storage is always in the EU (AWS Frankfurt; encrypted backups in Amsterdam), and Advanced Data Protection runs AI only on Mistral AI, an EU-headquartered provider, in Frankfurt. Check that setup against the regime that applies to you. Turn it on in Settings → Data Protection.
Stop transferring client data to US AI.
Spin up a workspace with Advanced Data Protection on. No credit card. Free to try on every plan.