"We Don't Sell Your Data" Is Not a Compliance Statement. Here's What Is.
Contractual Data Processing Guarantees vs. Marketing Claims in Financial AI
---
Your AI vendor's website says "We don't sell your data." Check their DPA — the legally binding document GDPR Article 28 requires them to provide. If they don't have one, or if it doesn't specify where your data is processed, how long it's retained, and whether it's used for model training, that marketing claim is worth nothing in an audit. Or in front of a regulator.
Signing a contract with an AI vendor who says "we don't sell your data" without providing any DPA is like hiring a financial auditor who promises to be honest while refusing to sign the engagement letter. The promise is lovely. The liability is yours.
---
The Six Things That Phrase Doesn't Cover
"We don't sell your data" is a statement about one out of six ways an AI vendor can extract value from your financial documents. The other five: using your data to train AI models they sell to other clients; analyzing aggregate patterns across all customer data to improve their product; retaining your data after contract termination with no deletion obligation; sharing it with sub-processors — cloud platforms, annotation services, API providers — whose own data practices you've never reviewed; and processing it on servers outside the EU, subject to foreign government surveillance laws you can't audit.
Genuine compliance requires all six to be addressed in writing. A marketing phrase covers one — and only if the specific definition of "sell" matches what you assumed it meant.
---
What GDPR Article 28 Actually Requires
Lawyers call it the controller-processor relationship. CFOs call it buying software. GDPR calls it a legal obligation that comes with fines up to €20 million or 4% of global annual turnover — whichever is higher.
When your AI vendor processes financial documents — invoices, contracts, accounting records containing personal data — you are the data controller and they are the processor. Article 28 of GDPR requires a written Data Processing Agreement (DPA) between every controller and processor. Not optional. Not implied by your SaaS terms. Written. Signed. Specific.
The DPA must specify: the purposes of processing, the duration of processing, the nature of processing, the type of personal data involved, the categories of data subjects, and — critically — the controller's instructions that the processor must follow. If your AI vendor processes financial documents and hasn't signed a DPA with you, you are already non-compliant. The question is whether anyone has noticed yet.
Procurement teams see "GDPR compliant" on the vendor's website and treat it as a checkbox. Legal teams know that "GDPR compliant" is not a certification — it's a claim that must be backed by documentation. The only thing that validates a vendor's claim is the signed DPA and the specific clauses it contains.
---
What the Enforcement Record Shows
Three enforcement cases define what happens when the gap between marketing claims and contractual reality comes under regulatory scrutiny.
Ireland's Data Protection Commission fined Meta €1.2 billion in 2023 — the largest GDPR fine to date — for transferring EU user data to US servers without adequate legal basis following the Schrems II ruling. The Schrems II ruling (2020) invalidated the EU-US Privacy Shield framework, meaning that Standard Contractual Clauses (SCCs — the legal template approved by the EU Commission for transferring personal data to countries outside the EU) alone are no longer sufficient for US data transfers. Supplementary measures must now be documented and verified for every cross-border transfer. Any AI vendor processing EU financial data on US infrastructure without valid transfer mechanisms is operating in the same exposure category that cost Meta €1.2 billion.
France's CNIL fined Google €90 million for placing analytics and advertising cookies without user consent — not for selling data — for processing it without proper legal basis. The pattern: companies that believe their privacy claims eliminate their documentation obligations are the companies that face enforcement action.
Samsung's experience provides a different kind of cautionary example. After discovering that engineers had pasted proprietary source code into ChatGPT in 2023 — three separate incidents in a single month — Samsung banned internal use of external AI tools. Finance teams pasting financial documents into public AI tools create the same category of exposure, without the formal ban that Samsung implemented. The difference between Samsung's situation and most European finance teams: Samsung found out.
---
The DPA You Should Ask For
A GDPR-compliant DPA for financial AI processing contains specific clauses that standard vendor agreements often omit. An explicit model training exclusion is non-negotiable: the DPA must state clearly that the vendor cannot use your data to train AI models, either directly or in aggregate. Without this clause, "we don't sell your data" is silent on whether your financial documents are being used to make their AI smarter for other clients.
Sub-processor transparency — a complete list with notification rights — is required under Article 28(2): the processor cannot engage sub-processors without the controller's authorization. General authorization — "we may use sub-processors as needed" — is technically permitted by GDPR with prior notice rights, but for financial AI this is insufficient. You should know every system that your financial data touches, including the cloud providers hosting the AI infrastructure.
Geographic processing commitments must be explicit. An EU-only processing clause — or a documented alternative transfer mechanism — is essential following Schrems II. Article 46 of GDPR permits transfers outside the EU using Standard Contractual Clauses, binding corporate rules, or adequacy decisions. For US-based AI providers, the EU-US Data Privacy Framework (2023) provides a newer adequacy mechanism — and it is currently subject to legal challenge in European courts. A vendor relying on the DPF as their sole transfer mechanism is relying on a document that may be invalidated again, as its predecessor was.
Data retention and deletion obligations must specify how long data is retained after contract termination and the process by which deletion is confirmed. For financial AI processing invoices and contracts, data that persists after termination represents ongoing GDPR liability — and ongoing risk that it could appear in a breach, a regulator's investigation, or a vendor acquisition.
Audit rights under Article 28(3)(h) give the controller the right to conduct audits and inspections of the processor's compliance. Ask the vendor: can you audit their compliance with the DPA's terms? If their answer is "we have SOC 2 Type II" — that's their auditor's assessment of their controls, not yours. Your audit right is separate and must be explicit in the DPA.
---
The Compounding Risk
Each compliance gap multiplies the others. No DPA means no documented legal basis, which means no compliant sub-processor contracts, which means no valid transfer mechanisms for cross-border processing, which means the entire processing chain is built on undocumented assumptions. If a regulator pulls that thread — following a breach, a complaint, or a routine supervisory inspection — the exposure isn't one violation, it's the entire chain.
For financial entities subject to DORA (Digital Operational Resilience Act, applying to EU financial entities from January 2025), the DPA gap creates a concurrent violation: DORA requires an ICT (Information and Communications Technology) third-party risk register that documents contractual arrangements with each critical technology provider. An AI tool without a DPA also lacks the contractual provisions DORA requires, including exit strategies, service level expectations, and incident notification obligations.
EU financial entities face all of these simultaneously — and they are not separate compliance programs. GDPR, DORA, the EU AI Act, and PCI-DSS each address different aspects of the same question: what are your documented obligations with every vendor who handles sensitive data, and can you prove you're meeting them?
---
What Genuine Contractual Protection Looks Like
Real protection requires a signed DPA specifying EU-only processing (or documented equivalent mechanisms), an explicit clause prohibiting model training on your data, a complete sub-processor list with your right to object to new additions, deletion confirmation within 30 days of contract termination, audit rights that don't depend on a third-party report, and a data breach notification obligation of 72 hours — matching GDPR's requirement to notify supervisory authorities.
Stralevo's architecture eliminates most of the DPA negotiation problem by eliminating the underlying risk. Processing happens within EU-sovereign infrastructure under your data residency requirements. Model training on customer data is architecturally prohibited — not contractually promised. Sub-processors are documented because the infrastructure is documented. When you request a DPA, the clauses it contains reflect how the product actually works, not commitments the vendor hopes to meet.
AI tools that enter your organization as a productivity solution can exit as a data processing agreement problem. The sales conversation covers features and pricing. The legal conversation covers DPAs that don't exist, sub-processors nobody audited, and processing locations nobody documented. The CFO who requires a DPA before signing is not creating friction — they're doing the job that GDPR assigns to them as the data controller.
---
Four Questions Before the Next Contract Signature
Every AI vendor handling your financial documents should answer four questions before signing:
Does a DPA exist, and can you receive it for legal review before contract signature? If the vendor requires signature of their standard agreement before providing the DPA, that's backward — and a signal about how they approach regulatory obligations.
Does the DPA explicitly state that the vendor cannot use your data to train AI models? "We don't sell your data" is not the answer to this question.
What is the complete list of sub-processors that will touch your data, and what is the notification process if new sub-processors are added?
Where is your data processed — specifically which data centers, in which countries — and what is the legal transfer mechanism for any processing outside the EU?
Vendors who answer all four questions with specificity and written documentation are ready for enterprise financial data. Vendors who answer with assurances, redirect to their privacy policy, or reference certifications instead of contracts are not — regardless of what their marketing page says about not selling your data.