- GDPR-compliant AI
- Fixed price in 3 days
- Privacy pass in 1-3 weeks
AI that respects
GDPR by design.
Embeddings of personal data are personal data. I build AI that keeps it in the EU, sends models the minimum, and deletes it everywhere when asked.
You talk to the engineer who builds it.
12products shipped
7 built solo, 5 embedded in client teams.
What I build in.Privacy you can prove.
- 01
EU residency
Model endpoint, vectors, database and logs in EU regions, or a self-hosted model where a provider cannot guarantee it.
- 02
Minimization
Redaction and pseudonymization before anything reaches a model.
- 03
Right to be forgotten
One deletion path through source data, the vector index, caches and fine-tuning sets, with a record that it ran.
- 04
No retention
Zero-retention tiers, signed DPAs and no-training flags, configured and verified.
- 05
Audit-ready logs
Records of processing that turn a data-subject request into a quick task.
- 06
Leak defense
Guardrails so personal data in context cannot be extracted by injection.
Call to launch.In weeks, not quarters.
Start with the callErgini · Software & AI developer
I build every project myself,so I only take a few at a time.
3 days
A fixed price, in writing,
three days after the call.
- Scoped from what we discuss on the call.
- Agreed before any work starts.
- Engineering only: DPAs and legal sign-off stay with your counsel or DPO.
Questions.Answered straight.
Can I use OpenAI or Claude and still be GDPR-compliant?
Yes, with the right setup. Both Anthropic and OpenAI offer data processing agreements and zero-retention or no-training options on their API tiers, and both are reachable through EU cloud regions via Azure, Amazon Bedrock, or Google Vertex AI. The compliance work is choosing the right tier, signing the DPA, configuring retention, and keeping personal data minimized. I handle the technical side of that.
How do you keep AI data inside the EU?
Three levers: pick an EU region for the model endpoint (Bedrock, Vertex, or Azure OpenAI in Frankfurt, Dublin, or similar), keep your vector store and database in the EU, and route logs and analytics to EU infrastructure. Where a provider cannot guarantee EU processing, I move that step to a self-hosted open-source model instead.
What about the right to be forgotten with RAG and embeddings?
This is the part most teams get wrong. When a user asks to be deleted, their data has to come out of the source store, the vector index, any caches, and any fine-tuning set. I build a deletion path that actually traverses all of those, with a verifiable record that it happened. Embeddings of personal data are personal data.
Is this the same as EU AI Act compliance?
Related but separate. GDPR governs personal data; the EU AI Act governs AI systems by risk. Many products need both. I implement the technical controls for each - see my EU AI Act compliant development service for the AI Act side - and your legal counsel owns the legal interpretation.
Do you provide the DPA and legal documents?
I implement the technical and organizational measures and document them, which is what your DPA and records of processing reference. I do not draft legal contracts - that is your counsel or DPO. I make sure what the documents promise is actually true in the code.
How much does GDPR-compliant AI cost?
It depends on what already exists, and you get a fixed price in writing within three days of a free 30-minute call, before any work starts. A privacy pass on an existing AI feature (residency, retention, deletion path) takes 1-3 weeks; a full privacy-by-design build with EU residency and audited deletion takes 3-6 weeks.
Pick a time.The call is free.
30 minutes, on Google Meet
Prefer email? ergin@ergini.com. I reply within hours.