EU data residency
Client data stays in the EU. We do not store it.
The documents and client data you put into a Lowkey tool are processed only to produce your form, then discarded. We keep one billing line per finished document, never the contents. Every part of the stack that touches your data runs on EU infrastructure. Your firm stays the controller, Lowkey acts as your processor. That keeps the work inside your professional confidentiality and the GDPR.
Where is our data located?
Data residency follows from how the system is built, not from a promise. Every layer that can touch your client data sits in the EU.
| Hosting and access point | Cloudflare (Pages and Workers), served from EU edge locations. |
| Reading uploads | AWS Bedrock in the EU region (Ireland), with EU-resident Claude inference profiles. No US inference endpoints. |
| Database | Cloudflare D1, West Europe region. |
| Document processing | A dedicated server at Hetzner in Nuremberg, Germany. |
| Payments | Stripe, for billing and contact details only, under EU processor terms. |
What do you store, and what not?
We do not store the uploads and client data. A contract, a payslip or structure data you give a tool lives in memory for the duration of the processing and is not written to a database or file storage. We do not build profiles and we do not use your input to train anything.
What we do keep is what is needed to run your account and bill you: your name, business email, firm, VAT number and payment status, plus one line per finished document with the tool and the timestamp. That line holds no client content.
Does this fit my professional confidentiality?
Yes. Your firm stays the controller of your clients' data. Lowkey acts as your processor and handles that data only on your instruction, to produce the result you ask for. A data processing agreement is in place with each underlying processor, and where a transfer would otherwise occur, the EU standard contractual clauses apply.
Working with us as a firm and need the formal data processing agreement? Ask for it and we will send it over. The full processing detail is in the GDPR statement.
Why this differs from a general AI tool
With a general chatbot you often do not know where the input lands, whether it leaves the EU, or whether it is stored or reused. With Lowkey that is fixed at build time: EU-only and not stored. On top of that, a model never decides the numbers here. The math and the form-filling are deterministic code; a model only reads a messy upload so a person does not have to retype it. For the full trade-off, read the comparison with general AI and legal copilots.
General information, not personalized tax advice. The tools fill in forms and draft the cover letter. The judgement and the responsibility stay with your firm.