dgbizzQ: FuseBase GDPR, EU hosting and AI – AppSumo plans
Hi Pavel,
I’ve read your GDPR page, DPA and AI terms. For EU client-data use on AppSumo LTD plans, please clarify:
1. Is EU/EEA hosting available? Which countries, tiers and extra fees? Does it cover files, databases, backups, logs, AI and overseas support access?
2. Can we get a signed, dated DPA with completed annexes covering portals, apps, AI, OCR/transcription and our role as a processor for clients?
3. Please share your official DPF listing or applicable SCC transfer assessment and safeguards.
4. Which AI providers/regions apply? Can you guarantee no training/fine-tuning? What retention and human review apply? Can admins disable AI?
5. Maximum deletion times for records, backups, AI logs and embeddings?
6. Can LTD users access the SOC 2 report, enforce MFA and receive subprocessor-change notices?
Links welcome.
Thanks,
DG
Pavel_FUSEBASE
Oct 13, 2026A: Hi
1) Data is currently stored in the US on Amazon and Azure servers. Hosting in Europe is possible but would require a separate discussion.
2) Yes, of course. Please contact support at [email protected].
3) You can find information about product security here - https://trust.delve.co/fusebase I’ll also check on DPF and SCC.
4) GPT models, as well as DeepSeek and Kimi, are currently available on US servers. We guarantee that customer data is not used to train the models. AI can be disabled entirely upon request.
5) Backups are created daily and retained for one month. You can also create manual backups of your notes and databases (dashboards and PostgreSQL).
6) Yes, of course. You can find the information here - https://trust.delve.co/fusebase MFA can be enabled in the organization settings.
Hi Pavel, thanks for the DPA and security links. Just three points remain:
1. Please share the promised DPF/SCC update. Your DPA already includes SCCs; is there a summary of the US transfer assessment and safeguards?
After we delete a file or close the account, what is the maximum time until the data and backups are deleted? How does one-month backup retention fit the DPA's seven days after account termination?
If we use AI with client data, which companies actually receive our prompts, and how long are prompts and responses retained?