CRM, note-taker, LLM… how to build a GDPR-compliant CS stack

A prospect sends you their security questionnaire. Question 12: "Where is our users' data hosted?" Your knee-jerk answer: "In Europe." Except your helpdesk summarises tickets with an LLM called from who knows where, and one of your CSMs' note-takers records your QBRs on US servers. Nobody's lying, but nobody really knows. Here's how to sort it out, tool by tool, and build a stack that stands up to scrutiny!

In a previous article, we looked at what happens when you connect your tools to an LLM like Claude: the data the AI reads leaves Europe, and sometimes stays there for a long time. But the issue doesn't stop at the LLM.

A Customer Success team works with a CRM or a Customer Success Platform, a ticketing tool, a note-taker, NPS surveys and product analytics. Every one of these tools stores personal data. And over the past two years, almost all of them have added an AI layer that sends this data to a model, somewhere.

So the real question is no longer "is my LLM compliant?", but "is my stack compliant?". We've reviewed the tools most widely used in B2B SaaS on three levels: where the data is stored, where the built-in AI runs, and what flows between tools.

A CS stack means 6 to 10 tools handling personal data

Let's start with a clarification that avoids plenty of misunderstandings. GDPR doesn't talk about PII but about personal data: any information relating to an identifiable person, even indirectly. A pseudonymous user ID, an IP address or a named usage history all count.

By that definition, a CS team's stack is full of it:

• CRM: contacts, emails, phone numbers, call notes, contract values.
• Support: tickets, often tied to a named person, sometimes containing data about your customers' own customers.
• Note-takers and video calls: emails, recordings, transcripts, voices, what was said.
• NPS and surveys: answers and verbatim comments linked to a respondent.
• Product analytics: who does what in your product, when, and from which device.
• Customer Success Platform: all of the above, centralised to calculate a health score.
• Billing: billing contacts, addresses, payment methods (usually tokenised).
• LLM: everything you get it to read and analyse.

And these tools don't live in isolation. The note-taker pushes its meeting notes into the CRM, the CRM feeds the CSP, the CSP triggers alerts in Slack. Every connection is a flow of personal data, and every flow can leave Europe.

So a stack is only compliant if every link in the chain is. All it takes is one tool hosted in the US for the promise "your data stays in Europe" to fall apart.

Hosting in Europe: almost always possible, rarely the default

The good news first: almost every major US vendor now offers hosting in the European Union. HubSpot, Salesforce, Zendesk, Intercom, Freshdesk, Gong, Mixpanel and Segment all have an EU region.

The catch: having an EU option doesn't mean your data is there. The pitfalls are always the same:

• The region is chosen at sign-up. With Freshdesk, Mixpanel or Chargebee, it's set when the account or project is created. If nobody thought about it, you're in the US.
• Switching region afterwards is complicated. With Intercom, Mixpanel or Segment, you have to create a new workspace and migrate the data, often by hand.
• The option is reserved for top-tier plans. With SurveyMonkey and Typeform, EU hosting only exists on Enterprise. With Intercom, it goes through a contract.

And some tools simply have no European option. That's the case for Fathom and Granola, two very popular note-takers hosted only in the US.

In practice, the first question to ask isn't "does this tool offer the EU?", but "is my account actually hosted in the EU?". The answer is in your account settings.

Built-in AI, the new blind spot

This is the point most teams miss. And it's where everything is at stake today.

Storage in Europe, AI elsewhere

When you use a tool's AI feature (summarising a ticket, condensing a call, analysing NPS comments), the vendor sends the content in question to a language model. The ticket, the transcript or the survey answers therefore go to a third party.

There's nothing unusual about a vendor using OpenAI, Anthropic or Google rather than its own models. Almost everyone does. The real question is where the model call runs. A tool can store your data in Frankfurt and send every AI request to a model running in the US.

It all depends on how the vendor calls the model: through a European regional endpoint (Azure OpenAI in Europe, AWS Bedrock or Google Vertex AI in an EU region), or through a "global" endpoint that can process the request anywhere.

Three scenarios

Going through vendors' documentation, the same situations come up again and again:

• The AI is processed in the EU, and it's documented. HubSpot, Zendesk, Intercom, Freshdesk, Modjo, Leexi and Noota state where their models run for European accounts.
• The AI goes through global or US endpoints. Attio says so in black and white in its AI policy. Atlassian-hosted models run in the US.
• The vendor says nothing. This is the most common case, including among European vendors hosted in the EU.

A word of caution: "undocumented" doesn't mean "outside the EU". It means you can't vouch for it to your customers. And if your terms and conditions promise processing in Europe, that's already a problem.

Other AI pitfalls

Location isn't the only issue. Three points come up regularly:

• Model training. Some note-takers, such as Fathom and Granola, use de-identified or anonymised data by default to improve their in-house models. You have to go and switch the option off.
• Retention by the model provider. At Help Scout, data sent to OpenAI may be kept for up to 30 days.
• Ancillary features. At HubSpot, AI is processed in Europe for EU accounts, but the web search it uses goes through US services.

In other words, for every AI feature, you need to know which model is used, where it runs, how long the data is kept and whether it's used to train anything.

Category by category: where do the tools stand?

We checked the public documentation of the tools most widely used in B2B SaaS: sub-processor pages, DPAs, help centres. The tables reflect the situation as of 7 November 2026. This information changes quickly, so always check the situation for your own account.

CRM

Support

Note-takers and video calls

This is the category with the starkest contrasts. It's also the most sensitive, since it records your customers' voices and what they say.

The note-taker installed without sign-off

The real risk isn't always the tool the company chose. It's the one a CSM installs on their own, on the free plan, because it saves them an hour a day. They invite it to their customer calls, accept terms they haven't read, and the recordings end up on servers whose location nobody knows.

Without clear rules, every CSM does their own thing. A few guardrails are enough:

• a list of approved tools, known to the whole team;
• no free or personal accounts for recording customer calls;
• informing participants, or even getting their consent, before every recording;
• model training switched off in the settings;
• a defined retention period for recordings.

NPS, CSAT and surveys

EU hosting is easy to get: many of the players are European. AI, on the other hand, is almost always a black box, even though automatic analysis of verbatim comments is the most heavily promoted feature.

Product analytics

A user ID, even a pseudonymous one, is still personal data. And named usage is precisely what feeds a health score. The good news: AI is still not very present here, and the issue is mainly about hosting.

Customer Success Platforms

We've published a full comparison of European Customer Success Platforms and GDPR. In short:

LLMs

We covered this in detail in our article on LLMs and customer data: neither claude.ai nor Anthropic's API offers EU residency today. ChatGPT Enterprise, Gemini and Copilot do on their top-tier plans, provided they're configured properly. For use with customer data, the safest route is still a model called through Vertex AI or AWS Bedrock in a European region.

How to build a compliant stack

There's no need to replace everything overnight. But you do need to know where you stand. And that takes five steps.

1. Map your tools and data flows

List every tool that touches customer data, including the ones teams installed without going through IT. Then note the connections between them: who pushes what to whom. This is often the stage where you discover the free note-taker or the home-made automation that exports everything to a server in the US.

2. Rank them by sensitivity

Not all tools are equal. A call transcript or an inbox contains far more personal data than an aggregated usage dashboard. Focus your efforts on the most sensitive tools: note-takers, support, CRM.

3. Ask each vendor the right questions

For each tool, five questions are enough:

• Where is the data for my account stored?
• For each AI feature: which model, called where, kept for how long, and used for training or not?
• Which sub-processors are involved, and in which countries?
• Which data still leaves the region (support, billing, monitoring)?
• How long is the data kept, and who can set that period?

If the vendor can't answer on AI, that's an answer in itself.

4. Configure your tools from day one

Much of compliance comes down to settings. Choose the EU region when you create the account. Switch AI on knowingly, and only where it's processed in Europe if your commitments require it. Switch off model training. Set retention periods.

5. Document and set rules

Update your record of processing activities and your list of sub-processors. Prepare standard answers for your customers' security questionnaires. Above all, give your teams clear rules: which tools are approved, for which uses, with which data. Without that, the map from step 1 will be out of date within three months.

What we did at Skalin

A Customer Success Platform centralises precisely your customers' most sensitive data: usage, tickets, conversations, contracts. So we couldn't settle for hosting the data in Europe while the AI was processed who knows where.

In practice:

• The data is hosted on Google Cloud, in Belgium.
• The AI features use Claude, called through Google Vertex AI in the Europe region. Requests are processed in the European Union and don't go through Anthropic's infrastructure in the US.
• Before being sent to the model, the content of emails and tickets is pseudonymised: we remove surnames, phone numbers, email addresses and secrets.
• Our customers' data feeds our in-house scoring models, but is never used to train LLMs.

It's exactly the approach we described for LLMs: use a state-of-the-art model, but call it where your commitments allow. AI performance and compliance aren't incompatible, as long as you think about them together from the start.

Conclusion

Just two years ago, stack compliance came down to one question: where is the data hosted? With AI built in everywhere, you need a second one: where is it processed when the AI uses it?

The good news is that there are answers in every category. CRMs, support tools, note-takers and CSPs can now keep both the data and the AI in Europe. But rarely by default, and rarely without some thought.

So before you add a new tool to your stack, or switch on the latest AI feature of one you already use, ask the five questions. Your customers will ask you them anyway!

Further reading

• LLMs and GDPR: stop messing about with your customer data!
• No, Claude Is Not Going to Replace Your Customer Success Platform
• The essential tools every Customer Success Manager needs in 2026
• CSAT, CES, NPS: which satisfaction metric should you choose?
• Artificial Intelligence for Enhancing Customer Success