Directory › Workflow automation › Activepieces
Is Activepieces UK GDPR compliant?
In plain English
Activepieces is an open-source (MIT core) automation tool whose cloud runs in Frankfurt by default. It can be self-hosted or even air-gapped, and it says your data is never used for training. Its SOC 2 status is unclear: the security page says 'SOC 2 Type 2', but the pricing page and trust centre say the programme is still in progress.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | EU region (no UK) 'Our cloud runs in Frankfurt by default, other regions on request.' Docs: Germany is the supported cloud region. | www.activepieces.com/security |
| DPA and UK GDPR transfer terms | DPA, UK not explicit 'Ask us and we will send ... our DPA and the current sub-processor list.' No public DPA; UK wording unknown. | www.activepieces.com/product/deployment-options |
| SOC 2 | In progress Conflicting claims: the security page shows 'SOC 2 Type 2', but the pricing page says 'Our SOC 2 program is in progress, so we will not claim a certification we do not hold yet' and the trust centre shows 'In progress'. | trust.activepieces.com/ |
| ISO 27001 | Not published No ISO 27001 claim found. | www.activepieces.com/security |
| Self-hostable | Yes Self-hosted on your own infrastructure in any region, including air-gapped deployments. | www.activepieces.com/security |
| Sub-processor list | Public Sub-processors tab in the trust centre. View list | trust.activepieces.com/?tab=subprocessors |
| AI model providers | Not published Security page says the model is 'ours or yours' and inference can point at any OpenAI-compatible endpoint; the default provider is not named. | www.activepieces.com/security |
| Customer data used for training? | No 'Your automations, runs, documents and prompts never train a model, ours or anyone else's.' | www.activepieces.com/security |
Questions UK buyers ask
Is Activepieces UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Activepieces offers EU (but not UK) data residency; its DPA status is "DPA, UK not explicit"; SOC 2: In progress; ISO 27001: Not published. AgentSafe UK readiness score: 57/100 (Mixed).
Does Activepieces store data in the UK?
'Our cloud runs in Frankfurt by default, other regions on request.' Docs: Germany is the supported cloud region.
Does Activepieces use my data to train AI models?
'Your automations, runs, documents and prompts never train a model, ours or anyone else's.'
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.