Directory › Agent framework and platform › Composio
Is Composio UK GDPR compliant?
In plain English
Composio is a tool and integration layer that lets AI agents use apps such as Gmail, Slack and Salesforce. It holds SOC 2 Type II and ISO 27001:2022, and its DPA covers UK transfers using the ICO addendum. Cloud hosting location isn't published, so UK or EU residency means a private VPC or a self-hosted Enterprise deployment.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | Not published Cloud hosting region not published. For residency, Composio points to a private VPC or self-hosted Enterprise deployment. | composio.dev/enterprise |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA 'Transfers from the United Kingdom': the template addendum issued by the Information Commissioner applies. | composio.dev/legal/dpa |
| SOC 2 | Yes SOC 2 Type II attested. | composio.dev/enterprise |
| ISO 27001 | Yes ISO 27001:2022 certified. | composio.dev/enterprise |
| Self-hostable | Yes Self-host at the Enterprise tier, or a private VPC. | composio.dev/enterprise |
| Sub-processor list | Public Referenced in the DPA at trust.composio.dev/subprocessors. View list | composio.dev/legal/dpa |
| AI model providers | Customer's choice (works with OpenAI, Anthropic, Google, xAI, Meta, Mistral and others) Composio provides tools to the agent; you pick the model. | composio.dev/enterprise |
| Customer data used for training? | Partly / conditional DPA 2.8: Composio will not use Payload Data or Personal Data to train AI, but may use de-identified data to train machine-learning models. | composio.dev/legal/dpa |
Questions UK buyers ask
Is Composio UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Composio does not publish a UK or EU hosting region; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Yes. AgentSafe UK readiness score: 67/100 (Good).
Does Composio store data in the UK?
Cloud hosting region not published. For residency, Composio points to a private VPC or self-hosted Enterprise deployment.
Does Composio use my data to train AI models?
DPA 2.8: Composio will not use Payload Data or Personal Data to train AI, but may use de-identified data to train machine-learning models.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.