Directory › AI agent builder › Dify
Is Dify UK GDPR compliant?
In plain English
Dify is an open-source platform for building LLM apps and agents. Its cloud service processes data mainly in the United States, but it can be self-hosted, including in your own VPC or air-gapped, which makes UK or EU residency possible. It holds SOC 2 Type II and ISO 27001:2022, and its EU and UK DPA includes the UK Addendum.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | No UK/EU region DPA: 'Company's primary processing operations take place in the United States.' Residency is achievable only by self-hosting. | dify.ai/assets/legal/data-protection-agreement.pdf |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA 'EU and UK Data Processing Addendum'; 'UK SCCs' are defined as the EU SCCs as amended by the UK Addendum. | dify.ai/assets/legal/data-protection-agreement.pdf |
| SOC 2 | Yes Completed SOC 2 Type II for the second year running. | dify.ai/blog/dify-achieves-soc-2-iso-27001-gdpr-compliance-f… |
| ISO 27001 | Yes ISO 27001:2022 audit completed. | dify.ai/blog/dify-achieves-soc-2-iso-27001-gdpr-compliance-f… |
| Self-hostable | Yes Deploy inside your own VPC, on-prem or air-gapped (Helm chart for Kubernetes). | dify.ai/dify-enterprise |
| Sub-processor list | Public List of Authorised Sub-Processors at Exhibit E of the DPA. View list | dify.ai/assets/legal/data-protection-agreement.pdf |
| AI model providers | Customer's choice (bring your own model provider) Privacy policy: AI data is sent to the provider you choose, and training depends on your agreement with that provider. | dify.ai/privacy |
| Customer data used for training? | No 'We do not train AI models ourselves, and we will not use your AI interaction data for model training.' | dify.ai/privacy |
Questions UK buyers ask
Is Dify UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Dify does not offer UK or EU data residency on its hosted service; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Yes. AgentSafe UK readiness score: 75/100 (Good).
Does Dify store data in the UK?
DPA: 'Company's primary processing operations take place in the United States.' Residency is achievable only by self-hosting.
Does Dify use my data to train AI models?
'We do not train AI models ourselves, and we will not use your AI interaction data for model training.'
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.