Directory › Workflow automation › Make
Is Make UK GDPR compliant?
In plain English
Make (owned by Celonis) lets you pick an EU data centre when you create an organisation, on any plan including Free. Its DPA applies the UK International Data Transfer Addendum for UK customers, and it holds SOC 2 Type II plus group ISO 27001. Some AI features (including all OpenAI models) still route to the US even on an EU zone.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | EU region (no UK) Choose US or EU when creating an organisation; it cannot be changed later. Make warns some AI features always route to the US and some Claude models are served from a UK region. | help.make.com/organizations |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA DPA section 7.1: the International Data Transfer Addendum attached to the SCCs applies to customers established in the UK. | www.make.com/en/data-processing-agreement.pdf |
| SOC 2 | Yes Has completed SOC 2 Type II and SOC 3 audits. | www.make.com/en/security |
| ISO 27001 | Yes Make says it operates under an ISO 27001-certified information security programme; the terms page links a Celonis SE ISO/IEC 27001:2022 certificate (group-level). | www.make.com/en/terms-and-conditions |
| Self-hostable | Not published No self-hosted edition is documented. | www.make.com/en/security |
| Sub-processor list | Public Sub-processor list linked from the Terms & Conditions page. View list | www.make.com/en/terms-and-conditions |
| AI model providers | OpenAI, Anthropic (Claude), Microsoft Azure AI Make's AI data-zone page lists the provider and processing region for each feature and model. | help.make.com/ai-providers-and-data-zones-in-make |
| Customer data used for training? | No Celonis says it does not and will not permit any third party to use customer data (including prompts and outputs) to train GenAI models without express written consent. | www.celonis.com/legal/trust-center/responsible-ai |
Questions UK buyers ask
Is Make UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Make offers EU (but not UK) data residency; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Yes. AgentSafe UK readiness score: 80/100 (Strong).
Does Make store data in the UK?
Choose US or EU when creating an organisation; it cannot be changed later. Make warns some AI features always route to the US and some Claude models are served from a UK region.
Does Make use my data to train AI models?
Celonis says it does not and will not permit any third party to use customer data (including prompts and outputs) to train GenAI models without express written consent.
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.