Directory › Workflow automation › Tray.ai
Is Tray.ai UK GDPR compliant?
In plain English
Tray.ai offers an EU region on AWS Ireland, with UK-based support staff through its UK subsidiary. Its DPA covers the UK Addendum, it has SOC 1 and SOC 2 Type 2 (Schellman), and it says it never trains on your data. We found no ISO 27001 certificate.
The facts, with sources
| Field | What the vendor publishes | Source |
|---|---|---|
| UK/EU data residency | EU region (no UK) Where the EU region is selected, the core sub-processors are AWS (Ireland), Datadog (Germany) and Tray's UK subsidiary for support. | tray.ai/legal/sub-processors/ |
| DPA and UK GDPR transfer terms | Yes, UK Addendum/IDTA UK transfers are made under the EU SCCs with the ICO's UK Addendum deemed executed. | tray.ai/legal/dpa/ |
| SOC 2 | Yes SOC 2 Type 2 (Schellman); period 1 Aug 2024 to 31 Jul 2025; 2025–26 exam underway. | tray.ai/trust/ |
| ISO 27001 | Not published No Tray ISO 27001 certificate found. | tray.ai/trust/ |
| Self-hostable | Not published No self-hosted edition documented. | tray.ai/trust/ |
| Sub-processor list | Public Public list split by region. View list | tray.ai/legal/sub-processors/ |
| AI model providers | OpenAI, Anthropic (Claude) and customer-chosen models Tray says customers decide where prompts and models are used. | tray.ai/trust/ |
| Customer data used for training? | No 'Tray never trains on your data, and AI providers do not retain prompts or responses after processing.' | tray.ai/trust/ |
Questions UK buyers ask
Is Tray.ai UK GDPR compliant?
No tool is UK GDPR compliant on its own. It depends on how you use it. On the vendor's side, Tray.ai offers EU (but not UK) data residency; its DPA status is "Yes, UK Addendum/IDTA"; SOC 2: Yes; ISO 27001: Not published. AgentSafe UK readiness score: 70/100 (Good).
Does Tray.ai store data in the UK?
Where the EU region is selected, the core sub-processors are AWS (Ireland), Datadog (Germany) and Tray's UK subsidiary for support.
Does Tray.ai use my data to train AI models?
'Tray never trains on your data, and AI providers do not retain prompts or responses after processing.'
Not legal advice. AgentSafe UK summarises what vendors publish about themselves. It is not legal advice and is not a statement that any tool is "compliant": UK GDPR compliance depends on how you use a tool. Always check the linked sources and take professional advice for your situation.