DeepL

Data-handling profile

Trains on input

Yes, on the consumer tier (enterprise tier excluded)

Retention

Consumer/Free tier: Texts and translations are stored for an undisclosed period to train and improve translation models. Enterprise/Pro tier: Texts are processed in RAM and deleted immediately after the translation is completed; no text is permanently stored.

Data region

European Union (primarily Germany and Finland)

Certifications

ISO 27001SOC 2 Type II

DPA available

Yes

Breach history

No known publicly disclosed data breaches of customer translation data have occurred.

EU AI Act

DeepL's AI translation tools are categorized as general-purpose AI (GPAI) but do not present systemic risks. As a German-headquartered company (DeepL SE), DeepL is subject to EU jurisdiction and maintains high compliance with European standards, aligning well with the EU AI Act's transparency and copyright compliance provisions.

By plan and surface

Vendor-level answers are often wrong for a specific tier. These are the precise claims, each with the verbatim sentence we relied on.

• pro/web: “When using our services DeepL Translator Pro, DeepL API Pro and DeepL Write Pro to translate or improve texts, the texts or documents you submit will not be permanently stored and will only be kept temporarily to the extent necessary for the production and transmission of the translation or improvement.”
• pro/api: “When using our services DeepL Translator Pro, DeepL API Pro and DeepL Write Pro to translate or improve texts, the texts or documents you submit will not be permanently stored and will only be kept temporarily to the extent necessary for the production and transmission of the translation or improvement.”

Sources

• https://www.deepl.com/en/privacy
• https://www.deepl.com/en/pro-data-security
• https://www.deepl.com/en/pro-license
• https://www.deepl.com/en/trust-centerlink no longer resolves

Every fact above is drawn from the vendor's public documentation, reviewed by a human, and version-stamped. Monitored daily for changes. 1 of these 4 links no longer resolve. We record what we relied on rather than deleting it, so the trail stays auditable — but a struck-through source cannot be re-checked today.

Control mapping

Obligations this vendor triggers, each attributable to the fact it rests on — for your supplier register, not a compliance determination.

• EU AI Act Art. 50 — Transparency obligations for AI systemsattention

  trains_on_input = consumer_tier. Inputs may be reused for model training — users interacting with this system need to be informed accordingly.

• EU AI Act Art. 26 — Obligations of deployers of high-risk AI systemsapplies

  Applies to your organisation as deployer, independent of vendor. Assign human oversight, keep logs, and monitor operation where this tool is used in a high-risk context (Annex III duties apply from 2 Dec 2027).

• ISO/IEC 27001 A.5.19 — Information security in supplier relationshipsapplies

  DeepL processes organisational data as a supplier. Include this vendor in the supplier register and risk assessment.

• ISO/IEC 27001 A.5.20 — Addressing information security within supplier agreementsok

  dpa_available = true. A data processing agreement is available and should be executed.

• ISO/IEC 27001 A.5.23 — Information security for use of cloud servicesattention

  Cloud AI service; trains_on_input = consumer_tier. Data submitted to this cloud service may be retained or reused — define acceptable-use rules for it.

• ISO/IEC 42001 A.10.3 — Suppliers of AI systems and servicesapplies

  certifications: ISO 27001, SOC 2 Type II No AI-management certification identified; assurance must come from your own supplier assessment.

• GDPR Art. 44–49 — International transfers of personal dataok

  data_region = European Union (primarily Germany and Finland). Processing region is within the EU/EEA.

• NIS2 Art. 21(2)(d) — Supply chain securityapplies

  AI vendor forms part of your ICT supply chain. In scope for entities covered by NIS2; include in supply-chain risk measures.

• DORA Art. 28 — General principles for ICT third-party riskapplies

  AI vendor is an ICT third-party service provider. For financial entities: register of information and contractual requirements apply.

Change history

No material changes recorded since monitoring began.