AI Chatbot Compliance, Without the Vaporware Badges

Most chatbot vendors bury their DPA behind an enterprise sales call, hide their subprocessor list, and slap a HIPAA logo on the homepage without signing a Business Associate Agreement. That may look reassuring, but it fails the first procurement review at any regulated buyer.

Boei takes the opposite approach: everything on this page is verifiable in one click, our DPA is free on every paid plan, and where we cannot honestly claim a certification (HIPAA is the big one), we say so in plain English.

The rest of this page walks through the five things procurement and privacy teams actually ask about: GDPR, our Data Processing Agreement, subprocessors, EU data residency, and our honest HIPAA stance.

Boei is a GDPR data processor for the personal data your visitors submit through the chatbot widget (name, email, phone, message content). You (the site owner) are the controller. We invest continuously in maintaining GDPR compliance and helping you comply with the framework you owe your users.

What GDPR compliance means at Boei

• Lawful basis: we process Controller Personal Data solely to deliver the Service you subscribed to. No behavioral profiling, no ad targeting, no reselling to data brokers.
• EU/EEA hosting: primary application, database, and backups run on Hetzner Online GmbH in Nuremberg, Germany. Backups live on a separate Hetzner Storage Box in the same region and are retained up to 60 days.
• Data-subject rights: your admin dashboard lets you export a visitor's data (Article 15), erase a conversation on request (Article 17), or bulk-export the whole account. Configurable retention windows keep old chats from lingering.
• Sub-processor governance: every third party that touches personal data is listed publicly on our subprocessors page, with 30-day advance notice on additions.
• International transfers: providers may process outside the EEA for enabled Service functions. Transfers rely on the applicable safeguards in DPA Article 6, including the EU-U.S. Data Privacy Framework for relevant certified US recipients or Standard Contractual Clauses, as applicable.
• Encryption: 256-bit AES TLS in transit; AES full-disk encryption at rest on every server holding user data. Static assets in AWS S3 use server-side encryption and HTTPS-only access.

Full detail is on the Security page.

Boei's Data Processing Agreement is a public, standalone document. You do not need to be on a specific tier, hit a seat threshold, or talk to sales to get one. The DPA is live at /data-processing-agreement/ and by using the Service under a paid subscription you are already covered by it.

If your procurement needs a countersigned copy

• Download the DPA PDF from the DPA page.
• Sign your part.
• Email [email protected] and we send back a countersigned copy, usually within one business day.
• Custom red-line requests are welcome on the Scale plan ($229/mo annual) which includes a custom DPA signed by our legal team as part of the tier.

The DPA references our subprocessors page as Annex 1, so any new subprocessor is automatically covered by the same agreement (with the 30-day advance-notice mechanism preserving your right to object).

The authoritative list lives at /legal/subprocessors/ and is versioned via our legal changelog. Here is a snapshot as of 2026-11-05 grouped by purpose so you can see the scope at a glance:

Core infrastructure (EU/EEA)

• Hetzner Online GmbH (Nuremberg, Germany) - primary servers, database, backups.
• Weaviate B.V. (registered in Amsterdam, processing in Frankfurt) - vector database for chatbot knowledge base.
• Amazon Web Services EMEA SARL (EU-West, Ireland) - static asset storage (S3).
• Plausible Insights OU (Tallinn, Estonia; processed in Germany) - cookie-less analytics for boei.help only, not Controller data.

AI providers

• Mistral AI, SAS (Paris, France) - EU-hosted LLM option.
• OpenAI Ireland Ltd. (Ireland) - enabled chatbot and knowledge-base functions; processing may take place in the USA and other locations under the provider terms.
• Anthropic Ireland, Limited (Ireland; processing may take place in the USA and other locations) - opt-in, requires customer configuration.
• Google Cloud EMEA Limited (Gemini Developer API Paid Services) (Ireland; processing may take place in the USA and other locations) - opt-in, requires customer configuration.

The response-model choice is configurable. Configured Mistral response processing takes place within the EEA. Providers may also support other enabled Service functions; the authoritative supplier list describes their scope.

Other service providers

• Cloudflare, Inc. - DNS and network-edge services on boei.help and cdn.boei.help where enabled, including static widget resources. DDoS and WAF services apply only on hosts where enabled.
• Mailgun Technologies - email delivery through the EU endpoint, including account notifications, enabled customer replies, transcripts and lead notifications.
• SideGuide Technologies, Inc. d/b/a Firecrawl - website crawling for knowledge-base ingestion in the USA; public page content may contain personal data.
• Stripe, Inc. - payment processing and subscription billing.

If a subprocessor changes we post it to /legal/subprocessors/ at least 30 days in advance and notify DPA-holding customers per the agreement.

Boei production services run on Hetzner Online GmbH infrastructure in Nuremberg, Germany. All Controller personal data processed by the Service is stored inside the EU/EEA. Backups sit on a separate Hetzner Storage Box, also in Nuremberg, and are retained up to 60 days.

Hetzner's data centers are ISO/IEC 27001 certified and operate with 24/7 on-site staff, video surveillance, biometric and multi-factor access control, redundant power and cooling, and fire suppression.

Static assets served alongside the widget (images uploaded through the admin) sit in the EU-West (Ireland) region of AWS S3 via Amazon Web Services EMEA SARL, with server-side encryption enabled.

Cloudflare provides DNS and network-edge services for boei.help and cdn.boei.help where enabled. These hosts may serve static resources used by widgets and receive request metadata such as visitor IP addresses. DDoS and WAF services apply only on hosts where enabled. This does not describe app.boei.help or the chatbot API as Cloudflare-proxied.

For teams that need to point to a specific procurement checklist item: this configuration satisfies the standard EU/EEA data-residency requirement most European public-sector and healthcare procurement bodies apply.

Boei is not currently HIPAA-certified and does not sign Business Associate Agreements at standard tiers. Some competitor sites display a HIPAA badge without ever signing a BAA, which is misleading. We prefer to be direct.

What this means in practice

• Non-PHI use cases work fine: appointment booking, hours, cost, prep instructions, insurance FAQ, general triage FAQ. None of these require the chatbot to touch protected health information.
• Symptom triage flows always include a non-medical-advice disclaimer so visitors are not misled into treating the chatbot output as clinical guidance.
• PHI-touching workflows: if your chatbot needs to intake symptoms tied to identifiable patients or coordinate care, and you need a signed BAA, contact us before onboarding to discuss the Scale plan and our current compliance roadmap.

See /for/healthcare/ for the vertical write-up aimed at clinics evaluating Boei.