Compliance
ONYRI and the GDPR
ONYRI is a data-minimization tool: it strongly reduces the exposure of your personal data before you send it to an AI. It doesn't replace your GDPR obligations — it serves them. Here's exactly what it does, and what it doesn't.
What ONYRI does
- Detects and replaces your sensitive data with reversible tokens 100% in your browser: it never leaves your machine (verifiable in the Network tab).
- Serves the minimization required by the GDPR (article 5.1.c): the AI only ever receives neutralized text.
- Hosts its backend in the European Union (Amsterdam). Only account metadata is stored there — never your content.
- Uses a European AI model by default (Mistral, France). Non-EU models (OpenAI, Anthropic) also only ever receive anonymized text.
- Logs no content from your messages (Chat proxy).
What ONYRI does not do (and doesn't claim to)
- It doesn't guarantee your GDPR compliance: responsibility for the processing remains yours (legal basis, informing individuals, records…).
- Reversible anonymization is pseudonymization: the text remains personal data under the GDPR as long as the mapping exists. ONYRI reduces exposure, it doesn't remove it.
- It's not a substitute for legal advice or a Data Protection Officer (DPO).
Subprocessors
The providers that process data on ONYRI's behalf. The sensitive data in your texts is never sent to them — it stays in your browser.
| Subprocessor | Role | Region |
|---|---|---|
| Railway | Hosting + database | European Union (Amsterdam) |
| Mistral AI | AI model (default) | European Union (France) |
| Stripe | Payments | United States |
| Resend | Transactional emails | United States |
| OpenAI | AI model (optional) | United States |
| Anthropic | AI model (optional) | United States |
Transfers to non-EU subprocessors are covered by appropriate safeguards (standard contractual clauses). Details are in the DPA.
DPA (data processing agreement)
A signable data processing agreement (DPA) is available for Team and Enterprise plans. It formalizes the split of responsibilities and subprocessor safeguards.
Minimize your data before AI
Anonymize my promptThis page is informational and does not constitute legal advice.