Skip to content
Menu
EN

Typical forEvery business using cloud and SaaSIT departmentsProcurement and legalSecurity

AI on your data processing agreements. Confidential terms stay in the EU.

Who processes data for you, where, and with which sub-processors? Let the AI read the agreements and find the gaps – GoalCube hides vendor names, contacts and your own system names before the AI sees anything.

Join the waitlistWhat can you use AI for?
  • Processors under controlThe AI finds missing agreements, countries outside the EU and changed sub-processors.
  • AI vendors mappedGoalCube shows which AI services train on data, and where they process it.
  • Confidential system names hiddenInternal system names and vulnerabilities are secret terms.
GoalCube Data VaultFictitious data
Processors 2026 · 3 rows
Show
Your dataStays in the EU with GoalCube
VendorContactUsed forData processed in
Paywise Cloud LtdEmma DohertyPayrollEU
TalkBridge Inc.Daniel BrooksChatbotUSA
Nordic Backup OyMikko SalmelaBackupEU

Note Paywise Cloud Ltd has given notice of a new sub-processor in the Netherlands. Internally, the payroll system is called Kestrel. Objections within 30 days to Emma Doherty.

What the AI seesIn ChatGPT, Claude or Copilot
VendorContactUsed forData processed in
[VIRKSOMHED_1][PERSON_1]PayrollEU
[VIRKSOMHED_2][PERSON_2]ChatbotUSA
[VIRKSOMHED_3][PERSON_3]BackupEU

Note [VIRKSOMHED_1] has given notice of a new sub-processor in the Netherlands. Internally, the payroll system is called [SYSTEM_1]. Objections within 30 days to [PERSON_1].

Task for the AI: Find processors where the agreement is missing or data leaves the EU.
The answer in GoalCubeNames filled back in, only on your side

TalkBridge Inc. sends data to the US with no standard contractual clauses in the agreement; ask for them, or find another option. Paywise Cloud Ltd has added a new sub-processor; check it within 30 days. Nordic Backup Oy is in order.

The AI’s answerPseudonyms only

[VIRKSOMHED_2] sends data to the US with no standard contractual clauses in the agreement; ask for them, or find another option. [VIRKSOMHED_1] has added a new sub-processor; check it within 30 days. [VIRKSOMHED_3] is in order.

7 sensitive values hidden from the AINo real names left the EU

Fictitious data. Point at a name or a pseudonym to see what belongs together.

What can you use AI for?

Choose a task. GoalCube works out the risk under the EU AI Act with fixed rules and tells you what to do.

GoalCube AI MapFictitious data
What will the AI be used for?
Minimal risk

Low risk. Vendor names and internal system names are hidden.

Minimal risk

Low risk. Vulnerabilities and system names are secret terms.

Minimal risk

Low risk. GoalCube's catalogue shows training, EU data residency and the data processing agreement for the major AI services.

The example is simplified. In GoalCube you answer a few questions, and the classification follows fixed rules.

What the law says

A data processing agreement is a must

If a vendor processes personal data for you, you need a written agreement covering specific points.

Article 28(3) GDPR

Sub-processors need your approval

The vendor may only use sub-processors with your prior authorisation.

Article 28(2) and (4) GDPR

Transfers to the US need a basis

For example, the vendor is listed under the EU-US Data Privacy Framework, or standard contractual clauses are in place.

Articles 45 and 46 GDPR

NIS2 and the supply chain

If NIS2 covers you, you also have to manage security at your IT vendors.

Article 21 NIS2 Directive (EU) 2022/2555

Short and simplified. GoalCube helps you follow the rules; it is not legal advice.

Your staff keep working. GoalCube keeps track of the rest.

Low risk is approved automatically under fixed rules. Anything that needs a human lands on This week’s list – typically around 5 minutes a week.

The employee
Your AI

Find the processors where the agreement is missing or data leaves the EU.

All goodLow risk. Approved automatically under your rules.

Two vendors need action: one sends data to the US with no basis in the agreement, and one has a new sub-processor. The names are in GoalCube.

The person in charge
This week’s listFictitious data

4 awaiting a human · approx. 5 minutes

Waiting for you

  • Check new sub-processor at payroll vendorDue in 30 days · needs a human
  • Update AI vendor in the inventoryMap · 2 minutes

Approved automatically

  • Summary of customer enquiriesLow risk · approved automatically on Monday
  • Overview of supplier contractsLow risk · approved automatically on Tuesday

What you need

Start free with the overview. Add protection when you want to use AI on real data.

AI Map

Map

0 € per month

  • AI inventory and AI policy
  • Training with proof
  • Deadlines, templates and report
Recommended for you

Data Vault

Map and protect

from 9 € per month

  • Everything in AI Map
  • AI on your data, data stays in the EU
  • Secret terms and documents

Data Vault + Human Decision

GoalCube for HR

from 15 € per month

  • Everything in Data Vault
  • A person decides on cases about people
  • Passkey, log and timestamps

See all prices All prices are per month and exclude VAT. Pay yearly and get 2 months free. Prices apply from launch, which we expect in November 2026.

Questions and answers

Can the AI read data processing agreements?

Yes, and it's good at finding missing points. Let a lawyer or the person responsible decide what to do.

Are AI services processors?

Yes, when they process personal data for you. That's why you need a data processing agreement (DPA) – free and personal plans usually don't come with one.

What is the EU-US Data Privacy Framework?

An EU decision from 2023 that allows transfers to US companies signed up to it. The EU Court of Justice is dealing with a challenge to it, so many businesses have a plan B.

Read more

Other solutions for suppliers

Ready to use AI on IT vendor data?

We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.