No training is not the same as data residency, and data residency is not the same as processing residency
For confidential bank statements, asking whether a model trains on the data is only one part of the assessment. Firms also need to understand the contract, processor terms, storage location, processing location, retention, subprocessors and access controls.
Transfers outside the EU are not automatically unlawful under GDPR, but they require the appropriate legal framework. Professional confidentiality duties can add another layer for accountants and advisers.
This guide provides general information and is not legal advice. The actual contract, plan and use case determine the assessment.
Three questions that should always be separated
1. Is the data used for training?
This concerns later model improvement. A business plan or opt-out may reduce this risk but says nothing by itself about where data is stored.
2. Where is the data stored?
Data residency usually controls customer content at rest. Logs, security copies and metadata may follow different rules.
3. Where is the data processed?
Inference and processing residency concern execution. PDF extraction, routing, security operations and integrations can still take place elsewhere.
Current data-location comparison
This reflects official provider information as of October 2026. The exact subscription and workspace configuration always matter.
| Service | Training | Storage | Processing | Practical view |
|---|---|---|---|---|
| ChatGPT Business | Business data is not used for model training by default. | Regional storage is rolling out. If a non-US region is selected, abuse-monitoring data remains in the US and OpenAI says a time-limited copy of every prompt and response is stored in the US. | The Business storage region does not provide inference residency or determine where responses are processed. | Business should not be read as an EU-only storage and processing guarantee. |
| ChatGPT Enterprise / Edu | Business data is not used for training by default. | Eligible workspaces can select Europe for at-rest customer content. | Eligible workspaces can use European GPU inference, while CPU processing such as PDF text extraction, routing and orchestration may still occur globally. | Stronger regional controls, but not every service step is guaranteed to stay in-region. |
| Claude for Work / Enterprise | Commercial chats and API data are not used for training by default. | Anthropic explicitly states that commercial product data is stored in the US. | Traffic may route by default through the US, Europe, Asia and Australia unless otherwise agreed or configured. | No-training terms do not provide EU data residency. |
| Gemini / Google Workspace | Qualifying Workspace plans provide enterprise protections and do not use Workspace content for external model training without permission. | Business Standard and Business Plus support a data-at-rest region. Gemini App and Workspace with Gemini prompts and responses are covered data types. | Processing-region controls depend on edition, with Enterprise Plus and certain other editions offering stronger regional processing controls. | Check the actual Workspace edition because storage and processing controls are separate. |
| Langdock | Langdock states customer data is never used for model training. | Langdock states customer data is generally stored in the EU and references Frankfurt and the Azure EU Data Boundary. | Most configurable models can run in the EU. Explicitly selected global models may perform inference outside the EU. | Strong EU-oriented enterprise positioning, but model selection still matters. |
| KontoCSV | KontoCSV is a purpose-limited converter rather than a general chat workspace. | KontoCSV uses European infrastructure with servers in Frankfurt. Files and visible history are automatically deleted after seven days. | Processing is limited to the conversion workflow and includes bank-specific validation and export logic. | The design minimises purpose breadth and retention while producing accounting-ready outputs. |
Professional confidentiality still matters
Accountants should treat unpublished client financial information as confidential and apply controls throughout collection, use, transfer, storage, retention and destruction.
ICAEW Code of Ethics 2026
The confidentiality principle requires professional accountants to protect confidential information through its full lifecycle, including transfer and storage.
GDPR / UK data protection
Where applicable, firms should separately assess controller and processor terms, security measures, retention and international transfers.
Technology due diligence
A model's quality does not replace supplier due diligence, contractual safeguards, internal approval and access control.
Client files are not test data
A production bank statement can reveal highly sensitive financial relationships and should not be treated like an ordinary prompt.
Checklist before uploading a client bank statement
- Is this an approved business workspace rather than a personal consumer account?
- Are processor terms, DPA and subprocessors understood?
- Is model training excluded or controlled for this workspace?
- Where are files, prompts and responses stored?
- Where do inference, PDF extraction, routing and safety processing occur?
- Are international transfers covered by an appropriate legal mechanism?
- What are the retention rules for content, logs and backups?
- Is the disclosure necessary for the task and permitted by firm policy?
- Will the extracted accounting data be independently reconciled before posting?
Why bank statements are a high-sensitivity AI use case
A bank statement can expose salaries, health-related payments, donations, rent, suppliers, customers and detailed economic relationships. It is a dense source of personal and commercial information.
Accounting also adds an integrity requirement. A generated CSV can look convincing while still missing a transaction, changing a sign or misclassifying a balance carry-forward.
What EU data residency really means
EU hosting can refer to different controls. Storage, inference and other processing should be checked separately.
ChatGPT Business: regional storage is not inference residency, and OpenAI describes US abuse-monitoring data plus a temporary US copy of prompts and responses for non-US regions.
ChatGPT Enterprise/Edu: eligible workspaces can use European storage and GPU inference, while some CPU processing can remain global.
Claude commercial: Anthropic states commercial data is stored in the US and traffic may be routed across multiple regions.
Google Workspace: Gemini prompts and responses can be covered by data regions, while processing-region controls depend on edition.
Langdock: the application and most configurable models can run in the EU, while explicitly selected global models can infer outside the EU.
How KontoCSV narrows the purpose
KontoCSV is a purpose-built bank and payment document converter, not a general AI workspace. Files are automatically deleted after seven days.
The pipeline adds bank-specific controls such as balance reconciliation, signed transaction sums, page and statement scope, multi-account assignment and guards for MT940 and CAMT.053.
This does not replace a firm's legal assessment, but it separates the bank-data task from a persistent general-purpose chat environment.
Official sources
Provider terms change. Check the current plan, contract and technical configuration before production use.
Frequently asked questions
Does Claude for Work store data in Europe?
Anthropic currently states that commercial product data is stored in the US.
Does ChatGPT Business keep all content in Europe?
Not solely by selecting a European storage region. OpenAI describes US safety data, a temporary US copy of prompts and responses, and no Business inference-residency guarantee.
Can Gemini Workspace use European data regions?
Yes. Gemini prompts and responses are covered data types, but processing-region controls depend on the Workspace edition.
Does Langdock keep everything in the EU?
Langdock states the application and most configurable models can run in the EU. Explicitly selected global model deployments can process inference outside the EU.
Use a purpose-built bank-data workflow instead of a general chat
KontoCSV focuses on bank and payment documents, automatically deletes files after seven days and adds balance and accounting-integrity checks to extraction.