AUREA
Home · Blog · GDPR
GDPR · 16 June 2026 · 7 min read

Private AI versus ChatGPT: where your data actually is.

Short answer: when you use ChatGPT or another public AI with your company's documents, that data travels to third-party servers, usually in the United States, and you need international transfer agreements to comply with GDPR. With a private AI installed on your server, the data never leaves your company and the processing agreement you already have with your clients remains valid.

The trouble with public AI

The worry many managers have is a reasonable one: uploading finances, contracts or client records to a public AI means sending them outside the company. For a Spanish small business that means reviewing international data transfers, contractual clauses, and what the provider does with whatever you send.

What a private AI is

A dedicated server — in your own office — with a graphics card capable of running language models locally, using tools like Ollama. It reads and processes invoices, PDFs and contracts at full speed, and not one byte goes to OpenAI or any third party.

16 GB of VRAM The graphics card in the AI servers we install: enough to handle a small business's document volumes with models running entirely on premises.

The comparison, in cold blood

Public AI (ChatGPT and similar)Private AI (on your server)
Where the data is processedThe provider's servers, usually in the USIn your office
GDPRRequires international transfer agreementsYour existing processing agreement still stands
CostMonthly fee per user or per useInvestment in your own hardware, no per-seat fees
ControlThe provider'sComplete: the system is yours

Who it makes sense for

Any small business handling sensitive client paperwork: accountancy firms, law practices, logistics, wholesalers with supplier data. The private AI page explains what the installation covers, and the free audit assesses whether your document volume justifies it.

Quick questions

Yes, done properly. With a private AI running on your own server, the data never leaves your infrastructure, so the standard processing agreement you already have with your clients remains fully valid.

For business tasks — reading, classifying, extracting data and answering questions about your own paperwork — open models running locally perform excellently. This is not about writing poetry: it is about processing your documents without them leaving the building.

Free, and no strings attached

Want these numbers for your own business?

The free 30-minute audit puts your specific case on the table.