Skip to content
All work

// Case study · Governance tooling · DACH

Popular AI tools: What about data protection?

An interactive comparison of 38 AI tool tiers, their contractual terms and the conditions for using personal data, confidential data or professional secrets in DACH.

Author & builder

Cover image for Popular AI tools: What about data protection?

The question

In AI governance work, I keep coming back to a practical question: can we use a particular tool with this data in Germany, Austria or Switzerland?

The answer depends on the product tier, the data processing agreement and whether the tool accesses the web. Finding those conditions means comparing terms, agreements and training policies spread across providers’ documentation. I wanted a reference that made the conditions easier to examine.

What I built

Open the interactive reference →

The reference compares free and paid consumer, business and API tiers from OpenAI, Microsoft, Anthropic, Google, xAI, Mistral, Perplexity, GitHub, Aleph Alpha and DeepL. It assesses their contractual terms for use in Germany and Austria under the GDPR, and in Switzerland under the revised FADP.

Each tier is assessed against six questions: personal data, confidential data, professional secrets, use of inputs for model training, general company use and eligibility for add-ins that use your own API key.

Selecting a data category ranks and color-codes the tiers. Each assessment opens into an explanation of the applicable agreement, any reservations, the effect of web access and links to the governing documents. Those sources matter when someone needs to challenge a conclusion or check a condition for their own use.

Filters, pinned comparisons and the open explanation are stored in the URL. A view such as Anthropic’s business tiers for professional secrets can be shared directly with a colleague.

Keeping the conditions visible

The difficult part was distinguishing between meeting a requirement, being workable with additional measures and being contractually permitted but still carrying reservations. A simple yes or no would hide conditions that affect the decision. Add-ins that use a team’s own API key are included because they come up frequently when people compare consumer and business terms.

I maintain the reference on this site, with the reasoning and sources available alongside each assessment.