For the EU & UK
Updated July 2026
In the EU or UK? Here is the whole posture, including what we do not claim.
Plenty of tools in this category will not serve you at all. Goodword's own FAQ says it is 'currently available in the US.' (checked July 2026). The ones that will take your money often go quiet about where your data ends up. If you are in the EU, the EEA, the UK, or Switzerland, the questions that decide whether you can use a relationship tool are narrow and boring: where is it stored, what legal basis covers moving it, who can read it, how do you get it back, and how do you make it go away. Our answers are below, including the parts that are still in progress.
How Wend helps people in the EU and UK
One region, one jurisdiction, one transfer basis
All Wend data lives in a single US region. For users in the EU, EEA, UK, or Switzerland, transfers run on the European Commission's Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914, together with supplementary technical measures. GDPR does not require your data to stay in the EU; it requires a valid safeguard for moving it, and that is the safeguard we rely on. Ask for a copy of the clauses at [email protected] and you get one.
Accuracy becomes a link instead of a promise
Article 5(1)(d) asks for personal data to be accurate and kept up to date. In Wend every fact links to the email, page, note, or recording it came from, nothing is stored until a person confirms it, and two sources that disagree are shown side by side rather than silently overwritten. Every AI inference is recorded, and the log is part of your export.
The exits work, and they are not a paid feature
Full export on every plan including Free, gated by two-factor auth: JSON for the graph plus your original files. Self-serve deletion hard-purges your data from the database and object storage inside 7 days. If you are not a user but appear in someone's graph, the erasure form at /privacy/rtbf is open to you and we confirm action within 30 days.
With Wend, you can
- Open the exact email a fact came from when someone asks how you know it
- Take everything with you as JSON plus your original files, on any plan including Free
- Delete the account yourself and have it purged inside 7 days
- Ask to be removed if you appear in a user's graph and are not a user yourself
The posture, item by item
- Storage
- A single US region, Northern Virginia. One region, one jurisdiction, no surprise replication.
- Transfer basis
- Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914, plus supplementary technical measures. A copy of the clauses we use is available on request.
- Encryption in transit
- TLS on every hop, from your browser to the database to every provider we call.
- Encryption at rest
- Database and file storage are encrypted at the disk layer. Our infrastructure providers hold SOC 2 Type 2 and ISO 27001 for the layers they run; those are their certifications, and we attribute them rather than borrowing them.
- OAuth tokens
- The Google tokens that let Wend read your mail and calendar get a second layer: AES-256-GCM applied in the application before the token reaches the database, with the key held outside the database entirely.
- Isolation
- Row-level security filters every read and write against the signed-in account, and no AI output for one user can draw on another user's graph.
- Training
- No model provider in our stack is permitted to train on your content, and we do not work with vendors who train on customer data. The commitment is published in our privacy policy.
- Selling
- Never. No advertisers, no data brokers, no licensed insights.
- Provenance
- Every stored fact links to its source, and you can open that source from the fact.
- Audit log
- Every AI inference that touches your data is recorded, and the full log is included in your export.
- Your rights
- Access, rectification, erasure, and portability apply in full. Hosting location does not reduce them, and your right to complain to your supervisory authority is unaffected.
- Export and deletion
- Both gated by two-factor auth, because they are the operations that move or destroy the whole graph.
- Non-users
- Erasure requests from people who appear in a user's graph go through /privacy/rtbf, and we confirm action within 30 days.
- Subprocessors
- Published at /legal/subprocessors, with what each one processes.
- Independent assessment
- An independent security assessment of our restricted Gmail scope, CASA Tier 2 as part of Google's production verification, is in progress. Not finished.
What we do not claim
- No EU data residency. We consolidated to one US region deliberately, and we cover transfers with Standard Contractual Clauses. If your requirement is that the bytes never leave the EU, we are not your tool today.
- No SOC 2 and no ISO 27001 for Wend itself. Those belong to the infrastructure providers underneath us, for the layers they run.
- CASA Tier 2 and Google production verification are in progress, not complete. That is the actual reason signup is waitlist-gated instead of open.
- Your content is encrypted at rest but not end to end. The assistant has to read what you save in order to be useful, and our Terms say so instead of burying it.
- No binding corporate rules and no Article 42 certification. The Standard Contractual Clauses are the mechanism, and they are the only one we rely on.
- We will not guess what your procurement or DPO review needs. Email [email protected] and we will tell you plainly what we can and cannot sign today.
A relationship brain built for people in the EU and UK.
We’re onboarding in small batches. Drop your email and we’ll save you a place in line.
FAQ
Is Wend GDPR compliant?
Compliance depends partly on how you use a tool, so here is the checkable part on our side. We name a lawful transfer mechanism (Standard Contractual Clauses, Decision (EU) 2021/914) and will send you the clauses. We publish our subprocessors. Access, rectification, erasure, and portability are supported and never charged for. Every AI inference is logged. Nobody in our stack trains on your content. What we do not do is claim a certification, because we do not hold one for Wend itself.
Do you store data in the EU?
No. One US region, on purpose: a single well-secured jurisdiction is easier to reason about than two half-maintained ones, and GDPR asks for a valid transfer safeguard rather than EU residency. If residency is a hard requirement for you, we are not the right tool today, and we would rather say that than imply otherwise.
What is the legal basis for sending my data to the US?
The European Commission's Standard Contractual Clauses, Commission Implementing Decision (EU) 2021/914, together with supplementary technical measures: encryption at rest, application-level encryption of stored OAuth tokens, strict access controls, and an audit log. You can request a copy of the clauses we use at [email protected].
Can I use Wend from the UK?
Yes. Our privacy policy covers the EU, EEA, UK, and Switzerland under the same Standard Contractual Clauses framework, and your UK GDPR rights are unaffected. If your review specifically needs the UK addendum or an international data transfer agreement on paper, ask us before you sign up rather than after, and you will get a straight answer about what exists today.
Are you SOC 2 or ISO 27001 certified?
Not for Wend itself, and we will not imply it. Our infrastructure providers hold SOC 2 Type 2 and ISO 27001 for the layers they run, which is a real part of the posture but is their certification. The independent assessment we are going through, CASA Tier 2 for the restricted Gmail scope, is in progress and not complete.
What about tools that are US-only?
Some of them cannot serve you at all: Goodword's FAQ says 'Goodword is currently available in the US.' (checked July 2026). Wend serves the EU, EEA, UK, and Switzerland, waitlist included. Our head-to-head with them, concessions and all, is at /vs/wend-vs-goodword.
Can I check any of this rather than trusting the page?
Some of it, yes. The engine that stores and governs your graph, including the schema, the propose-and-confirm write path, provenance, and recall, is open source under AGPLv3 as wend-core, so the write path is readable rather than asserted. The subprocessor list and the privacy policy are published. The certifications we do not have are named above.