Security, data residency and GDPR
Choose EU or US storage. Learn how SquadBear protects people data, including optional Cloudflare AI summaries and connected assistant access.
EU or US
You pick the data region when you register. It stays with the workspace.
Isolated workspaces
Every query is scoped to your organisation. Another customer cannot land in yours.
Export and erasure
Anyone can download their own copy. Admins can erase an offboarded person, with a receipt.
Clear AI boundaries
Optional summaries use Cloudflare Workers AI. Your connected assistant receives only authorized tool results.
EU or US data residency
At sign-up you choose where the workspace lives: the European Union or the United States. That choice is written into the workspace and cannot be toggled later. Moving would be an export and a new workspace, not a setting. Workspaces created before the US region existed stay in the EU.
Each region is its own database and file store, not a column on a shared pile. Uploaded documents and export files are stored under Cloudflare's R2 jurisdiction for that region (a platform guarantee). The workspace database is placed in the same region.
Storage is regional. Processing is not: a click may be handled at the nearest Cloudflare location, and background jobs may run globally. Those jobs carry identifiers, not copies of leave reasons or files.
You can see the region later at Workspace settings → Workspace → General.
Tenant isolation
SquadBear is multi-tenant: many companies on one product. Isolation is not a hope in the application layer. The signed-in workspace supplies the tenant id on every query. A tenant id taken from the URL, the body or a query string is a bug, and we treat it as one. The database itself refuses a child row that points at a parent in another workspace.
Managers still only see the people their role allows. That is a second clamp on top of tenancy, not a substitute for it.
GDPR tools that actually run
Your organisation is the controller of employee data. SquadBear is the processor. People exercise most rights through their employer; we give the employer the buttons.
- Export. Preferences → Your data, or an admin from the person's profile. One JSON file, built in the background.
- Erasure. Admin-only, and only for someone already offboarded. Identity is cleared; the leave ledger and audit trail stay as compliance evidence under a placeholder name.
- Special-category leave. Channel digests and default calendar titles are names and dates. Never the type of leave. Sick notes stay on the request.
- Anonymous health checks. Closing an anonymous run drops the link between a person and their answers.
- Performance reviews. No SquadBear model reads them. Peer answers reach a connected assistant as Peer 1, Peer 2, with no name. Upward feedback is stored without an author, and only when at least three people answered. Review settings, "Delete reviews after", runs from 12 to 120 months (24 by default) after the round closes. The same nightly job deletes feedback after it was sent and goals after they were closed.
How to run export and erasure: Data protection in the docs. The legal text: Privacy Policy.
When AI processes people data
Routine leave balances, coverage checks, timesheets and numeric team-health trends use the product's rules and calculations. If an authorized user requests a health-check summary or retrospective assistance, SquadBear sends selected comment or card text and limited context, such as dimension scores, to Cloudflare Workers AI for a summary, suggestions or similarity checks. We remove author labels from these requests, but free text can still contain identifying details. The model's output is a suggestion for a person to review. Performance reviews, goals and anytime feedback are not part of that request. SquadBear does not send them to Workers AI.
You may separately connect Claude, ChatGPT or another assistant over MCP. SquadBear applies the connecting person's permissions and approved OAuth scopes to each tool call. The data returned by a tool may then be processed by your assistant provider under your agreement with that provider. See the Privacy Policy for details.
What we do not do
- We do not copy your entire people directory to a model for routine HR calculations.
- We do not sell data or run ad-tech in the app.
- We do not guess a Slack or Discord identity from email.
- We do not put another workspace's rows on your screen.
EU AI Act
SquadBear does not recognise emotions, use biometrics, screen candidates, or rank or score employees. Leave, time and attendance numbers come from rules, and a person approves sensitive changes an assistant prepares over MCP. Our reading of where that leaves SquadBear under the AI Act, written so your counsel can check it: SquadBear and the EU AI Act.
Subprocessors
Cloudflare always hosts the app. The others process data only when the feature in the second column is on. The live list for the deployment is /api/subprocessors, and we give 30 days' notice of a change under the Data Processing Agreement.
| Subprocessor | When | Purpose and data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Always | Hosting, database, file storage, transactional email, optional AI summaries (Workers AI) | Your data region (EU or US) for storage; Cloudflare's network for processing |
| Stripe, Inc. | Paid plan | Subscription billing: billing contact name and email, workspace id | United States |
| Google LLC | Google sign-in, shared calendar or Workspace out-of-office | Authentication and calendar sync | United States |
| Microsoft Corporation | Microsoft sign-in | Authentication: account email | United States |
| Functional Software, Inc. (Sentry) | Error reporting enabled | Browser error reports with workspace id and role; no name, email or user id | European Union (Frankfurt) |
Transfers outside the European Economic Area rely on an adequacy decision or the Standard Contractual Clauses in each provider's data processing agreement. Integrations you connect yourself, such as Slack, Discord, Jira, GitHub or your AI assistant, receive data on your instruction under your own agreement with them.
Data Processing Agreement
The Data Processing Agreement covers GDPR Article 28: your instructions, confidentiality, security measures, subprocessors, breach notice, deletion and audits. It is part of the Terms and applies when you create a workspace.
Who operates SquadBear
Digital Cloud Piotr Giedziun, ul. Belwederczyków 4/6 lok. 6, 51-688 Wrocław, Poland. Security questions: privacy@squadbear.com. Full provider details are in the Impressum.
Frequently asked questions
Can I choose EU or US?
Yes, on the first step of registration. The data region is stored with the workspace and cannot be switched later. Existing workspaces stay in the EU.
Is SquadBear GDPR-ready?
Yes. You are the controller of employee data; we are the processor. Anyone can export their own copy. An admin can erase an offboarded person. Sick leave never appears as a type in channel digests or default calendar titles. The Privacy Policy is the legal text.
Can another company see our data?
No. Every query is scoped to the signed-in workspace. A tenant id from the request body, query or path is rejected. The database also refuses a row that points at another workspace.
When does an AI model process our data?
Optional health-check and retrospective AI features send relevant free-text comments or cards to Cloudflare Workers AI without author labels. Free text may still identify someone. If you connect your own assistant over MCP, the tool results it requests may be processed by that provider under your agreement and approved scopes. Routine leave, time and coverage calculations do not need a model.
Where are files stored?
Uploaded documents and data-export files are stored in the same data region you chose, under Cloudflare's R2 jurisdiction (EU or US). That jurisdiction is set when the bucket is created and does not move.
Does choosing EU mean every request stays in the EU?
No. Storage is regional. Interactive requests may be handled at the nearest Cloudflare location, and background jobs may run globally. Queue messages carry ids, not people records. Optional Stripe or SSO, if you turn them on, process a small amount of account data in the US under their DPAs.
Do you sign a Data Processing Agreement?
The GDPR Article 28 Data Processing Agreement is part of the Terms and applies when you create a workspace, with no separate signature. It is published at /dpa/. If your procurement process needs a signed copy, write to legal@squadbear.com.
Is SquadBear a high-risk AI system under the EU AI Act?
We do not make that classification. SquadBear does not recognise emotions, use biometrics or screen candidates, and it does not average ratings into a score or rank people. Performance reviews are stored as people wrote them. No SquadBear model reads them. A connected assistant may save a draft, peer answers reach it as Peer 1 with no name, and upward feedback is stored without an author from three responses. Retention is 12 to 120 months. Your counsel classifies the deployment. The EU AI Act page sets out the mechanics.
Start free in minutes
Pick EU or US when you register. Free for up to 5 people, no time limit.
Start free