GDPR and Eddie

The short version

• GDPR compliant (self-assessed). There is no official GDPR certification we hold, and we do not claim one. We assessed our own practices against the GDPR.
• A DPA is available. Our Data Processing Addendum sets out how we process personal data for you as a processor: subprocessors, security and international transfers.
• SOC 2 Type II audited. An independent auditor, Advantage Partners, tested our controls against the Security criterion from May to August 2026.

Request a signed DPA

The published DPA takes effect once it is part of your agreement with us. If you need a signed copy, email hey@heyeddie.ai with your organization's name.

What data goes where

• Footage you import into Eddie's cloud is stored and processed by Eddie, and by the third-party providers that do some of the work for us (for example transcription and AI models). Each is listed, with what it may do, in our Trust Center. Transfer mechanisms are in the DPA.
• On-device Eddie runs locally on your own machine. Ask us whether it fits your requirements.
• We do not train AI models on your content, and we do not authorize the third-party AI providers that process it for us to train on it. See the Terms.
• Everyone in a workspace can open every project in it. See What everyone in a workspace can see (and spend).

Your rights and who to contact

Our Data Protection Officer and our EU and UK Article 27 representatives are named in the Privacy Policy. Data subject requests go to privacy@heyeddie.ai, and we answer within the statutory timeframe. To delete your account and its data, see Delete your Eddie account and data.

Related: Legal, security and compliance, HIPAA and Eddie, Contact support.