GDPR Compliance

Xilos helps organizations meet General Data Protection Regulation (GDPR) requirements for AI workloads.

Data Subject Rights

Xilos supports GDPR data subject rights through:

• Right to access — Query logs and audit trails provide a complete record of what data was processed
• Right to rectification — Users can update their information through the user management system
• Right to erasure — Organization admins can delete user data and associated query history
• Right to restrict processing — Restriction rules can be configured to block processing of specific data types

EU Data Residency

Configure Xilos to process and store data within the EU:

1. Navigate to SuperAdmin > Model Config.
2. Set Data Region to eu.
3. Toggle Data Residency Enforced on.

When enforced, Xilos only routes queries to LLM providers with EU-region endpoints. This ensures prompt data and responses remain within the EU.

Info: Data residency enforcement prevents queries from being routed to providers that cannot guarantee EU-region processing.

PII Detection

Xilos automatically detects and masks Personally Identifiable Information (PII) in queries before they reach the LLM. This includes:

• Names, email addresses, phone numbers
• Social security numbers, passport numbers
• Credit card numbers, bank account numbers
• IP addresses, physical addresses

See PII Detection for the full list and configuration.

Audit and Deletion

• All query processing is logged in the audit trail with full context
• Admins can export audit data for compliance reporting
• User data can be deleted on request while preserving anonymized aggregate metrics
• SIEM export forwards governance events to your compliance platform

Configuration