GDPR-Compliant SaaS: DPA, EU Hosting, and Data Retention (Tolky B2B)

When Tolky moved from a consumer product to a B2B platform for Dutch and Belgian public-sector buyers — municipalities, OCMW/CPAS, schools, GP practices — GDPR stopped being a marketing line and became a procurement gate. These buyers have DPOs who read the small print. Three things determined every deal.

The Data Processing Agreement (DPA)

Every B2B customer needs a signed DPA before legal will countersign the MSA. That means having a template ready — controllers, processors, sub-processors, purposes, the Article 28 requirements — and an e-signature flow that does not take two weeks. If the DPA is not ready when procurement asks, the deal stalls.

EU hosting, for real

"EU-hosted" has to be true end to end: compute, database, object storage, backups, and the model inference endpoint. A SaaS that runs its app in Frankfurt but calls a US-hosted model for translation is not EU-hosted in any way that matters to a DPO. Architecting the inference layer to land in an EU region was a hard constraint from day one, not an afterthought.

Explicit retention and deletion

GDPR is specific about storage limitation. "We keep data as long as needed" is not a policy; it is a finding waiting to happen. Define retention per data category — transcripts, usage logs, account records — with concrete windows and automated deletion. For a translation product, transcripts are the sensitive category: they can contain medical or legal content. Defaulting to short retention with an opt-in longer window is the defensible posture.

The pattern, generalized

For any SaaS targeting European public-sector or healthcare-adjacent buyers: DPA-ready, EU-resident infrastructure, and retention you can state in one sentence. Get those three right and procurement becomes a conversation instead of a wall.