GDPR compliance built directly into 2021.ai’s GRACEchatbot. Chat Guardian automatically scans and filters personal data from prompts and documents, giving you full control over what leaves your organization.
AI tools create an entirely new data risk
AI tools boost productivity, but they also introduce a new category of GDPR risks that traditional compliance tools were never built to handle.
One copy-paste away from a data breach
Employees paste customer data, contracts and HR information into AI chat tools, often without realising that the data leaves the company's control the moment they hit enter.
Files sent to unknown servers
Documents uploaded for summarisation or analysis can be stored, processed or used to train models on servers outside the EU.
AI trained on your data
Business-critical and confidential information can end up training external AI models without your knowledge, consent or legal basis.
External AI with access to internal data
When external AI tools process sensitive information, it can constitute a breach of GDPR articles 28, 32 and 44.
Let your employees work freely. We handle GDPR compliance.
When an employee sends data to ChatGPT, Copilot, Claude, or Gemini, Chat Guardian scans the message in real time. Sensitive data is caught before it reaches the AI model, and the employee receives a clear warning.
The result: you avoid data breaches without putting AI work on hold.
A natural integration. No overlap.
One product, two specialists. Chat Guardian emerges where GRACE's AI platform meets Safe Online's data classification.
2021.AI builds GRACE, the AI platform European companies use to deploy GenAI with full control and documentation. Safe Online builds the data classification engines that have been running inside EU compliance teams since 2019. Chat Guardian is what happens when these two specialists come together.
For organizations on GRACE, Chat Guardian is a first-class control: same admin console, same SSO, same support. No additional vendor to procure, no separate integration process.
Built into GRACE. Available as a configurable control across all GRACE deployments, including GenAI, MLOps, and Governance.
One unified audit log. Chat Guardian events flow directly into GRACE's existing governance reporting. Your DPO gets a single source of truth.
GRACE AI Platform
The European AI platform for governed GenAI, MLOps, and governance. Used across legal, finance, life sciences, manufacturing, and the public sector.
+
The engine behind Chat Guardian
The detection engine powering the scan. Personal data classification trained on European languages with a GDPR-aligned taxonomy. In production since 2019.
How does the scanner know what qualifies as GDPR-sensitive data?
Our scanner comes pre-configured with a thorough understanding of the data categories regulated by GDPR. Recognition is based on GDPR’s definitions and applicable standards, and can be extended with your own data policies. This way, the scanner catches both what the legislation requires and what your organization itself considers sensitive.
How does the warning log support GDPR compliance?
Every time the scanner triggers a warning, it is automatically saved in a time-stamped log. This gives your compliance and security teams full visibility into where and when there has been a risk of data leakage in AI conversations. The documentation makes it easy to demonstrate accountability to auditors and the Danish Data Protection Authority.
Can we define what counts as sensitive data within our organization ourselves?
Yes. The scanner has configurable data policies, so you can tailor exactly what should be detected. This means you can account for your industry, your legal requirements, and your internal compliance standards, without compromising on what GDPR already covers.
Is the scanner built on a language model?
No, Chat Guardian is not built on a large language model like ChatGPT or Claude. Instead, it uses a purpose-built AI pipeline consisting of several smaller, targeted models — including a Small Language Model (SLM) — trained specifically to recognize and classify sensitive data in real time. This makes the solution fast, accurate, and independent of an internet connection, since all analysis takes place locally within the customer’s own environment.
