Conversational Platform
AI Chatbots with integrated compliance features
GDPR, EU AI Act, DORA, and Accessibility compliant – LoyJoy meets all regulatory requirements for enterprise chatbots.
LoyJoy offers you the assurance that every customer dialogue meets the highest legal standards – from the first click to archiving.
EU Data Sovereignty
AI models on our own hardware in our German data center
For our chat agents, we run the AI model Gemma 4 on our own hardware in our data center in Münster, not in a rented cloud. This removes the use of external AI subprocessors for chat. There are also data protection benefits: the US Cloud Act attack surface is completely eliminated. On accuracy, speed and reliability, our customers rate Gemma 4 on par with current large language models from well-known providers. If you want to use other current models as well, you remain free to choose them.
Why Compliance is Crucial Now
Regulatory requirements are increasing. LoyJoy helps you stay one step ahead.
- Stricter Regulations
-
The EU AI Act and DORA increase requirements for transparency and resilience. LoyJoy is prepared for all relevant regulations.
- Reputation Protection
-
Violations don't just cost money – they cost trust. With LoyJoy you support your compliance posture and protect your brand.
- Growing Customer Expectations
-
Accessible and privacy-friendly experiences are expected. LoyJoy fulfills WCAG 2.1 AA and Privacy-by-Design out-of-the-box.
Legal Frameworks & How LoyJoy Complies
From GDPR to EU AI Act to DORA – LoyJoy is aligned with all relevant EU regulations.
- GDPR.
- EU-only hosting in securely encrypted data centers. Privacy-by-design with data minimization, pseudonymization, and consent-aware tracking.
- EU AI Act (Limited Risk).
- Transparency obligations met: an AI label on every AI-generated message and Explainable AI feature. Model freedom without vendor lock-in, compliant with Art. 53 para. 1 lit. d.
- DORA.
- End-to-end audit logs for all chat events. Automated API incident notification via email.
- Accessibility (BfSG / WCAG 2.1 AA).
- Screen reader compatible web component, keyboard navigation, high color contrast, and automated accessibility tests with every release.
- Certified infrastructure & external testing.
- Hosted on ISO 27001 and PCI DSS certified infrastructure (Google Cloud EMEA). LoyJoy's own information security management follows the BSI IT-Grundschutz-Kompendium and ISO/IEC 27001:2022, with certification as a stated objective. Annual external penetration test by an accredited provider, OWASP Web Security Testing Guide methodology, certificate available on request.
- Technical & organizational measures.
- TLS 1.3 in transit, AES-128 at rest. RBAC and optional MFA requirement. Data retention policy with automatic deletion period.
Privacy by Design & Operational Security
Transparency, control, and data protection are not extras – they are built into the LoyJoy platform.
- Explainable AI view.
- Source highlighting for every generated answer – traceable for customers and auditors.
- Pseudonymised processing.
- Processing via abstract identifiers. Retention configurable per tenant from 7 to 720 days, enforced by irreversible deletion.
- Model-switch log.
- Every LLM change is documented – full traceability for compliance teams.
- Data residency.
- All customer data stored exclusively in EU regions. LoyJoy does not have access to your data without your explicit permission.
- Customer audit portal.
- 24/7 access to reports and log exports for your compliance evidence.
- External audits.
- Annually by independent auditors, last report July 2026.