MeinGPT
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
SelectCode GmbH (Amtsgericht München HRB 234337, Oskar-von-Miller-Straße 11, 82008 Unterhaching, Germany; managing directors Florian Baader and Reiner Conrad; no parent company found)
AI workspace for German SMEs by SelectCode GmbH (Munich area): multi-model chat, assistants, RAG and API on Hetzner Germany; default prompts go to Azure OpenAI and Google Vertex EU regions.
MeinGPT offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
MeinGPT is a multi-model AI workspace operated by SelectCode GmbH (HRB 234337, Amtsgericht München, founded 2017 as a UG, owner-managed, no outside investor or parent company found), and its paperwork is above average for the category: a public AVV (version 2.0.1, 24 September 2026) with TOMs mapped to ISO 27001 Annex A, a clause refusing third-country authority requests that lack a mutual legal assistance basis, a sub-processor annex of 21 entries (20 companies), and an ISO/IEC 27001:2022 certificate held by SelectCode itself (Proks Certification, no. DE-IS-20250256, valid to December 2028). Platform, chat and document data sit on Hetzner in Germany, and the app endpoint resolves straight to a Hetzner server in Falkenstein. The score is held at 3 by the model path: the default Bestes Modell setting sends prompts to GPT-5 on Microsoft's Azure OpenAI EU Data Zone and falls back to Gemini on Google Vertex, Claude runs on Google Vertex in Frankfurt, and AWS Bedrock and OpenAI Ireland are further model sub-processors, so core content is routinely processed by US-owned providers, even though their regions are in the EU. Several US-hosted models stay selectable unless an admin restricts the workspace, and the PII filter for non-EU models is off by default. Managed databases are run by Ubicloud B.V. inside Hetzner, a Y Combinator company whose terms route payments to Ubicloud Inc. in San Francisco; the website privacy policy also names Sentry (US) for application error monitoring, which the AVV annex does not list. An EU-only setting (Mistral AI, Nebius-hosted open models) narrows the model path; it does not remove the platform-level US links.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About MeinGPT
MeinGPT is a browser-based AI workspace for mid-sized companies, built and operated by SelectCode GmbH, an owner-managed software company founded in 2017 near Munich that launched MeinGPT as its own product in 2023. One interface gives employees chat with models from OpenAI, Anthropic, Google, Mistral and open-weight families, plus file analysis, meeting transcription, shareable assistants, workflows, retrieval over company documents and an OpenAI-compatible API. A connector called Outpost indexes files inside the company network without opening an inbound firewall port. Admins decide which models each team may use, set spending limits, and can provision users from Microsoft Entra ID. The platform licence starts at €18 per user and month on annual billing for up to 50 users, excluding VAT, or €20 on monthly billing; model usage is paid separately from prepaid credits. Contracts are for businesses only.
The paperwork is public and unusually specific. The AVV (version 2.0.1, September 2026) can be downloaded without a login and lists 21 sub-processor entries with purpose and location, maps its technical measures to ISO 27001 controls, and commits SelectCode to refuse authority requests from outside the EU that lack a legal assistance basis. SelectCode holds its own ISO/IEC 27001:2022 certificate. Workspace, chat and document data are stored on Hetzner servers in Germany; at audit the application endpoint resolved directly to a Hetzner machine in Falkenstein with no CDN in front, and static files came from bunny.net in Slovenia. Managed databases are run by Ubicloud, a Y Combinator company with a Dutch contracting entity whose terms route payments to its San Francisco company.
The determining question is where prompts go, and the vendor answers it openly: German platform hosting does not mean every request is processed in Germany. The default "best model" setting uses GPT-5 through Microsoft's Azure OpenAI service in EU data centres and falls back to Gemini on Google Vertex; Claude also runs on Google Vertex in Frankfurt. These are EU regions of US-owned providers. A few models run in the United States and stay selectable unless an admin switches them off, and the filter that redacts personal data before such requests is off in a new workspace. An "EU only" level narrows the choice to providers headquartered in the EU, such as Mistral AI and open models served by Nebius. Ownership is recorded as EU-owned, with SelectCode based in Germany, but because default inference runs on US hyperscalers, CLOUD Act exposure is recorded as Material. Best fit: companies that want a governed AI workspace with a German counterparty and published documentation. Buyers who must keep prompts away from US-owned providers should set the EU-only level and confirm which platform services remain in the data path.
Sub-processor map · not disclosed
Frameworks & certifications
Held by the provider that operates the hosting, not by MeinGPT itself.
Capability matrix
Table 1Capabilities of MeinGPT
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
| Aleph Alpha Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
| Black Forest Labs Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
| DeepL Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |