ChatGPT, Gemini, Claude, DeepSeek — brilliant tools, and we use them daily. But should a client's confidential document go into one? Here's the honest comparison. Every claim below links to its source.
On the consumer tiers of the major chatbots, what you paste can be retained and used to improve the model unless you find and flip a setting — and the policy differs tool to tool, so "safe" depends on which one and which tier. OpenAI's own documentation notes that data already used in a training run cannot be removed retroactively [1][2]. An opt-out protects your next document, never your last one.
In May 2025, a US federal court ordered OpenAI to preserve user conversations — including ones users had deleted — as potential evidence in a copyright lawsuit [3]. In January 2026 the court went further and compelled production of a sample of 20 million chat logs to the plaintiffs [4]. None of those users did anything wrong — their conversations became litigation material anyway. That is what it means to have your processor inside another country's legal system.
ChatGPT (OpenAI), Gemini (Google), and Claude (Anthropic) are US companies — under the US CLOUD Act they can be compelled to hand data to US authorities even when it's stored on EU servers, which the EU's own regulators flag as conflicting with European law [5]. DeepSeek is Chinese: it stores user data on servers in China and told Italy's regulator it isn't subject to EU data-protection law — so Italy's Garante banned it outright in January 2025, with data authorities across the EU opening probes [7][8]. The pattern: no major general chatbot is EU-sovereign. They are US (CLOUD Act) or Chinese — and picking an "EU region" doesn't change who the company answers to.
Suppose you opt out of training, use temporary chats, pick the careful tool, and never slip. When a client — or an auditor — asks "who processed this document, under what agreement, and where?", a personal chatbot account gives you nothing to show: consumer terms, no data processing agreement, no processor relationship. That's the textbook definition of shadow AI.
Tirmira's answer fits on one line: a named EU vendor, a signed DPA, every processor listed in the privacy policy, EU-only processing, zero data retention, and originals that are never stored. Your name is on the audit — ours is on the processing.
Hosted by a German infrastructure company, analysed by a French AI provider on EU servers [6]. No US — or Chinese — company touches your documents at any step, so there's no foreign provider for the CLOUD Act (or anyone else) to reach.
Our EU AI provider (Mistral) runs under Zero Data Retention: your document and its analysis are never stored or logged — used only to produce your result, then gone. No retention window, no training. Where a chatbot keeps your inputs, nothing of yours remains here — not with us, not at the subprocessor.
Our AI provider does not use API data to train models [6] — a contractual term of the paid API, not a buried toggle you have to find.
Text is extracted in memory and your file is discarded on the spot. Analyses live in your dashboard for 7 days — or until the moment you delete them.
No empty chat box. Each document type runs through a fixed professional template — contract, RFP, lease, financial report, meeting notes — consistent every time, built for long documents.
A real vendor relationship: DPA in place, processors named, deletion guaranteed. GDPR-safe by design — a defensible answer for your audit trail.
If an analysis fails or is unusable, it's refunded. A human answers within two business days. Try getting that from a chat tab.
We use ChatGPT, Gemini, and Claude ourselves — for brainstorming, drafting, public information, anything that isn't confidential. If the text you're pasting contains nothing you'd mind a stranger reading, a general chatbot is excellent. The line is simple: your data, your call — your clients' data, their trust. Tirmira exists for the second category.
Analyse your first document — free
One-step account · no card required · first analysis free
All sources accessed June 2026. If any of these facts change, we'll update this page — accuracy is the product.