Built for European teams
Strategy software with EU-first data processing
Suunta.ai processes your strategy data primarily in the EU and is built with GDPR in mind. Our DPA and subprocessor list are public, so your vendor review has something concrete to read.
- EU-first data processing
- Built with GDPR in mind
- Not used to train general-purpose AI
- Encrypted in transit and at rest
The compliance gap
Most AI-powered tools were not built for European data rules
Many SaaS platforms store customer data outside the EU, use AI processing with unclear retention terms, or provide limited transparency about where information goes. For European teams, that creates legal and reputational risk.
The problem with US-first tooling
When your strategy discussions, OKRs and performance data live in tools built around non-European infrastructure, you face three concrete risks:
- Data residency: sensitive company data may require additional safeguards before it is processed outside the EEA.
- AI training: some AI-assisted tools reserve the right to use customer inputs to improve their models.
- Opaque subprocessors: complex vendor chains make it hard to know who actually handles your data.
What EU-first processing means for you
Suunta.ai is built to reduce these risks. Data is processed primarily in the EU. Some processing, such as AI processing, may take place elsewhere through the providers named in our subprocessor list, under the safeguards described in our DPA. We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly.
For your DPO, this means clearer answers for vendor review, subprocessor assessment and AI risk management. For your leadership team, it means you can connect strategy work without accepting vague data-handling promises.
- 01
EU first
Data is processed primarily in the EU. Where a provider operates elsewhere, transfers are covered by the safeguards described in our DPA.
- 02
GDPR-focused controls
Suunta.ai is designed to support GDPR requirements with a DPA, subprocessor disclosure, deletion support and GDPR-aligned data handling.
- 03
Your content, not training data
We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly. Conversation history is stored so the service works, and it can be deleted.
- 04
Encrypted in transit and at rest
Data is encrypted at rest and in transit. Role-based access controls and data export support your security review.
- 05
Clear DPA
Our DPA is public. It documents roles, processing purposes, subprocessors, security measures and data retention.
- 06
Strategy without surveillance
Your plans, OKRs and KPIs stay private to your organisation. Suunta.ai does not analyse or benchmark your data against other customers.
For your DPO and legal team
What you get in writing
Compliance confidence should not depend on a vendor marketing page. Here is what is documented for procurement and vendor review.
Data Processing Agreement (DPA) - Public. Covers roles (controller / processor), processing purposes, security measures, retention and subprocessor disclosure.
Subprocessor list - A published list identifies third-party services that process customer data, along with their role and country of operation.
Processing location - Data is processed primarily in the EU/EEA. Where AI, payments or integrations involve providers outside the EU/EEA, they are listed in the subprocessor list and covered by transfer safeguards such as an adequacy decision or Standard Contractual Clauses.
Right to erasure - Suunta.ai supports data subject requests, including full account and data deletion on request.
Incident notification - If a personal data breach affects your data, we notify you without undue delay and assist with your own notifications.
From the founder
Strategy data is the most sensitive information a company holds
"Privacy and security have been a top priority for us since day one, shaping every architectural decision we have made. That is not a compliance checkbox, it is a commitment to our customers."
Kare Oja
Founder, Suunta.ai · CTO, Y4 Works
- 01
Strategy to execution in one place
Connect long-term strategy with OKRs, projects and KPIs. No more copying targets between tools or losing context across documents.
- 02
AI that respects your data
Suunta.ai uses your goals and context to generate useful suggestions. We don’t use your content to train general-purpose AI models, and conversation history can be deleted.
- 03
Live KPI tracking
Track progress against your goals as work moves. Spot misalignment early and redirect effort before it becomes a problem.
- 04
Built for leadership teams
Designed for 10–200-person organisations where the leadership team needs clarity, not complexity. Fast to set up, easy to maintain.
Common questions
Data protection — what people ask
You can delete chat history at any time in the app. For full account and data deletion, contact privacy@suunta.ai.
Yes. Our DPA, subprocessor list, Privacy Notice and Terms of Service are published and open to read.
Suunta.ai personnel access customer content only where needed to operate and support the service, and only under confidentiality obligations. Each organisation’s data is kept separate from other organisations’, and we process your content only on your documented instructions. Details on access, security measures and subprocessors are in our Data Processing Agreement.
AI processing is done by the providers named in our subprocessor list, which also shows each provider’s processing location and transfer safeguards. If keeping AI processing inside the EU is a requirement for your organisation, email privacy@suunta.ai and we’ll go through the options with you.
We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly. The details are in our DPA and subprocessor list.
Suunta.ai is built with GDPR in mind. Your data is processed primarily in the EU, protected with encryption and access controls, and kept separate from other organisations’ data.
We don’t use your content to train general-purpose AI models, and we choose AI providers and settings accordingly. Conversation history is stored so the service works, and it can be deleted.
AI providers are listed as subprocessors, with transfer safeguards where data leaves the EU/EEA. See our DPA and subprocessor list.
Role-based permissions control access within your organisation. Customer data is kept separate between organisations, and Suunta.ai personnel access it only as needed for their tasks and under confidentiality obligations.
See the DPA: security measures and DPA: confidentiality. For specific authentication requirements, email privacy@suunta.ai.
Data is processed primarily in the EU. Some processing, such as AI processing, may take place elsewhere through the providers named in our subprocessor list, under the safeguards described in our DPA.
Questions for your vendor review? Email privacy@suunta.ai.
Further reading
A practical GDPR guide for European teams using AI strategy tools
Choosing an AI-powered strategy platform as a European team raises specific questions: where does data go, who can access it, and how do you explain AI use to your DPO? This article guides you through the key considerations.
Our article covers:
- What EU data residency actually means in practice and what it does not cover
- How to assess AI subprocessors under GDPR (SCCs, data retention, training clauses)
- The questions your DPO is likely to ask when reviewing a strategy SaaS vendor
- What a GDPR-ready AI tool should document: DPA, subprocessor list, deletion rights and incident notification
If you are evaluating tools for your team or preparing a vendor review, the article is a practical starting point.
EU-first data processing
Run your strategy on infrastructure you can explain
Primarily EU data processing, encryption at rest and in transit, public subprocessors and a strategy tool your team will actually use.