Connect Your AI App to GDPRWise

You can connect an AI app that you already use, such as ChatGPT, Microsoft 365 Copilot, Claude or Cursor, to your GDPRWise dossier. You paste one web address into the AI app, sign in with your own GDPRWise account, and confirm once. From then on you can ask that AI app about your own processes, third parties and compliance status, and about the GDPRWise help articles.

What connecting does

The connection is read-only. The AI app can look things up in your dossier and in the GDPRWise help articles. It cannot create, change or delete anything; every change still goes through the normal screens in GDPRWise.

You connect an AI app once, with your own account, and it sees only what that account can already see in GDPRWise. The connection covers every company you are a member of, now and in the future, as long as that company’s account owner allows AI app connections. Each time the AI app looks something up it names the company, and GDPRWise checks, on that very call, that you are still an active member, that the company’s plan includes the AI assistant and that its owner has not switched AI app connections off. If you work for several companies, the AI app first asks GDPRWise which companies you can use. To check which GDPRWise account an AI app is connected with, just ask it: it receives your name and email address along with that list.

The address to paste

The address is shown on the Configuration page in GDPRWise, in the card “AI app connections”, with a copy button. Only the account owner sees that card. For GDPRWise it looks like this:

https://api.gdprwise.eu/mcp

Copy the address from the card, because partners and other brands can have their own. If you are not the account owner, ask them for it.

How to connect, per AI app

The menus of AI apps change often, so these steps stay short. Your AI app’s own help pages have the current screens.

1. ChatGPT. Turn on developer mode in the settings, add a new connector, paste the address and choose OAuth as the sign-in method. Developer mode is only available on some ChatGPT plans.
2. Microsoft 365 Copilot. Your Microsoft 365 administrator adds the address as an MCP connection in Copilot Studio. A ready-made Copilot agent for GDPRWise is not available yet.
3. Claude. In Claude on the web or desktop, open the connector settings, add a custom connector and paste the address. On a team plan an administrator may need to add it first. In Claude Code, run claude mcp add --transport http gdprwise <address> and then sign in through the /mcp command.
4. Cursor. Add a server with the address to your mcp.json file, under mcpServers, with the url setting. Cursor then opens a sign-in page.

In every case a GDPRWise page opens in your browser. It shows which app asks for access. Check that, then choose Continue.

What is sent to the AI app

When the AI app looks something up, GDPRWise sends it:

• your GDPR register: processes, systems, data categories and third parties
• your compliance status and next steps
• your organisation profile, including the names and roles of team members
• GDPRWise help articles

Text that you and your colleagues wrote in the register is sent whenever the AI app looks something up. Email addresses and phone numbers are pseudonymised: they are replaced by labels. That is not anonymisation. Pseudonymised data is still personal data under the GDPR, and names, roles and free text are sent as they are.

Nothing is sent while the AI app is not looking something up.

Who processes it

Your questions and the answers are processed by the provider of the AI app, such as OpenAI (ChatGPT), Microsoft (Microsoft 365 Copilot) or Anthropic (Claude), under that provider’s own terms. By connecting the app, you choose that provider as a recipient of the data. GDPRWise does not choose it and does not pay for it, so it is not a GDPRWise sub-processor. Check the terms and the data settings of your AI plan before you connect, and record the provider in your register as a recipient.

The risk that remains

An AI app reads text and may act on instructions hidden in that text. If a document, a web page or a note in the register contains such instructions, the AI app might follow them. If other connectors are active in the same app, the app could pass on what it read from GDPRWise. GDPRWise cannot prevent this, because it does not control the AI app. To keep the risk small, connect only AI apps your organisation already trusts, avoid combining the connection with connectors that can send data out, and keep free text in the register factual.

How to disconnect

• Yourself. To stop an AI app reaching GDPRWise, disconnect it in that app’s settings. Changing your GDPRWise password also disconnects every AI app.
• The whole company. An account owner controls this with one switch on the Configuration page. Off blocks every AI app from reaching that company immediately, including resellers’ agents. On restores existing connections.
• Automatically. A connection ends when you change or reset your password, and after 30 days without use, or 90 days after you first connected, whichever comes first. An AI app can no longer reach a company once your access to that company is removed or suspended.

Usage

Searches made by the AI app count towards the same daily AI usage limit as the in-app assistant. The Configuration page shows how much of the limit is used today.