The only AI customer agent built for the EU from day one.

Whether you call it a chatbot or the Customer Agent, the GDPR posture is the same: Unless is the processor and you remain the controller. Personal data stays in the EU, is screened for PII the moment it enters the platform, and sensitive identifiers are tokenized before any model call. Your end users exercise access, rectification, and erasure rights through your own dashboard, with a human confirming each request before anything changes.

Yes, whether it's a simple chatbot or a fully agentic one. Under the EU AI Act, Unless is the Provider of the AI system and you are the Deployer. Most agentic deployments like the Customer Agent classify as limited-risk, which requires disclosing that the customer is talking to an AI, keeping a per-decision audit trail, and letting a human review or override any output, all of which the platform gives you by default. Where a specific use case is closer to high-risk, we work with you in advance on the additional obligations that apply.

Three regimes usually apply at once, whether you're running a basic chatbot or an agentic system like the Customer Agent. GDPR governs the personal data it touches, with you as controller and Unless as processor. The EU AI Act governs the AI system itself: disclosure, audit trail, human oversight. And if you're a financial entity, DORA adds ICT risk management, incident reporting, and third-party oversight on top. Unless is built to carry the technical side of all three, not bolted on per deployment.

The usual risks apply to any chatbot, agentic or not: handling personal data without proper filtering, giving answers with no record of why, or taking an action nobody approved. The Customer Agent addresses each directly: PII is filtered and tokenized before any model call, every answer carries a per-decision audit trail your DPO can read, and it never takes an irreversible action without a human approving the boundary first. The OWASP Top 10 LLM risks, prompt injection, insecure output handling, data poisoning, and the rest, are mitigated at the platform level.

Functionally, yes. GDPR doesn't classify by label; what matters is who's the controller, who's the processor, and how personal data moves. The Unless Customer Agent carries the same GDPR posture whether your team calls it an agent, an assistant, or a chatbot: EU data residency, PII filtering and tokenization at the gateway, and data subject rights handled through your dashboard.

Not by default. Most agentic deployments, ours included, across acquisition, retention, expansion, and support, classify as limited-risk, which calls for disclosure, human oversight, and a per-decision audit trail rather than the heavier obligations for high-risk systems. If your specific use case does qualify as high-risk under Annex III, we work with you in advance on the additional measures that apply.

This holds regardless of whether you're running a simple chatbot or the full Customer Agent: the model that phrases the final answer never sees personal data, it receives only tokens and filtered text, never a recoverable name, email, or identifier. The one component that does see personal data in the clear is the PII-detection step itself, which is why it's listed as a sub-processor in your DPA, alongside the EU-hosted cloud providers the platform runs on. We don't claim no component ever touches personal data; we can say exactly which one does, and that it isn't the model.

Not as its own legal entity. The cloud infrastructure Unless runs on is: AWS holds ISO/IEC 27001, 27017, and 27018 certification, audited independently. Unless's own information security management system is modeled after ISO 27001 and 27002:2022, and we're working toward ISO/IEC 42001 for AI management systems specifically.

Not yet at the infrastructure layer, and we don't claim otherwise. Unless runs on AWS EU regions today, and we intend to move to AWS's European Sovereign Cloud once it supports what the platform needs. What we can stand on today is the data flow: raw personal data is tokenized and filtered at the gateway, so it never reaches a model in a form a provider could read, regardless of which cloud region sits underneath.

Yes, and Unless is built to support your obligations rather than add to them. Our ICT risk management aligns with ISO 27001 and ENISA guidance, incidents are disclosed under committed timelines, the platform undergoes annual penetration testing, and subcontractors are disclosed with audit and termination rights you retain.