Security
Why moderation and triage run at Mistral in the EU, what fraction of comments ever triggers a draft, how third-country transfers are covered under Chapter V GDPR - and why "servers in the EU" on its own says nothing.
Published · September 3, 2026 · Tim Urbutt · 8 min read
01
A moderation tool does not make one kind of AI call but several quite different ones. They differ in volume, in content and in risk - which is exactly why it makes sense not to run them all at the same provider.
The call that touches every single comment is the moderation: does this text breach this rule? Next to it sits reply triage: is this even a question that deserves an answer? Both run at Mistral AI in the EU. They are the frequent ones, and what happens millions of times should take the shortest path - geographically and legally.
| Step | Where | How often |
|---|---|---|
| Moderating a comment | Mistral AI, EU | For every comment |
| Reply triage | Mistral AI, EU | When replies are switched on |
| Reply draft (Copilot) | US provider, standard contractual clauses | Only for comments that trigger a draft |
| Knowledge base embeddings | US provider, standard contractual clauses | When your own knowledge changes |
| Image and audio context of a post | US provider, standard contractual clauses | Once per post, not per comment |
The point of the table is the third column. The call with the highest volume and the most third-party personal data runs in the EU; the calls outside it concern either your own material or a fraction of the comments.
02
The honest answer is: because the tasks are different. Classifying a text against a rule you wrote yourself is a different job from drafting a reply that has to sound like you and draw on your knowledge base. Models differ in how well they do each, and a tool pretending one model is ideal for everything is optimising a story rather than a result.
The split also has a data protection logic, and that is the more important one: it follows the amount of personal data. Every comment under your post comes from a third person who knows nothing about your choice of tools. That processing is what stays in the EU. Your knowledge documents and your reply library, by contrast, are your own material - a different case, even if it deserves the same care.
03
Before arguing about processing locations, it is worth looking at the payload. The moderation call carries the comment text and an internal id, plus your rules and the post context. The commenter's name and profile id are not sent along, because the decision does not need them.
A comment text without a sender is, in the vast majority of cases, no longer personal data. Minimising before the call is therefore more effective than any argument about server location afterwards.
The same holds for the draft: what the drafting step sees is the comment text and the knowledge you stored, not your customer base and not the identity of the person asking.
04
Chapter V of the GDPR, Articles 44 and following, requires a safeguard for every transfer to a third country. The most common one is the European Commission's standard contractual clauses under Article 46(2)(c), supplemented by an assessment of the legal situation in the destination country - in the jargon, a transfer impact assessment. On top come the technical measures that make the transfer proportionate in the first place: here, the minimisation that never sends the sender.
A server location says nothing about who has access. What matters is the combination of three things: where processing happens, which law the provider is subject to, and what has been agreed contractually. A European data centre operated by a company subject to a third country's law is a different case from a European provider in the same data centre.
Ask this of every tool you use - us included. An answer that only says GDPR compliant is not an answer. An answer that names the provider, the processing location, the legal basis for the transfer and the assurance on model training is one.
05
Comments, rules and knowledge documents are not used to train or fine-tune models - not by us, and not by the providers we use. This is the question to put to every provider in writing, because it cannot be inferred from the processing location: a provider in the EU that trains on your inputs is worse than one in the US that contractually excludes it.
The answer is not in the marketing but in the model provider's terms and in the data processing agreement. Ask for it in writing - from us as much as from anybody else.
06
Moderation and reply triage - the step that touches every comment - run at Mistral AI in the EU. Reply drafts, embeddings and image or audio context run at providers in the US under the EU standard contractual clauses; that only affects the fraction of comments that produces a draft at all.
Largely yes, through feature selection: if you do not use Copilot drafts and the knowledge base, you do not trigger the steps that run there. Moderation and triage are unaffected and run in the EU either way. Talk to us if you want that fixed contractually for your case.
No. The moderation call carries the comment text and an internal id, plus your rules and the post context. Name and profile id stay in our database, because the decision does not need them.
Yes, on request - with purpose and processing location per provider, together with the data processing agreement under Article 28 GDPR and the description of technical and organisational measures under Article 32.
07
Last reviewed: 3 September 2026. When a provider or a processing location changes, this article is updated together with the subprocessor list.
Write to us — we are happy to help with a concrete answer.
Nordify UG (haftungsbeschränkt), Hamburg