GDPR Art. 22
No fully automated individual decisions about people. Letting decisions rest solely with you.
Security & Compliance
Your data. Your applicants. Secure.
Built according to Article 22 of the General Data Protection Regulation (GDPR Art. 22). Database in the EU. Data is encrypted in transit (TLS) and at rest.
Eight pillars
How we build security in practice.
Compliance is the legal foundation. Tech is the implementation. The two have to fit together.
Compliance
DSK three-phase model
Following the guidance of the German data protection conference (DSK) on tenant self-disclosures, version 2.0 (January 2026): applicant data is processed in three clearly separated phases. Proof of income only after the viewing, ID copy only before the contract.
Database in the EU
The database is in the EU. For AI and delivery we also use services outside the EU, based on EU standard contractual clauses or an adequacy decision. Which services these are is listed in the list of sub-processors.
Anti-profiling architecture
No AI scores, no ranking, no personality assessment. Rule-based hard-facts checks against your criteria.
Tech
Encryption
Connections to Locari are encrypted in transit (TLS). Database and files are stored encrypted (AES-256).
Language models disclosed
Applicant dialogue, document extraction and classification run on Mistral (Paris). The landlord assistant additionally uses Claude (Anthropic), with transfer to the US. No training on your data.
No scoring in the data model
A single criteria helper in the backend checks your hard facts (met / not met). The applicant database has no scoring columns at all – there is no field an automated score could be written to.
Brand continuity
Applicants see you as the landlord, not “Locari” as a third party. No mention of the platform in the applicant process, no data passed on to marketing.
Self-commitment
We commit to the highest standards.
What the law requires, we meet today.
Self-commitment documented, code architecture auditable, data-protection practice open in detail.
GDPRActive
Legally required. Active today.
EU databaseActive
Database in the EU. Active today.
Data flows
Who has access, and when.
Four paths, each documented. No hidden processors – the full list is in the Trust Center; US services are secured via EU standard contractual clauses.
| From | To | Safeguard |
|---|---|---|
| Applicant | Locari (WhatsApp / email) | |
| Locari | Landlord (WhatsApp) | |
| Locari | ImmoScout24 · Kleinanzeigen | |
| Locari backend | Database (EU) · language models |
No SCHUFA API and no automatic guarantor verification: the applicant brings their own credit report, Locari stores and displays it – without rating it.
Common security questions
What landlords ask most often.
Where are my data and my applicants’ data stored?
The database is in the EU. For AI and delivery we also use services outside the EU, based on EU standard contractual clauses or an adequacy decision. These include app hosting/CDN (Vercel), the landlord assistant (Anthropic) and WhatsApp (Meta). The full list is under sub-processors. For our own purposes we also use PostHog (usage analytics with your consent, error monitoring; servers in the EU, provider based in the US, safeguarded by EU standard contractual clauses). Details are in the privacy policy.
How does Locari implement the GDPR?
Locari follows GDPR Art. 22 (no fully automated individual decisions about people) and the three-phase model of the DSK guidance (V2.0, January 2026) for applicant data. Letting decisions rest solely with the landlord. The architecture enforces this, not just the terms.
Which LLM does Locari use?
The sensitive applicant data – applicant dialogue, document extraction, classification – is processed by Mistral, hosted in the EU. The landlord assistant (e.g. viewing briefings) additionally uses Claude (Anthropic) via the Vercel AI Gateway; applicant master data (e.g. income, credit indicators) is processed in doing so. No training on applicant data. The full list of services is in the Trust Center.
How is deletion of applicant data handled?
Applicants can request deletion at any time via chat or email – Locari then immediately erases everything, leaving nothing behind: every email, the AI chat history, open tasks. Without such a request, the data of applicants who weren’t chosen is deleted automatically after the letting ends, as soon as it’s no longer needed. The exact period is set out in the privacy policy. Chosen applicants’ data moves into the tenancy context and follows the retention periods that apply there.
What happens when an applicant requests access to their data?
Locari detects an access request under Art. 15 GDPR in every application status – even after rejection or withdrawal. Locari compiles the complete report from the stored data (without AI, word for word from the database) and sends it within the statutory one-month deadline; the landlord is told once it has gone out. If the request can’t be clearly matched to the applicant’s address, the landlord releases the delivery with a button. The report is delivered exclusively to the address the applicant communicates from. Deletion is just as simple: a single reply is enough.
Anti-profiling – what does that mean technically?
No ML scores, no personality assessment, no ranking. Locari checks your self-defined hard facts on a rule basis (number of people, income multiple, pets) – the result is met or not met, not a score. More on the anti-profiling architecture.
What sets Locari apart from US providers?
The database is in the EU. For AI and delivery we also use services outside the EU, based on EU standard contractual clauses or an adequacy decision. These include Vercel and Anthropic for the landlord assistant as well as WhatsApp. What sets Locari apart is the architecture: no rating of people, you decide who moves in. The full list is under sub-processors.
Get started
Security isn’t an add-on. It’s the foundation.
At Locari, GDPR, an EU database and anti-profiling are anchored in the code – not hidden in the terms.