Your diagnostics are processed in the EU, and our AI provider keeps nothing from them. Two auxiliary steps and web search still run in the United States; the details are below. Here is where your workshop's data is processed, what is kept and by whom, and what we can show you if you ask.
Last updated 23 September 2026
Where your data is processed
Storage. Your account and diagnostic records are stored on Amazon Web Services in Stockholm (region eu-north-1).
AI processing. Diagnoses run on Google Cloud Vertex AI through its EU multi-region endpoint, in data centres in the European Union. No endpoint outside the EU is used. The Google Cloud projects are owned by WrenchLane AB.
Two auxiliary steps (translating a bulletin search, checking a fault code read from a photo) still run on OpenAI in the United States; they never receive registration numbers, VINs or customer details, and we are moving them to our EU AI provider.
What our AI provider keeps: nothing
Your prompts and the answers. Not stored. Each request is processed and nothing is kept afterwards.
Caching. Off on our Google Cloud projects.
Abuse-monitoring logging. Exempted. Google approved WrenchLane's exemption in writing on 11 September 2026. Without it, Google may keep prompts for up to 30 days for abuse review.
Request and response logging. Off. Never enabled.
Audit logs. Metadata only, such as timestamps. No prompt or answer text.
Model training. Never. Google does not use your prompts or answers to train its models.
What WrenchLane keeps
The diagnostic record: the vehicle, the fault codes, the description you type, and the ranked causes and repair guidance we give back.
Where. Our database in the EU (AWS Stockholm).
Why. To run WrenchLane for your workshop, to help when you contact support, and to measure and improve diagnostic quality.
How long. Until you ask us to delete it or close your account. When a subscription ends, we keep data for up to 90 days unless you ask us to delete it sooner.
Anonymised data. Before deletion, we may keep de-identified, aggregated data to improve WrenchLane. It can't be traced back to your workshop and is never given to our AI provider to train its models.
One caveat: web search
Some diagnoses need current information from the public web. Then a search query goes to our web-search provider. It contains the fault codes, the vehicle's make, model and year, and the problem description. It never contains registration numbers, VINs or customer details.
Our web-search provider may keep that query for a limited period. We're moving it to a plan with no retention. Once that's signed, this section will say it keeps nothing either.
For some answers our AI provider runs the web search itself; Google keeps those search queries, together with contextual information, for up to three days to debug the service. Google Search is not limited to the European Union.
Web-search provider: Brave Software, Inc., United States. See clause 2.4 of our DPA.
Sub-processors
The companies that process personal data for us, exactly as listed in clause 4.1 of our Data Processing Addendum. We e-mail customers at least 30 days before we add or replace one.
| Sub-Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, data storage, speech-to-text and search infrastructure | Stockholm, Sweden (EU, region eu-north-1) | Not applicable (EU) |
| Google Cloud EMEA Limited | AI inference (Vertex AI) for the diagnostic and chat features, configured for zero data retention (no caching, no prompt logging, no training) | European Union (EU multi-region) | Not applicable (EU) |
| OpenAI, L.L.C. | Language detection and translation of technical-bulletin search queries; validation of fault codes read from uploaded images | United States | Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Payment processing (WrenchLane.com does not store card details) | Ireland (EU) | Per Stripe's data processing terms |
| Customer.io, Inc. | Service, onboarding and lifecycle e-mail to business representatives | European Union (EU data centre) | Not applicable (EU); EU-U.S. Data Privacy Framework and Standard Contractual Clauses under Customer.io's DPA for any access from the United States |
| PostHog, Inc. | Product analytics (EU cloud; IP address discarded) | European Union | Not applicable (EU) |
| Functional Software, Inc. (Sentry) | Application error monitoring | European Union (EU data region, Germany) | Not applicable (EU); Standard Contractual Clauses under Sentry's DPA for any access from the United States |
| Haynes Group Limited (HaynesPro) | Vehicle identification by registration number and licensed technical data | United Kingdom | UK adequacy decision |
Evidence, on request
You don't have to take our word for it. We can show you:
- Google's written approval of our prompt-logging exemption (11 September 2026)
- Google Cloud Support's written statements on retention (September 2026)
- A dated capture of the caching setting on our projects
- A sample of our audit logs, showing metadata only
Ask at support@wrenchlane.com.
The legal documents
Data Processing Addendum · Privacy Policy · Terms of Service