AI Platforms for Businesses Compared 2026: GDPR, Section 203 and Data Storage

Looking for an AI platform where data, instance and contracts stay in your hands? The WZ-IT AI platform runs as your own instance on your own domain, with models operated in Germany by German providers and the Section 203 supplementary agreement from the smallest package. Book an initial consultation

Anyone looking for an AI platform for the whole team finds dozens of providers with similar promises: GDPR compliant, servers in Germany, all models. The differences lie deeper, and that is exactly where compliance is decided: do many customers share one platform, or does each organisation get its own instance? Which US groups process the inputs, even if the database sits in Frankfurt? Is there an agreement under Section 203 of the German Criminal Code (StGB), and from which plan?

This comparison sets out ten AI platforms from German providers side by side, using information from the providers' pricing pages, data processing agreements and trust centres. WZ-IT offers an AI platform itself and is therefore included in the table. All information as of 14 October 2026.

Table of contents

• What an AI platform is
• The providers at a glance
• Shared platform or dedicated instance
• Data path: where the models run
• Section 203 StGB and professional law
• What 25 users cost
• Operating models: hosted, in your network, on premises
• Selection checklist
• Common misconceptions
• Status and methodology
• Our approach at WZ-IT
• Further guides

What an AI platform is

An AI platform is the central interface through which an organisation uses generative AI: chat with several language models, questions about your own documents (knowledge bases), reusable assistants, SSO sign-in and permissions per group. The difference from a single AI tool is the breadth, the difference from a private ChatGPT account is control: the organisation decides which models are allowed, who sees which data and which contract applies.

The features are very similar across providers. What matters for the choice are four questions: how is data separated? Who processes the inputs? Which contracts exist? What does it cost for your number of users?

The providers at a glance

"Shared" means one multi-tenant application for all customers, separated logically. The evidence for each row is in the following sections and under Sources.

Shared platform or dedicated instance

Most platforms are multi-tenant SaaS: one application and one database for all customers, with separation in software. According to its security page, innoGPT separates workspaces via row level security, Logicc also uses row-level security, meinGPT separate keys per tenant. DeutschlandGPT explicitly states in its trust centre: "no operation in your own data centre".

These providers only offer a dedicated instance in large plans: Langdock offers a dedicated deployment from 2,000 seats according to its security page, and your own cloud or on-premises from 5,000 users according to its documentation. Logicc mentions "own instance, location Germany" in the enterprise plan.

Separate instances are the standard with:

• kamium: dedicated instance, "physically separated", in the customer's Azure tenant.
• CompanyGPT: installation in the customer's cloud tenant; innFactory writes "we are not a SaaS provider" (product page).
• Alan: "isolated instance in a secure environment in the Open Telekom Cloud" (pricing page).
• plusKI: private instance with a dedicated GPU (product page).
• WZ-IT AI platform: own instance per customer on its own domain, with its own database, knowledge bases and groups (AI platform).

Why it matters: with your own instance, updates, backups, configuration errors and permissions affect only your organisation. It can be set up so that it is reachable only from your own network, and it can be fully deleted or handed over when the contract ends. On a shared platform, separation depends solely on the provider's software.

Data path: where the models run

"Hosting in Germany" usually describes where the platform is stored, not the path the inputs take. Anyone offering GPT, Claude or Gemini uses Microsoft Azure, Google Cloud, AWS or OpenAI. These groups process inputs via their EU subsidiaries in European data centres, but as parts of US groups they remain subject to the US CLOUD Act. An example of the limits: according to its documentation, Microsoft explicitly excludes the Anthropic models in Copilot from the EU Data Boundary.

Anyone processing professional or official secrets should therefore not ask about the server location, but about the list of subprocessors and which models on that list work without a US group. On most SaaS platforms these are the Mistral AI models; with Alan, plusKI and the WZ-IT AI platform it is all default models.

Section 203 StGB and professional law

A lawyer, tax advisor, notary, auditor or public official who involves a service provider is only exempt from criminal liability if that provider is bound to secrecy (Section 203(3) and (4) StGB). Professional law sets out the minimum content, worded alike in Section 43e BRAO, Section 62a StBerG, Section 26a BNotO and Section 50a WPO:

1. a contract in text form,
2. a confidentiality obligation with instruction on the criminal consequences,
3. access only as far as the service requires,
4. rules on whether subcontractors are used and their commitment in text form.

A DPA under Art. 28 GDPR alone is not enough. This is how the providers handle it:

Two details are often overlooked: at innoGPT the free trial is explicitly not Section 203 compliant, and at WZ-IT too the Section 203 supplementary agreement only applies with the booked package, not in the test instance. And the agreement with the platform provider only covers the chain that the provider itself has bound. If a user chooses a model from a host that is not included, that part falls outside the protection. Logicc therefore hides such models once the agreement is concluded (help).

More on the contract chain is in the article What is Section 203 hosting?. This is not legal advice.

What 25 users cost

The pricing models are hard to compare: per user, per active user, per organisation, by credits or by GPU. The following calculation assumes 25 users, monthly payment, public net list prices and the plan that includes a Section 203 agreement where there is one.

With annual payment, prices at Langdock, Logicc, DeutschlandGPT and meinGPT drop by 10 to 20 percent. Not included are setup fees (kamium, CompanyGPT, optionally WZ-IT), SSO surcharges and usage-based add-on features. The calculation does not replace a quote, but it shows that "from EUR 20 per user" is rarely the real price when Section 203 requirements apply.

Operating models: hosted, in your network, on premises

Besides the SaaS question there is a second one: where should the platform run, and where the models? The providers cover different levels:

For health data the last level is often the only practical one: under Section 393 SGB V, cloud services for health and social data require a C5 attestation. A comparison of routes with your own hardware is in the article On-premises AI solutions 2026.

Selection checklist

Every provider should be able to answer these questions in writing:

1. Instance: does our organisation run in its own installation with its own database or in a shared application?
2. Subprocessors: which companies are listed in the DPA, with the group's seat and the place of processing?
3. Models: which models work without a US group, and can the others be blocked for individual groups?
4. Section 203: is there an agreement with the four mandatory elements, from which plan, and does it extend to the model provider?
5. Trial: does the agreement already apply in the trial, or should you test only with non-critical data?
6. Cost: what does our number of users cost in the plan with Section 203 and SSO, monthly and annually?
7. Network: can the platform be restricted to your own network or VPN?
8. Exit: how is data deleted or handed over when the contract ends, and in which format?

Common misconceptions

"Servers in Germany means no US provider." Most platforms store data in Germany but run GPT, Claude and Gemini via Microsoft, Google, AWS or OpenAI. What matters is the subprocessor list, not the storage location.

"GDPR compliance is a property of the platform." The platform provides building blocks such as a DPA, storage location and permission management. Whether the use is GDPR compliant depends on your organisation's data, purpose and legal basis.

"A DPA is enough for client data." Professional secrets additionally require the commitment under Section 203 StGB and professional law, in text form and including all subcontractors.

"Multi-tenant is the same as a dedicated instance." A logically separated database for all customers is not your own installation. The difference shows in updates, misconfigurations, network restrictions and deletion.

"More models are better." Every additional model brings another provider into the data path. For most tasks a few good models, cleanly covered by contract, are enough.

Status and methodology

• Status: 14 October 2026. Prices, models and contracts change frequently; the provider's own page is authoritative.
• Selection: platforms for teams (chat, knowledge bases, assistants) from companies based in Germany (GmbH or AG), plus WZ-IT. Not included: Zive, because it has belonged to Docebo since April 2026 and is no longer offered as a standalone product, and 506.ai, because the company is based in Linz (Austria).
• Sources: only the providers' own pages: pricing pages and calculators, imprint, DPAs and subprocessor lists, trust centres, documentation. Where statements conflict, the more binding source applies (DPA over marketing page).
• Prices: net, monthly payment, list price without discounts. At Langdock the pricing calculator shows EUR 29.00 (EUR 22 plus EUR 7 for models); some page texts still mention EUR 25.
• Not assessed: answer quality and usability. The features are very similar and are better checked in a trial than in a table.
• Transparency: WZ-IT is the provider of the WZ-IT AI platform. Please report errors or changed information to us and we will update the table.

Our approach at WZ-IT

The WZ-IT AI platform is built for organisations where compliance and data storage are decisive:

• No shared SaaS: every organisation gets its own instance on its own domain, with its own database, knowledge bases and groups.
• Models operated in Germany by German providers: gpt-oss-120b, Qwen and Ministral run with a German AI hosting provider in Germany, without US providers and without training on inputs.
• Contract chain: DPA with technical and organisational measures and Section 203 supplementary agreement from the smallest package, the same supplementary agreement with data centre and AI hosting.
• Operation on your terms: hosted in Germany, on request reachable only from your network or via VPN, on an App Node on premises or with local models on the AI Cube.
• Interface: Open WebUI with web search, knowledge bases, assistants, dictation and SSO, package prices per organisation instead of per licence.

Law firms, tax advisors, notaries and audit firms have their own pages with the professional law details, for example AI for lawyers and AI for tax advisors.

Further guides

• Local AI or ChatGPT Business? Costs, control and use compared
• On-premises AI solutions 2026: six routes for businesses compared
• Local AI for law firms: Section 43e BRAO, Section 203 StGB and the RAG route
• Open WebUI licence 2026: what the branding clause means for businesses
• What is Section 203 hosting?
• WZ-IT AI platform: your own instance, models operated in Germany by German providers

Your own instance instead of a shared platform, Section 203 from the smallest package? Test the WZ-IT AI platform free for 7 days with non-critical data and clarify number of users, sign-in and operating model in an initial consultation. Book a call

Sources

• Langdock: pricing and calculator
• Langdock: security and deployment types
• Langdock: documentation on pricing and deployment
• Langdock: legal documents and professional secrecy addendum
• Langdock: data processing agreement
• Logicc: pricing
• Logicc: security
• Logicc: agreements under Section 203 StGB
• Logicc: data processing agreement with subprocessors
• meinGPT: pricing
• meinGPT: security
• meinGPT: data processing agreement v2.0.1
• nele.ai: pricing
• nele.ai: data processing agreement
• innoGPT: pricing and Section 203 licence
• innoGPT: data protection and security
• innoGPT: trust centre
• DeutschlandGPT: pricing
• DeutschlandGPT: trust centre
• DeutschlandGPT: solution for professional secrecy holders
• kamium: pricing
• kamium: comparison with Langdock (instance model)
• innFactory: CompanyGPT
• Alan: pricing
• Alan: platform privacy notice
• plusserver: plusKI
• plusserver: subcontractor list
• Docebo: Zive is part of Docebo
• Section 203 StGB: violation of private secrets
• Section 43e BRAO: use of services
• Section 62a StBerG: use of services
• 18 U.S. Code § 2713 (CLOUD Act)
• Microsoft: privacy and EU Data Boundary in Microsoft 365 Copilot