AI chatbots from Germany: four questions before buying

The company address answers only the first question

An AI chatbot from Germany needs a traceable data flow. The important details are your contractual partner, the model operator, processing locations and the rules for storage and training. Together, these establish whether an offer meets your business requirements.

Our recommendation: Ask two suppliers to answer the same four questions in writing before testing with customer data. Request the contractual documents and settings that apply to your proposed service. A general statement on a marketing page is insufficient.

For a public website, the first trial can use approved product information and fictional enquiries. Our comparison of a website chatbot and a contact form covers whether you need a bot at all. This article addresses the next decision: checking suppliers once the intended use is clear.

The model developer and operator can be different businesses

The model name does not identify every data recipient. A business can operate another company’s model itself or forward requests to an external model service. Buyers need to establish which arrangement the proposed chatbot actually uses.

IONOS AI Model Hub provides an example: According to its documentation, IONOS operates third-party model weights, the learned parameters, itself in Germany. Developers receive neither prompts nor responses.

Microsoft makes a similar distinction for Models sold by Azure: The models run in Azure, and the documentation says model providers cannot access the inputs or outputs. That statement covers the specified product group, rather than every model in the wider catalogue.

Ask for the product name, operating arrangement and contractual partner. A German flag will not review the contract for you.

Storage and processing locations need separate entries

The storage location describes only part of the data flow. Generating a response, known as inference, can follow different location rules from storing uploaded files. The chatbot supplier’s application and connected services also need to be covered.

Microsoft’s documentation illustrates the distinction: Global deployments can process prompts and responses in other geographies while stored data remains in the designated geography. A German resource location therefore does not establish that all processing takes place in Germany.

Ask the supplier to complete three separate entries: where chat histories are stored, where responses are generated and which countries may provide support access. Request the exact deployment type as well. A phrase such as “European cloud” leaves these questions unanswered.

Our selection rule is straightforward. If your business requires Germany-only processing, the commitment must cover the entire proposed workflow. An unanswered requirement stays open; it does not become an approval and cannot be offset by a lower price.

Excluding training still leaves storage to be checked

A training exclusion answers a separate question. It states whether inputs may be used to improve models. Chat histories, uploaded documents, logs and deletion periods still need their own explanation.

According to IONOS, AI Model Hub does not persistently store prompt or response content or use it for training; metadata is recorded. If a chatbot application in front of it saves conversations, that storage needs a separate check.

The German Data Protection Conference discusses training, input history and deletion separately. For procurement, we would therefore request a list of every storage location, identifying its purpose, access arrangements and deletion rule.

A useful answer includes the setting for your proposed plan and the corresponding contract wording. “We do not train on your data” alone does not explain who might read a conversation later.

Four questions make supplier answers comparable

This enquiry gives the comparison a consistent structure. Copy the introduction and four questions below into your message, changing only the intended use and permitted data.

“We are planning a website chatbot to answer questions about our published services. Our initial trial will use fictional enquiries. Please answer the following questions for the specific plan and configuration you are offering, with links to the relevant contractual documents.”

• 1. Who operates which language model? Please identify the model, operator, contractual partner and every external service to which requests are actually transmitted.
• 2. Where is content processed and stored? Please distinguish response generation, chat histories, uploaded files, logs and possible support access by country, and identify the deployment type.
• 3. Which subprocessors receive which data? Please provide the current list, the data processing agreement where applicable, and the arrangements for subsequent supplier changes.
• 4. Is content used for training or product improvement? Which settings exclude those uses, what retention periods apply, and how is content deleted, including additional copies?

Two fictional offers show the practical difference

A comparison needs evidence for each mandatory requirement. The completed example below is fictional and does not describe real suppliers. Business A requires processing in Germany, exclusion from training and documented deletion for its website trial.

The North offer says only “German supplier, secure cloud”. The South offer includes a data-flow description, contractual annexes and the proposed settings. This is how we would organise the initial review:

• Model and operator: North leaves them open; South identifies both and links them to the offer.
• Processing and storage in Germany: North leaves them open; South documents the model service and chatbot application.
• Subprocessors: North provides no list; South supplies a current list with responsibilities and countries.
• Training: North provides a general marketing statement; South documents the exclusion for the proposed plan.
• Deletion: North leaves it open; South identifies retention periods and a responsible contact.
• Decision: Send North a follow-up question; move South to functional and data-protection review. Complete documentation does not itself authorise deployment.

The initial document review costs €150 in our example

The review needs its own time budget. Our example assumes 45 minutes to read each supplier’s documents, another 60 minutes to compare them and an internal hourly rate of €60. The calculation is (2 × 45 + 60) ÷ 60 = 2.5 hours, followed by 2.5 × €60 = €150.

These assumed figures cover only the initial screening. Follow-up questions, contract review, configuration and technical testing may require additional time. These are neither measured project results nor Thümmler AI prices.

For one chatbot, we would start with two offers and make one targeted request for each missing mandatory detail. If the data flow remains unclear, testing with real customer data stays on hold. Our guide to business chatbot pricing models provides a separate comparison of usage charges. This keeps procurement effort distinct from the ongoing service cost.

Three answers lead to the next decision

The business must decide for its particular use case. Three questions often remain after the shortlist is prepared:

Is a German supplier automatically GDPR-compliant? No. The German Data Protection Conference identifies requirements including a defined purpose, an appropriate legal basis and clear responsibilities; a processor relationship also requires the relevant agreement. This procurement check does not replace legal review of the specific deployment.

Can the bot start with public information only? That is our preferred starting point. Also use fictional test questions, limit input fields and decide how accidentally submitted personal information will be handled. Public reference material does not prevent visitors from entering such information.

What if neither supplier explains the data flow adequately? Keep the existing contact route or choose a more narrowly scoped solution. Locally operated AI can be an alternative for internal tasks, but requires someone to maintain it.

Next step: Add your intended use to the enquiry and send the four questions to two suppliers. For the implementation planning that follows, see our chatbot and business AI services.