# Dify

## Kurzbeschreibung
**"Build Production-Ready AI Agents."**


**Dify **is a platform for AI agents, RAG, visual workflows, chatbots, and no-code AI applications. Teams can develop, test, deploy, monitor, and integrate LLM apps into existing systems via APIs or plugins.

## Claim
Build Production-Ready AI Agent.

## Geeignet für
- API Integration
- Automation / Workflows
- Data Extraction / Document Analysis
- Customer Service & Chatbots
- Programming / Software Development
- Research
- Texts / Content
- Knowledge Management / Internal Search

## Kernfunktionen
- API Integration
- App Development
- Automation
- Chatbot
- Document analysis
- AI agents
- Research
- Text generation
- Knowledge Base

## Preismodell
- **free:** **Sandbox** Free cloud test environment with limited AI credits and core features.


**Community Edition** Open-source self-hosting with agents, workflows, RAG, APIs, and plugins.
- **subscription:** **Professional** Cloud workspace with extended usage scope, higher storage, logs, and team features.


**Team **Larger team workspace with more users, capacities, and advanced features.


**Enterprise** Customized infrastructure, security, support, and governance solution.
- **other:** **Dify Premium on AWS** One-click deployment as an AWS AMI in your own VPC with branding and enterprise options.


**Your own model providers** Direct connection of your own API keys for OpenAI, Anthropic, Google, local models, and additional providers.

## DSGVO und Datenschutz
**Gesamteinschätzung:** Yes

**On-Prem / local hosting: covered**

The website mentions self-hosted and describes enterprise deployment options as 'on-premise, public cloud, VPC'. This clearly documents a local or customer-controlled operating model.

**Private cloud / data center: covered**

The enterprise page lists 'public cloud' and 'VPC' as deployment options. This documents a distinct private-cloud / controlled infrastructure path for customers.

**EU SaaS / managed: partial**

A dedicated cloud service clearly exists. However, the privacy policy does not mention guaranteed EU data residency for the SaaS; instead, it names the USA, EEA, and China as possible processing locations, and website servers in the USA.

**Hybrid: partial**

An explicit hybrid offering is not clearly described. Due to the documented combinability of on-premise/public cloud/VPC and external cloud, a hybrid deployment is indirectly plausible, but not specifically defined on the website.

**DPA / DPA: covered**

The website refers multiple times to a 'Data Protection Agreement', and the compliance article mentions comprehensive data processing agreements as part of GDPR compliance.

**No training: unclear**

A clear statement that prompts, uploads, chats, or outputs are not used for training general models, or an explicit opt-out option for AI training, is not provided on the website.

**Open source / transparency path: covered**

Dify describes itself as fully open source and mentions a mixed AGPL+MIT licensing model. In addition, self-hosting and open components such as DifySandbox are documented, which provides a clear transparency / sovereignty path.

**Data processing**

For EU/EEA users, the main distinction is between SaaS and self/customer-controlled operation. The website shows that the standard SaaS does not provide pure EU data residency; according to the privacy policy, data may be processed or stored in the USA, EEA, and China, and the website servers are located in the USA. At the same time, Dify names reliable alternatives for enterprise and self-hosted use, such as on-premise, public cloud, and VPC. This makes more privacy-friendly EU/EEA usage possible if customers control the deployment themselves within EU/EEA infrastructure.

**Conclusion**

For a European directory, Dify is best categorized as **GDPR-compliant for use via self-hosting/on-premise or controlled enterprise deployments**. The website provides sufficient indications for this. By contrast, the standard SaaS is weaker from a data protection perspective because no clear EU data residency is guaranteed and US/third-country processing is explicitly mentioned.

**Sources**

- [https://dify.ai/privacy](https://dify.ai/privacy)
- [https://dify.ai/pricing](https://dify.ai/pricing)
- [https://dify.ai/blog/dify-achieves-soc-2-iso-27001-gdpr-compliance-for-the-second-year-running](https://dify.ai/blog/dify-achieves-soc-2-iso-27001-gdpr-compliance-for-the-second-year-running)
- [https://dify.ai/blog/dify-open-source](https://dify.ai/blog/dify-open-source)
- [https://dify.ai/blog/openai-assistants-api-vs-dify-self-hosting-flexible-ai-solutions](https://dify.ai/blog/openai-assistants-api-vs-dify-self-hosting-flexible-ai-solutions)
- [https://dify.ai/blog/dify-x-microsoft-azure-marketplace](https://dify.ai/blog/dify-x-microsoft-azure-marketplace)
- [https://dify.ai/jp/enterprise](https://dify.ai/jp/enterprise)

For the EU/EEA area, Dify can be assessed as usable in the **best available usage path** in a GDPR-compliant manner, because the website on the one hand mentions self-hosting or enterprise deployment in controlled environments and on the other hand describes data protection mechanisms on the SaaS/enterprise side such as Privacy Policy, SCC-based third-country transfers, as well as Data Processing Agreements. For the standard SaaS variant, however, the situation remains less ideal, because the Privacy Policy mentions US servers and also refers to processing in the USA, EEA, and China; therefore, the positive assessment is primarily sustainable via the self-hosted/on-premise or controlled deployment path.

**Positive**

Positive aspects are the GDPR compliance stated on the website, the reference to comprehensive Data Processing Agreements, the mention of Standard Contractual Clauses for transfers from the EEA/Switzerland to third countries not considered adequate, an EU representative in Ireland, as well as the clearly documented deployment options with 'on-premise, public cloud, VPC' and a self-hosted/open-source offering.

**Negative**

A negative aspect is that the standard Privacy Policy for cloud/website operation mentions US servers and also describes processing in the USA and China. A specific EU/EEA-exclusive server location for Dify SaaS, an explicit EU data residency commitment, a publicly discoverable subprocessor list, and a clearly findable statement on opting out of general AI training are not specified on the website.

**Server location**

The Privacy Policy states that website servers are located in the USA and that data may be processed or stored in regions where LangGenius, affiliated companies, or service providers have facilities, including the USA, Australia, Canada, China, and the EEA. A specific EU data center for the SaaS is not specified on the website.

## Hosting und Daten
- **On-Prem / lokales Hosting:** abgedeckt
- **Private Cloud / Rechenzentrum:** abgedeckt
- **EU SaaS / Managed:** teilweise / indirekt
- **Hybrid:** teilweise / indirekt
- **AVV / DPA:** abgedeckt
- **Kein Training auf Kundendaten:** unknown
- **Open-Source / Transparenz-Pfad:** abgedeckt

## Standort
**Land:** USA

**Taxonomie:** USA

LangGenius, Inc., 548 Market St, PMB 60083, San Francisco, CA 94104-5401, USA.

## Vorteile
- Visual agent and workflow builder
- RAG, knowledge pipelines, and document processing
- Cloud and self-hosting
- APIs, plugins, observability, and team features
- Community edition for your own infrastructure
- The provider’s statements regarding DPA, SOC 2, ISO 27001, and GDPR

## Nachteile
- Dify Cloud processes data globally depending on the region, including in the USA, EEA, UK, China, Australia, and Canada
- The Cloud Terms exclude sensitive personal data for certain uses
- External plugins and models can create additional data flows
- Production self-hosting instances require DevOps, security, and monitoring

## Quellen
- Offizielle Website: https://dify.ai/

## Letzter Datenstand
2026-06-29

## Originalseite
https://kifox.ai/en/ki-tools/dify-en/