# Rasa Platform ## Kurzbeschreibung **"Trustworthy, scalable AI agents."** **Rasa **is a platform for AI chatbots, voicebots, and service automation. It is aimed at companies that want to integrate dialog-based assistants into their own systems, CRM, contact center, and communication channels in a controlled manner. ## Claim Trustworthy, scalable AI agents. ## Geeignet für - API Integration - Audio / Voice - Automation / Workflows - Customer Service & Chatbots - Programming / Software Development - Knowledge Management / Internal Search ## Kernfunktionen - API Integration - Automation - Chatbot - AI agents - Customer Support - Lead generation - Voice assistant - Telephone Assistant - Scheduling ## Preismodell - **free:** **Developer Edition** Free local or production use for one bot with limited conversation volume and community support. - **other:** **Enterprise** Scalable agent platform for production chat, voice, and service automation with enterprise support and custom deployment requirements. **Professional Services** Consulting, implementation, architecture, agent design, and long-term support from Rasa. **Self-Hosted Deployment** Operation in your own cloud, private cloud, on-premises, or air-gapped environment. ** Own model providers** Combination with self-hosted or external LLMs, speech, and integration services. ## DSGVO und Datenschutz **Gesamteinschätzung:** Yes **On-Prem / local hosting: covered** Clearly documented on the website. Rasa mentions on-premise, own infrastructure, fully offline or air-gapped deployments, and documents self-hosted installation of Rasa Studio with Docker Compose or Helm. **Private cloud / data center: covered** Clearly documented on the website. Rasa states that the entire stack can be hosted in a private cloud or on infrastructure of the customer's choice and promotes deployment 'in your cloud'. **EU SaaS / managed: partially** There are references to 'fully managed' or managed service, but on the website there is no specifically named EU/EEA hosting location and no clearly stated EU data residency for a standard SaaS variant. Therefore only partially covered. **Hybrid: partially** A hybrid path is indirectly indicated because Rasa describes both self-hosted/private-cloud and services/managed offerings, and the products can integrate with third-party services. However, an explicit product page that describes a standardized hybrid operating model in detail was not clearly found on the website. **DPA / AVV: covered** Covered by the published DPA/AVV. In it, Rasa commits to processing based on documented customer instructions, regulates subprocessors, restricted transfers, as well as return/deletion of data after the end of the contract. **No training: unclear** A clear statement on the website that prompts, uploads, chat histories, or outputs are generally not used to train general models was not found. Although the DPA prohibits the marketing/sale/resale of personal data, it is not a clear general 'no AI training' clause. **Open-source / transparency path: covered** Rasa explicitly refers to open-source software; the Product Privacy mentions 'Rasa Open Source Software', and the FAQ says that 'Rasa Open Source' is licensed under Apache 2.0. Together with self-hosting, this creates a clear transparency/sovereignty path. **Data processing** The website describes Rasa strongly as a controllably deployable platform. For EU/EEA users, the most privacy-friendly path is self-hosting or operation in their own EU/EEA infrastructure or private cloud. Then data processing can remain within their own environment. If Rasa provides services, according to Product Privacy, Rasa may process personal data, for example for support or assistance with training within the customer's environment. In contractually regulated hosted/managed scenarios, the specific hosting location is only determined in the contract according to the website. **Conclusion** For a European directory, Rasa Platform is particularly strong because the provider offers a clearly documented path to high data sovereignty: **self-hosted, private cloud, on-premise and offline**. This argues for 'yes' regarding GDPR status when the best available path is evaluated. Less strongly documented, by contrast, are a publicly named EU data residency for managed/SaaS, a public subprocessor list, and an explicit website-side opt-out or exclusion for AI training. **Sources** - [https://rasa.com/dpa](https://rasa.com/dpa) - [https://rasa.com/product-privacy](https://rasa.com/product-privacy) - [https://rasa.com/privacy-policy](https://rasa.com/privacy-policy) - [https://rasa.com/security-at-rasa](https://rasa.com/security-at-rasa) - [https://rasa.com/legal](https://rasa.com/legal) - [https://rasa.com/docs/studio/installation/overview/](https://rasa.com/docs/studio/installation/overview/) - [https://info.rasa.com/faqs](https://info.rasa.com/faqs) - [https://rasa.com/product/managed-service/](https://rasa.com/product/managed-service/) - [https://rasa.com/](https://rasa.com/) Rasa Platform can be assessed as usable for the EU/EEA region **in the best available usage path** in a GDPR-compliant manner, because Rasa provides a DPA/AVV and, according to its own website, the platform can be self-hosted or deployed in customer-owned infrastructure, private cloud, on-premise, and even in fully offline-operated environments. This provides a straightforward way to keep processing entirely within your own EU/EEA infrastructure. However, for the services provided by Rasa itself, the documentation remains partly unclear or only contractually regulated regarding server locations, EU data residency, and subprocessors. **Positive** Positive aspects are the published DPA/AVV, the explicit classification under GDPR, the commitment to process only on documented customer instructions, and the strong self-hosting/private-cloud focus. The product privacy policy also states that the products can be privately hosted by customers and that Rasa generally does not process personal data as part of the products. The website also mentions self-hosted deployment for Rasa Studio and promotes deployment in your own infrastructure, private cloud, on-premise, and even offline. **Negative** Negative or limiting is that the website states **no specific EU/EEA server location** for a managed SaaS or hosting option. The DPA only says that customer data is hosted in the location specified in the agreement. In addition, the subprocessor list is not openly published on the website, but is only provided 'upon written request'. A clear, general statement on the website that customer data is not used to train general models was also not found. **Server location** No specific server/data center location for Rasa Platform is stated on the website. The DPA only states that 'Customer Data is hosted in the location set forth in the Agreement'. Therefore, there is no publicly specified standard statement for EU/EEA data residency; however, through self-hosting/private cloud, the customer can determine the EU/EEA location themselves. ## Hosting und Daten - **On-Prem / lokales Hosting:** abgedeckt - **Private Cloud / Rechenzentrum:** abgedeckt - **EU SaaS / Managed:** teilweise / indirekt - **Hybrid:** teilweise / indirekt - **AVV / DPA:** abgedeckt - **Kein Training auf Kundendaten:** unknown - **Open-Source / Transparenz-Pfad:** abgedeckt ## Standort **Land:** Germany **Taxonomie:** Germany Germany / USA. Rasa operates a German GmbH and a US company. ## Vorteile - Self-hosting and high architectural control - Chat, voice, and service automation - API, CRM, and contact center integration - Open-source components and developer ecosystem - DPA available for enterprise use ## Nachteile - Not a plug-and-play chatbot for laypeople - Requires dialog design, integration, monitoring, and technical support - Data protection also depends on connected LLMs, speech services, and channels - Enterprise features are not fully included in the free Developer plan ## Quellen - Offizielle Website: https://rasa.com/ ## Letzter Datenstand 2026-06-29 ## Originalseite https://kifox.ai/en/ki-tools/rasa-platform-en/