Ten questions to ask before you send personal data to JEV. Processor roles, cross-border transfer rules under GDPR and Turkey's KVKK, and the gaps in TypeSafe's public documentation.
TypeSafe AI's JEV model does not generate text. It makes decisions. This does not change anything for compliance. To make a decision, JEV reads the input. If the input contains personal data, the company that provides JEV becomes a party that processes personal data on your behalf. This article gives the questions your compliance team must ask before you send data to JEV.
Legal Notice
This article gives general information. It is not legal advice. Laws change. Confirm the current texts with your legal team before you act.
Why JEV Needs a Separate Assessment
JEV accepts text input: strings, JSON objects, and text arrays. For tasks such as classification, routing, and scoring, this input is often real business data. Examples: customer records, support ticket text, and transaction descriptions.
TypeSafe states that its service is hosted on the US West Coast. The product is in early access. Together, these two facts raise questions about cross-border transfer and vendor assurance.
Information Missing from the Public Documentation
On 20 September 2026, the Moftgate team reviewed the TypeSafe documentation introduction and System One concept pages. These pages do not give information about data retention periods, training on customer data, compliance certifications, or data center regions. This information can be on another page. Do not make assumptions about these topics without a written contract or a written vendor response.
Three Core Questions
- Is the data personal data? If it contains a name, national ID, email, phone number, or any information that indirectly identifies a person, yes.
- What are the roles? In most cases you are the controller and TypeSafe is the processor. The contract defines the roles. Do not assume.
- Does the data leave your country or region? Because the service is hosted in the US, most likely yes. Cross-border transfer rules then apply.
GDPR and KVKK: Which Obligation Applies Where?
| Topic | GDPR | Turkey KVKK |
|---|---|---|
| Transparency | Articles 13 and 14 | Article 10 |
| Processor relationship | Article 28 (processor contract) | Article 12 (security and processor responsibility) |
| Cross-border transfer | Articles 44 to 49 (Chapter V) | Article 9 |
| Risk assessment | Article 35 (DPIA for high-risk processing) | Internal risk analysis recommended |
| Automated decisions | Article 22: right not to be subject to solely automated decisions | Article 11, item (g): right to object to results of automated analysis |
For transfers out of the EU to the US, ask which transfer mechanism the vendor relies on. Get this answer in writing. For Turkey, KVKK Article 9 requires conditions such as an adequacy decision or appropriate safeguards. This section changed in recent years. Confirm the current conditions and notification periods with your legal team.
10 Questions to Ask TypeSafe
- In which regions do you process and store the data I send?
- How long do you keep inputs and outputs? Can I turn retention off?
- Do you use customer data for model training or evaluation?
- Do you offer a data processing agreement (DPA)?
- Who are your sub-processors and where are they located?
- Which legal mechanism do you use for cross-border transfers?
- Do you hold SOC 2, ISO 27001, or a similar certification?
- How quickly do you notify customers of a data breach?
- How does data deletion on request work?
- Will these terms change when the product leaves early access?
What to Do Until You Get Answers
- Do not send personal data to JEV. Use anonymous or synthetic data for tests.
- Find out who is testing JEV. Log the tests.
- Put the approval process in writing: purpose, data type, responsible person, legal approval.
- Even for approved use, block or mask sensitive data before it is sent.
Moftgate supports these steps at the endpoint level. The agent detects connections to JEV services. It blocks the connection, shows a warning, or logs it, depending on the policy. AI DLP stops or masks data such as national ID numbers, credit card numbers, and API keys. Audit logs help you answer the question "who sent what data and when" during GDPR and KVKK audits.
Strategic Takeaway
JEV itself is not a compliance problem. The problem is unapproved and unrecorded use. Get vendor answers in writing, do not send personal data before approval, and keep usage visible.
Research team specializing in enterprise LLM security, AI governance, and model-level data loss prevention.
Expert Answers to Core Practitioner Questions
Is sending personal data to JEV a GDPR violation?
Not automatically. But you must have a legal basis, transparency, a processor contract, and valid transfer conditions. Sending data without these conditions is risky.
If JEV does not generate text, do I still process personal data?
Yes. Sending personal data to a service is processing, regardless of the output type of the service.
Does TypeSafe train models on customer data?
The public documentation pages we reviewed do not give information on this. Ask TypeSafe in writing and confirm it in the contract.
Do I need a contract for a product in early access?
If you will send personal data, yes. Early-access status does not remove data protection obligations.
Can Moftgate stop personal data from going to JEV?
Yes. AI DLP detects sensitive data at the moment of sending and blocks or masks it based on policy. Each event is written to the audit log.
Authoritative Sources & Regulatory Standards
- •TypeSafe AI Docs: System One ↗(Input types and model description)
- •TypeSafe AI: Introducing System One Models & Jev ↗(Service location and early-access status)
- •
- •Turkish Personal Data Protection Authority (KVKK) ↗(Current legislation and board decisions)
- •