Back to Tools
P

Profound

Partially Compliant

US enterprise AI visibility analytics platform. Not European: data is processed in the United States under Standard Contractual Clauses.

Non-EU · United States

Subject to the US CLOUD Act: a US parent company can be compelled to disclose data it holds, including data stored in the EU.

Paidfrom $99/mo
Profound website screenshot

GDPR Compliance Data

Not independently verified
GDPR Status
Partially Compliant
HQ CountryUnited States
OwnershipNon-European
Foreign Disclosure ExposureUS CLOUD Act / FISA 702
Data Hosting Location
United StatesAnnex III lists every sub-processor as processing in the United States, with one exception listed as "United States, Germany"; infrastructure is AWS and Google Cloud.
EU Servers Available
Data Processing AgreementView DPA
Sub-processor ListNot verified
Schrems II Risk
Medium Risk
SCCs in Place
Last Verified11 August 2026
NotesUS company. Read from its own DPA at tryprofound.com/legal/data-processing-agreement: all Annex III sub-processors process in the United States except Pylon Labs, Inc. ("United States, Germany"); infrastructure is AWS and Google Cloud operating primarily from the US; EU transfers use Module 2 (Controller-to-Processor) SCCs under Irish governing law, with the UK Addendum for UK transfers. The sub-processor list is embedded in Annex III rather than published separately. The DPA does not name the legal entity or its state of incorporation.

About Profound

The American Benchmark in GEO

Profound is the best-funded platform in AI visibility analytics and the one most European teams end up comparing others against. It sits at the enterprise end: prompt-volume data on what users actually ask AI assistants, and analytics on how AI crawlers read a site.

It is listed here because European buyers evaluate it, not because it meets the criteria the rest of this directory is built around. It does not.

Where the Data Goes

Profound's own Data Processing Agreement is unusually clear, and worth reading before you buy:

  • Every sub-processor in Annex III processes data in the United States, with a single exception listed as "United States, Germany"
  • Infrastructure runs on AWS and Google Cloud, operating primarily from the US
  • EU transfers rely on Module 2 (Controller-to-Processor) Standard Contractual Clauses, governed by Irish law, with the UK Addendum for UK transfers

That is a properly documented arrangement. It is also, unambiguously, US data processing with SCCs as the safeguard, which means US disclosure law reaches it in a way that no contractual clause overrides. Read the Schrems II checklist if that matters for your data.

If EU Residency Is a Requirement

It is not the tool for you, and the honest answer is to look at the European GEO platforms instead: Rankscale covers more engines, Peec AI is Berlin-registered, and Otterly.AI hosts its platform in Frankfurt. If it does not, Profound's depth is real and the DPA is one of the clearer ones in this category.

Key Features

Prompt-volume data on what users ask AI assistants
Agent analytics on how AI crawlers read a site
Coverage of ChatGPT and Perplexity, with 10+ engines on Enterprise
Enterprise-grade reporting and integrations

Pros & Cons

The deepest dataset in the category
Unusually clear DPA that names sub-processors and transfer mechanism
Standard Contractual Clauses in place for EU transfers
US company with US data processing — no EU residency option documented
US CLOUD Act reaches the data regardless of the SCCs
Enterprise pricing; the lower tiers cover fewer engines

Categories

Profound GDPR & data protection: common questions

Is Profound GDPR compliant?

Partly. Profound meets some of the requirements, with caveats worth reading before you commit. Profound is based in United States, outside the EU/EEA, data is hosted in the United States, and a Data Processing Agreement is published.

Where does Profound store data?

Profound states: "Annex III lists every sub-processor as processing in the United States, with one exception listed as "United States, Germany"; infrastructure is AWS and Google Cloud.". Data is hosted in the United States.

Does Profound offer a Data Processing Agreement (DPA)?

Yes. Profound publishes a DPA at https://www.tryprofound.com/legal/data-processing-agreement. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.

What a DPA has to cover

Is Profound a European company?

No. Profound is based in United States, outside the EU/EEA. It may still be a sound choice (EU hosting and a signed DPA matter more than a flag) but the ownership is not European.

Is Profound subject to the US CLOUD Act?

Yes. US authorities can compel disclosure of data held by a US company or its subsidiaries, regardless of the country the servers sit in. EU hosting alone does not remove this, the question is who controls the data, not where the disk is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.

Schrems II compliance checklist

Spot an error in the compliance data? Get in touch