Dify
Dify · Agent platform · SG · dify.ai
services/dify.yamlVendor data-handling terms
“We do not train AI models ourselves, and we will not use your AI interaction data for model training. / Whether such data is used for model training depends on the agreement between you and that provider, and we bear no responsibility for such use.”
“We retain personal information for as long as necessary for the purposes for which the personal information is processed and for longer periods as necessary for us to comply with applicable laws.”
“The information collected through our website and our products may be stored and processed in any country/region where LangGenius or its affiliated companies or service providers maintain facilities, including your region, the United States, Australia, Canada, China, and the European Economic Area and the United Kingdom.”
Domains and endpoints
observed means seen in Unseen deployments; vendor-documented means listed by the vendor. Vendors do not publish complete lists.
| Host | Role | Source |
|---|---|---|
| api.dify.ai | api | observed |
| dify.ai | app | observed |
Assessment
Reasoning: An LLM application builder whose cloud edition passes prompts to whichever model provider the builder connects, under that provider's terms. Dify's own no-training statement is clear; the storage region list includes China, which for an EU deployer is a transfer without an adequacy decision. Self-hosted deployments keep data on the organisation's own infrastructure and are outside these terms.
Flags: GDPR Chapter V (possible storage in China and the US) · Provider-dependent training terms · Assessed 2026-09-16. The assessment is Unseen's; the terms above are the vendor's.
Changelog
- 2026-09-16Documented. Training, retention, and storage-region terms verified against the Dify privacy policy.
- 2026-09-15Listed from the Unseen catalogue with observed domains.
Corrections
Pull request on GitHub, or the form below. Changes are reviewed and recorded in the changelog.