- Deployment
- on-prem
- Hq Country
- United States
- Hq City
- San Francisco
- Ownership
- private
- Founded
- 2023
- Training Default
- opt-out-clear
- Residency Options
- customer VPC, on-premises data centre, air-gapped environments
- Gov Access Exposure
- none-eu
- Eu Ai Act Role
- gpai
- DPA available
- yes
- Self Host Option
- Yes
- Retention Default
- No product-level retention window is published. The DPA sets duration of processing as "as long as required (i) to provide the Product to Customer under the Agreement; (ii) for Poolside's legitimate business needs; or (iii) by applicable law" — which is the standard controller-side formula, not a statement about code.
- Retention Exceptions
- The privacy policy's only training statement is that collected personal data is used for purposes that include "training our machine learning models (unless you opt-out)". Nothing published says Poolside will not train on customer source code. In a self-managed deployment inference runs on the customer's own infrastructure, so the practical exposure is small — but the commitment is missing, and missing evidence scores zero here.
- Subprocessors
- not published — the DPA defines an "Authorized Subprocessor" approval mechanism but no roster accompanies it
- Subprocessor Count
- 0
- Transfer Mechanism
- sccs
- Eu Procurement Ready
- conditional
- Eu Procurement Reason
- Poolside sells deployment control as the product — you run model inference in your own VPC, data centre or air-gapped environment, against foundation models Poolside trained itself rather than brokered. That earns it the architecture points. What it does not sell is disclosure, and the gap is oddly specific. There is a real DPA with EU Standard Contractual Clauses properly incorporated and Poolside, Inc. of San Francisco named as data importer — so someone did the legal work — and yet the security page 404s, no certification is claimed anywhere, no sub-processor list accompanies the DPA's approval mechanism, and the only sentence about model training in the entire published estate is a privacy-policy clause saying personal data may be used for training unless you opt out. For a vendor whose pitch is that your code never leaves your perimeter, the absence of a written "we do not train on your code" is the thing to fix, and the thing to ask for in procurement.
- Training Claim Basis
- stated
- Training Confidence
- medium
- Residency Claim Basis
- stated
- Residency Confidence
- high
- Retention Claim Basis
- stated
- Retention Confidence
- medium
- Residency Class
- customer-controlled
- Portability / Exit Path
- proprietary-only
- Subprocessor Jurisdiction
- undisclosed
- Underlying model providers
- Poolside (own foundation models, Laguna family)
