GDPR check

Is Rayyan GDPR compliant? What universities should check

Rayyan is one of the most widely used tools for screening studies in systematic reviews, with a free tier that many students start on. This page sets out what Rayyan publicly documents about hosting, contracts, subprocessors, transfers and its ResearchPilot AI features, and what that means for a university.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Rayyan Systems, Inc. is a US company in Cambridge, Massachusetts. Its trust centre says all customer data is hosted on Amazon Web Services in the US Northeast, with OpenAI models running on Microsoft Azure in the same region. A GDPR data processing addendum with the 2021 Standard Contractual Clauses is built into the terms, and DataRep in Ireland is its EU and UK representative. Rayyan was not on the Data Privacy Framework list when we checked. Its ResearchPilot AI features are limited to institutional plans, while all plans include a classic relevance-rating classifier. SOC 2 and ISO 27001 are documented as engagements rather than completed certificates.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers systematic review screening with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Rayyan documents publicly

Everything in this table comes from Rayyan's own pages or the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Topic	What the vendor states	Source
Company and establishment	Rayyan Systems, Inc., a Delaware corporation at 1 Broadway, Cambridge, MA. EU and UK representative: DataRep (Dublin and London). Rayyan is controller for account data and processor for User Content uploaded by users. Privacy policy last revised 15 September 2023; terms 6 February 2025.	[1] [2] [3]
Where data is stored	US hosting AWS, "Northeast Region (US)", is the "main cloud provider hosting production code and all customer data". The enterprise page lists "data retention, portability and residency" for Enterprise. An EU storage region was not found in public documentation (checked 7 October 2026).	[3] [4]
Data processing agreement	Documented Annex A of the terms, a GDPR Data Processing Addendum, applies where Rayyan processes personal data in User Content within the scope of the GDPR. On termination, Rayyan returns or deletes personal data at the customer's choice.	[2]
Subprocessors	Documented Public list of 13: AWS and Microsoft Azure (US Northeast), OpenAI (text embeddings for customer uploaded data), LangSmith (tracing LLM interactions "to optimize our prompts and models"), New Relic, Mixpanel, Google Analytics, Redis, Sentry, Zendesk, Zoho, Pusher and Apollo. The DPA gives customers ten business days to object to a new subprocessor.	[2] [3]
International transfers	SCCs The DPA incorporates the 2021 Standard Contractual Clauses (Module 2, controller to processor), with Irish law and courts. Rayyan Systems did not appear on the official DPF list (active or inactive) when searched on 7 October 2026.	[2] [5]
AI features	Plan-dependent All plans: relevance ratings from a support vector machine trained on the review team's own include and exclude decisions. Institutional plans with ResearchPilot enabled: AI Reviewer (blind second screener), AI Analyzer, Auto Extraction from full-text PDFs and Q&A over the review. Rayyan says ResearchPilot "never overrides your decisions".	[6] [7] [8]
AI training on customer content	Not found publicly A statement on whether Rayyan or its AI providers use customer content to train models was not found (checked 7 October 2026). LangSmith tracing is described as being used to optimise prompts and models.	[3]
Retention and deletion	Account deletion is by support request after reviews and library files are removed, and data is permanently removed within 30 days of activation. The privacy policy keeps information "as long as necessary to provide the Services".	[1] [9]
Security and certifications	In progress Trust centre: HIPAA attestation (as of 8 May 2026), a SOC 2 Type II engagement letter confirming completion of the audit period, an engagement letter to pursue ISO 27001, SOC 2 and HIPAA, and a May 2026 penetration test. The enterprise page describes "SOC2 controls" and encryption in transit and at rest.	[3] [4]
Institution controls	Plan-dependent Institutional plans (Academic, Business, Enterprise) are licence-based and centrally managed. Enterprise adds SAML 2.0 and OAuth SSO with MFA, auto-provisioning, an admin console and transfer of review ownership when staff change.	[4] [8]

Rayyan deserves credit for a data processing addendum that is part of the standard terms rather than available only on request, a public subprocessor list with locations for its cloud providers, a named EU representative, a published penetration test summary, and AI features designed as decision support with the researcher kept as the final decision-maker.

What this means for a university

Validemic's analysis

What goes into Rayyan. Most content is bibliographic: titles, abstracts and author names. Full-text PDFs, notes and decisions are added later. Sensitive material appears less often, but reviews in health and social sciences can include unpublished reports or data from study authors.

The DPA is a good start. Because the addendum covers User Content and uses Module 2 of the SCCs, Rayyan can be a processor for a university's review content without a separate negotiation. A university should still check how the addendum fits with its own institutional agreement, and record the transfer impact assessment that the SCCs require under Chapter V GDPR [10].

Plan tier matters. Students on free individual accounts sign up under the standard terms, outside any institutional licence. Institutional plans bring central administration, SSO and ResearchPilot. Where a university wants AI screening only under conditions it has assessed, the licence configuration is the place to set that.

Ask about AI data flows. The subprocessor list is clear that customer uploaded data is embedded with OpenAI models on Azure and that LLM interactions are traced in LangSmith to optimise prompts and models. We did not find a written statement on training. For unpublished work, a university should get one in writing, together with the retention periods at OpenAI on Azure and at LangSmith.

Residency wording. The enterprise page mentions residency while the trust centre lists only US regions. That may mean different options for Enterprise contracts. Ask before assuming either.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Rayyan before approving it

Does the Annex A data processing addendum govern our institutional licence, or will a negotiated DPA replace it?
What does "residency" on the enterprise page mean in practice, and can our data be stored in the EU?
Do Rayyan, OpenAI on Azure or LangSmith use our review content to train or fine-tune models, and can this be excluded in writing?
How long do Azure OpenAI and LangSmith keep prompts, traces and embeddings?
Can administrators enable ResearchPilot for some departments and keep it off for others?
When will the SOC 2 Type II report and ISO 27001 certificate be available to customers?
How are subprocessor changes notified, since the DPA gives only ten business days to object?
The privacy policy dates from September 2023. Is a revision planned that reflects the AI features?

An EU-built option

Looking for a European tool for systematic review screening?

Kahubi is an AI research workspace built by Avidemic AB, a company registered in Sweden. Researchers use it to run searches across OpenAlex, screen studies against inclusion and exclusion criteria with every decision logged, and get PRISMA counts and a written review.

Runs on servers in the European Union, under EU law end to end
Your papers, data and recordings are never used to train AI models
For institutional customers, every subprocessor is a European company processing data in the EU

Explore Kahubi See Kahubi's subprocessors

Disclosure: Kahubi and Validemic are both built by Avidemic AB. Assess any tool, ours included, against your own institution's requirements.

The EU AI Act angle

AI screening for a research review is not among the education uses listed as high-risk in Annex III of the AI Act, Regulation (EU) 2024/1689 [11]. The obligation that applies today is AI literacy: Article 4, as amended by Regulation (EU) 2026/1744, requires deployers to take measures to support the AI literacy of staff using AI systems [12]. For reviews, that means researchers should understand how AI Reviewer reaches decisions and report its use in the methods section. Annex III obligations apply from 2 December 2027 [13]. They would become relevant only if a tool like this were used to evaluate students' learning outcomes, for example to mark a review assignment.

Sources

Rayyan Privacy Policy, last revised 15 September 2023, retrieved 7 October 2026
Rayyan Terms of Service (including Annex A, GDPR Data Processing Addendum), last revised 6 February 2025, retrieved 7 October 2026
Rayyan Trust Center (overview, resources and subprocessors pages), retrieved 7 October 2026
Rayyan Enterprise, retrieved 7 October 2026
Data Privacy Framework List, searched for "Rayyan" (active and inactive participants), retrieved 7 October 2026
What is ResearchPilot?, Rayyan Help Center, retrieved 7 October 2026
How to Use Ratings and Relevance Ranking in Rayyan, Rayyan Help Center, retrieved 7 October 2026
Rayyan Plans Overview, Rayyan Help Center, retrieved 7 October 2026
How to Deactivate or Delete Your Account, Rayyan Help Center, retrieved 7 October 2026
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 28 and 44 to 49, retrieved 7 October 2026
AI Act Annex III: High-risk AI systems, AI Act Service Desk, retrieved 7 October 2026
AI Act Article 4: AI literacy (as amended), AI Act Service Desk, retrieved 7 October 2026
AI Act Article 113: Entry into force and application (as amended), AI Act Service Desk, retrieved 7 October 2026

About this page

We read Rayyan's privacy policy, terms and data processing addendum, trust centre, enterprise page and help centre on 7 October 2026, and searched the official Data Privacy Framework list on the same day. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it. Plans, terms and features change, so confirm the current position with Rayyan before relying on it.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Rayyan and see an error, please contact us and we will correct it.

Frequently asked questions

Is Rayyan GDPR compliant?

No tool is GDPR compliant on its own. Rayyan incorporates a GDPR data processing addendum with the 2021 Standard Contractual Clauses into its terms, appoints an EU and UK representative and publishes a subprocessor list. Whether a university's use complies depends on its plan, its contract and how AI features are used.

Where does Rayyan store data?

Rayyan's trust centre lists Amazon Web Services in a US Northeast region as the main cloud provider hosting all customer data, and Microsoft Azure in the same region for OpenAI deployments. Its enterprise page mentions data residency, but an EU storage option was not found in public documentation (checked 7 October 2026).

Does Rayyan's AI send my data to OpenAI?

Rayyan's subprocessor list says OpenAI models are deployed on Microsoft Azure AI Foundry and that OpenAI is used to generate text embeddings for customer uploaded data. LangSmith is listed for tracing customer interactions with LLMs. ResearchPilot AI features beyond Help Center Mode are available only on institutional plans where ResearchPilot is enabled.

Is Rayyan on the EU-US Data Privacy Framework?

We did not find Rayyan Systems on the official Data Privacy Framework list on 7 October 2026. Its data processing addendum relies on the EU Standard Contractual Clauses (Module 2, controller to processor) for transfers.

Does Rayyan have SOC 2 or ISO 27001?

Rayyan's trust centre lists a HIPAA attestation, a SOC 2 Type II engagement letter and a letter confirming the start of engagement to pursue ISO 27001, SOC 2 and HIPAA. A completed SOC 2 Type II report or ISO 27001 certificate was not listed when we checked on 7 October 2026.