I recently landed my first client for a voice agent for a DTC brand based in Europe, and I'm concerned about GDPR/EU AI law compliance. Should I build the agent inside her own system so the data stays secured there, or what do you suggest?
I build all my flows on the client's own system — get set up on their n8n, their Make.com, their servers, and have them give you the credentials rather than building on your own accounts. That way, you avoid needing to hand things off if they ever stop working with you, and any liability sits with the client since everything is domiciled on their infrastructure.