Self-hosting AI customer service: a guide for specialty retail

What does it mean to self-host AI customer service?

Self-hosting means the software runs on your own infrastructure, on a server you control, rather than in a vendor's cloud. In customer service, that is not a technical footnote. It decides where your customers' data sits. A service inbox holds names, order numbers, addresses, and the occasional complaint. That is personal data, and you are the one responsible for it as a retailer.

With a self-hosted tool like Corresa, the software is installed on your side. The emails you receive, the drafts it produces, and the reporting all sit on your system and nowhere else. The software vendor runs no cloud that your customer correspondence passes through, and has no way into it. That is what sets the approach apart from classic SaaS, where every customer email travels across the vendor's servers.

Why self-host instead of subscribing to a cloud tool?

Most AI tools for customer service are pure cloud products. That is convenient, but it hands control over sensitive data to yet another company.

Self-hosting reverses that. You keep the responsibility where it already sits: with you. For your privacy policy, that means a shorter processing chain, clearer lines of responsibility, and easier access and deletion requests when a customer asks. You do not depend on a cloud vendor keeping its servers in the EU, maintaining its certifications, and leaving its contract terms unchanged.

People often confuse this with "EU hosting". A SaaS vendor can run its machines in Frankfurt too. Self-hosted means something different: the data never leaves your server toward a software vendor in the first place. We go into this in more detail in the self-hosted versus SaaS comparison.

But the customer email still goes to an AI model, doesn't it?

Yes. And this question is what decides whether a data-protection claim holds up. For Corresa to draft a reply, the text of the inquiry has to go to a language model. Anyone who tells you the data never leaves the building is not being straight with you at this point.

What is accurate is control in three layers. First, the software runs on your infrastructure; every stored email, draft, and report stays there. Second, the language model runs under your own contract with an AI provider of your choice. We recommend a European provider with a data processing agreement, no training on your data, and a short retention period, for example Mistral in Paris. So the inquiry goes to exactly one further system, and that system operates under a contract you hold yourself. Third, we as the maker of Corresa see nothing along this path: no cloud of ours, no access, no link between your customer emails and us.

A customer email therefore touches exactly two systems: yours and your AI provider's.

Isn't this the same as ChatGPT in the browser?

Plenty of teams get by today by pasting a customer email into a free AI tool and having it write a reply. It saves a moment now, but it is awkward under data-protection law. Personal customer data lands with a provider in an uncontrolled way, often with no data processing agreement and sometimes with training on the inputs. As the controller, you know neither where the data goes nor what happens to it afterward.

A self-hosted tool closes exactly that gap. The inquiry does not travel by copy and paste into some account. It goes on a governed path to exactly one provider you have a contract with. Your team works faster, and nobody tips customer data into a system that no one in the building controls.

What does "your own contract with the AI provider" mean?

Corresa brings no language model of its own and bills no AI usage. You supply an API key from the contract you have signed with an AI provider yourself. That has consequences for both cost and control.

Inference costs show up directly with your AI provider, with no markup from us and no per-case fee. You decide which model is used, and you can switch providers without switching away from Corresa. In the language of the GDPR, you are the controller, your AI provider is the processor, and the software maker sits outside that chain.

What do I have to handle myself for data protection?

A few things remain your job, and none of them is heavy. You add the use of AI to your privacy policy: purpose, legal basis, the AI provider as processor, and the retention period (Article 13 GDPR). You sign a data processing agreement with your AI provider; with an EU provider one is already in place and there is no transfer to a third country. And you record briefly that your team is trained in how to use the tool, which meets the AI literacy obligation under Article 4 of the EU AI Act.

Because a person makes the final call, there is no automated decision in an individual case of the kind Article 22 GDPR would govern. For all of this we supply templates at the start: a building block for your privacy policy, a checklist for the contract with your AI provider, and a training sheet for the team. Here too this is guidance and does not replace review by your data protection officer.

Where does the AI get its product information?

A common misconception is that the AI invents prices and stock levels. With Corresa it does not. For each inquiry, the system searches your connected online shop and pulls the matching product data: prices, sizes, stock, and descriptions. The AI does not work from memory. It works from your current data. For Shopware shops, this connection is part of the setup.

If the search finds no matching product, or a figure such as a firm delivery time is missing, the system invents nothing. It drops in a placeholder rather than guessing a number, and your staff fill in the rest. The review view shows what the AI searched for in the shop and what it found, so the difference between "looked up in the shop and confirmed" and "a reliable figure is missing here" stays visible in the draft instead of slipping through.

That noticeably lowers the risk of wrong information, and in advice-heavy retail it is exactly where a generic chatbot falls down. A wrongly promised size or delivery date here leads straight to returns and annoyed customers.

Does a human really check every reply?

Yes, and the software enforces it rather than merely recommending it. Every draft lands in the review view: the customer email on the left, the suggested reply on the right. A member of staff reads the text, edits it, and approves it. As long as a placeholder is still open, the send button stays locked. This cannot be switched off.

That makes the AI a drafting tool, not a chatbot that talks to your customers on its own. Responsibility for the substance stays with your team, and the writing time per reply still drops sharply. Why this division of labor is the whole point rather than a lazy compromise, you can read in AI drafts, a human signs off.

And what about the EU AI Act?

From 2 August 2026, the transparency obligations of the EU AI Act apply. They target AI systems that interact with people on their own and directly, meaning chatbots that answer with no human involved. Such systems have to disclose that the other party is a machine.

Corresa works differently. The AI drafts each reply, but a person approves it before it goes out. Communication with the customer stays an email correspondence that people are answerable for. On the wording of the regulation, this flow does not fall under the labeling requirement for automated interaction. The rule itself is in EU AI Act, Article 50, and the detailed reading is in our guide to Article 50 in customer service.

This is guidance, not legal advice. How your specific case should be assessed is something to clarify with your data protection officer.

Does this replace my service staff?

No. Corresa takes the writing off your team's hands, not the responsibility and not the customer contact. The judgment call, the decision when in doubt, and the approval stay with people. The tool speeds up the path from inbox to finished reply. It cuts no jobs. Anyone who advises customers in specialty retail knows good answers take experience that no model brings.

How much time does my team save?

The gain is not that nobody replies anymore. It is that nobody starts from a blank page. Instead of writing every email from scratch, your team checks and completes a finished draft. We reckon on roughly 70 percent less writing time per reply, a deliberately cautious average that we keep checking against real usage. Your actual figure depends on how similar your inquiries are and how much research a reply needs.

That time does not vanish. It moves to where no language model can reach: the phone, the personal consultation, the customer standing in the shop. In specialty retail, that is the part of the work that brings in revenue and that a machine will not take over.

Self-hosted or SaaS: how do I tell the difference?

Both models advertise as "GDPR-compliant". The difference sits underneath, in the question of who holds the data and who can see it. A short comparison:

Criterion	Self-hosted (Corresa)	Classic SaaS
Where the emails sit	On your server	On the vendor's servers
AI contract	Your own, directly with the AI provider	Bundled through the software vendor
Software vendor access	None	Technically possible
Price	Flat license	Often per case or per seat

That is the short version. The full comparison against every criterion is in the self-hosted versus SaaS comparison.

What does running it on your own infrastructure cost?

Self-hosting sounds like it needs your own data center. In practice a standard server or a virtual machine at a host of your choice is enough. Corresa runs in an ordinary container environment. We support you with the setup, connecting your inbox and online shop, and training your team.

The software costs a flat monthly license, regardless of how many inquiries you handle. The only usage-based cost is your own contract with the AI provider, usually a few euros a month. There is no per-reply fee. When your volume climbs over the Christmas season, your bill does not climb with it. You know in advance what your inbox costs.

How does setup work?

We handle the setup together with you. That covers installation on your server, connecting your existing service inbox and your Shopware shop, and storing your AI key. After that, your team learns from concrete examples how the review view works and how to resolve placeholders. The training material stays with you.

You do not need an AI department for this. Running the server matches what a Shopware shop already knows about infrastructure. Updates and support are included in the license.

Which retailers is this worth it for?

Not every shop needs this approach. If you mostly get order-status questions and standard FAQ, a simple chatbot often serves you well. Self-hosting pays off where the inquiries are advice-heavy and the answers call for real expertise.

That is the profile of specialty retail. Customers ask about the right size, about materials, about whether a product suits a particular purpose. Whether a sleeping bag is warm enough for a trip to Iceland in September, whether a given back length fits in size M, whether eight pairs of crampons can be delivered by mid-August: questions like these call for a look at the product data and a judgment, not a canned-text reply. No bot can simply automate answers like these without risking mistakes that cost you revenue or reputation in the end. A draft that a human checks fits better here than a fully automated reply. And because these inquiries carry real names and real cases, the question of where the data sits weighs more than it would for anonymous mass communication.

How do I get started?

If your service inbox is full and the answers call for expertise, a self-hosted tool is the option that lets you keep control of your customer data and still save time. You can click through the flow without signing up, in the demo inbox, from the incoming inquiry through the online-shop research to the finished draft. And if you want to know whether Corresa fits your shop and your product data source, write to us. The reply comes from a person, usually within one working day.