frag.hugo

npx add-mcp 'https://mcp.fraghugo.de/mcp'

Server address to paste into your assistant:

https://mcp.fraghugo.de/mcp

Fill it in by conversation

Tell your AI assistant. frag.hugo fills it in. Your data protection officer reviews it.

Records of processing, service providers, TOMs, the staff list and training come out of a conversation instead of forms. You explain, the assistant asks about anything missing, and the entries are in the app afterwards.

1. Explain

   Type or speak in Claude or ChatGPT, the way you would brief a colleague. Both apps accept voice, on phone and computer.

2. frag.hugo fills it in

   The assistant uses frag.hugo’s templates and creates the entries in your account. It can never do more than you can in the app.

3. Your data protection officer reviews

   Whatever you submit for review goes to your data protection officer, who approves it or comes back to you with questions, as with any entry from the app.

What it sounds like

• Managing director, 35 staff “Here is our software list and the staff list. Set everything up, invite everyone to data protection training and tell me what is still missing.”
• Office manager, dictating on the go “The three new starters on Monday get the screen work and fire safety briefings, due in four weeks.”
• Head of IT “All laptops now have BitLocker and we keep a second backup off-site. Add that to the TOMs.”

What you can rely on

Log and undo

Every change to entries appears in the app under “What your assistant changed”, with before and after. For 90 days you can undo it with a click or a sentence. Sent emails cannot be recalled.

Preview where it matters

Before an email goes to people or anything is deleted, the assistant shows what will happen and waits for your yes.

A person reviews

The assistant prepares, decisions are made with your data protection officer. If you prefer to call, you still can.

What it does

10 tools without an account, 42 with your account

The assistant picks the right tool itself. You talk in plain sentences.

Without an account

Free, no sign-in.

• Search documented GDPR fines with authority, amount and source
• Deadlines from GDPR, NIS2, the EU AI Act and the Cyber Resilience Act
• DSGVO-Prüfstand verdict on a software, ten criteria with sources
• New subprocessors at Microsoft, Google, AWS and others
• Competent German supervisory authority by state or postcode
• Ransomware situation in Germany, by sector
• Email security of a domain (SPF, DKIM, DMARC and more)
• Start a website privacy check (Hugo Check)
• Result of the website check with the main findings
• Vendor profile: email security, Prüfstand, fines

With your frag.hugo account

The assistant can never do more than your account can in the app. Which areas that covers depends on your plan.

• Incidents and deadlines Data breaches with their 72-hour deadline, data subject requests, software introductions and your open deadlines.
• Overview and next step What is still missing, company details, onboarding questionnaire, tasks and every entry at a glance.
• Privacy documentation Records of processing, processors with DPAs, TOMs, privacy policy, retention rules and DPIAs. From more than 600 templates if you like.
• Employees and training Add the staff list, invite people, assign training and safety briefings, check training status.
• Phishing simulation See the status, write your own practice emails and plan a campaign.
• Documents and policies Fill in documents from templates, file your own texts and send policies to employees for acknowledgement.
• AI register, NIS2 and Cyber Resilience Act Register AI systems, record the NIS2 assessment, add products for the Cyber Resilience Act.
• Supply chain and security profile Collect security facts, publish the profile, manage website monitoring, send a contract or questionnaire to a vendor.
• Delete and undo Delete entries and undo changes to entries for 90 days.

Setup

Connected in two minutes

The address is all the public tools need. When you want something recorded, the assistant sends you to sign in at frag.hugo once.

Claude

Web, desktop app and mobile

1. Open Settings, then Connectors.
2. Add custom connector, name it “frag.hugo” and paste the address above.
3. Ask in a chat. For account tools, sign in at frag.hugo and allow the connection.

In Team and Enterprise workspaces, an owner adds the connector once for everyone.

Claude Code

Command line, with six guided skills

As a plugin, with server and guided skills:

/plugin marketplace add Jens-KI-007/fraghugo-claude-plugin
/plugin install fraghugo@fraghugo

Or just the server:

claude mcp add --transport http fraghugo https://mcp.fraghugo.de/mcp

Plugin on GitHub (MIT licence)

ChatGPT and Microsoft 365 Copilot

Directory listings in review

ChatGPT: the app “frag.hugo” is in review at OpenAI. If you use ChatGPT’s developer mode, you can already add it as your own app with the address above.

Microsoft 365 Copilot: the agent “frag.hugo Datenschutz” is in review at Microsoft. After that, add it in the Agent Store with one click; your tenant’s admin can make it available to everyone.

In review at OpenAI and Microsoft

Examples

One question, one answer with sources

• Managing director in Microsoft 365 Copilot “May we use ChatGPT with customer data? And which deadlines are coming in 2027?” The Prüfstand verdict with plan and sources, plus the deadlines with their legal basis. No sign-in.
• Buyer at a machine builder in Claude “Vendor profile for deepl.com” Email security of the domain, Prüfstand verdict, subprocessors and fines where they exist. One answer instead of five websites.
• Office manager with Hugo DSB in Claude “A colleague left his laptop with customer data on the train.” Follow-up questions, then a preview with deadline and competent authority. After her yes, the incident is in the app, the draft notification is ready, and the data protection officer sees it for review.
• IT service provider in ChatGPT “Check my client’s website” Hugo Check runs, the main findings come into the conversation, the full report as a link.

Your data protection officer

The assistant prepares, a person reviews

• Preview before emails and deletions Before an email goes to people, a data breach is logged or anything is deleted, the assistant shows what will happen. It only runs after your yes. Creating and changing entries takes one step; every change is logged and can be undone for 90 days.
• Your data protection officer sees it Whatever you submit for review goes to your appointed data protection officer, just as in the app.
• Drafts, not decisions The draft notification, draft reply and draft record of processing are drafts. Whether to report and what the reply says is decided by you and your data protection officer.

FAQ

Questions about the AI assistant

Can I connect my external data protection officer to Claude?

Yes, through frag.hugo. You connect Claude to your frag.hugo account and say in the chat what should be recorded. Claude creates it in the app. Whatever you submit for review reaches your data protection officer like any other entry; they approve it or come back to you with questions.

Will ChatGPT fill in my record of processing activities?

Yes, once ChatGPT is connected to frag.hugo. You list your software and processes, ChatGPT picks matching templates from more than 600 and creates the entries. If something is missing, it asks. Then you submit the record for review, and your data protection officer sees it.

What happens to my data when I connect Claude to frag.hugo?

Claude only reads and writes what your account may do in the app. Whatever is in the chat and whatever frag.hugo returns is processed by Anthropic as the provider of Claude, so use a plan with a data processing agreement for personal data, such as Claude Team. At frag.hugo every change is logged; we do not store your chats.

Can I dictate entries by voice?

Yes. The Claude and ChatGPT apps accept voice on phone and computer. You might say: “The three new starters on Monday get the fire safety briefing, due in four weeks.” The assistant turns that into entries in frag.hugo. We do not listen in; our own app has no microphone.

What if the assistant records something wrong?

Every change made through the assistant is listed in the app under “What your assistant changed”, with time, before and after. You can undo changes to entries there or in the chat for 90 days; sent emails cannot be recalled. Emails to people and deletions are shown as a preview first and only run after your yes.

Does the AI assistant replace the data protection officer?

No. The assistant takes the typing off your hands and records what you tell it. Whether an entry is right, whether a DPIA is needed and what belongs in the privacy policy is checked by your data protection officer, who remains your contact. The assistant works for them, not instead of them.

Does it cost anything?

The ten public tools are free and need no account. With a booked frag.hugo area, administrators also get the tools for filling things in, at no extra charge. They can do what your plan can do in the app: with Hugo Learn you assign training, with Hugo DSB you maintain the record of processing.

Which AI assistants are supported?

Claude on the web, in the desktop app, on mobile and in Claude Code. ChatGPT and Microsoft 365 Copilot are in review at OpenAI and Microsoft; in ChatGPT you can already add frag.hugo as your own app in developer mode. Technically frag.hugo is an MCP server with OAuth sign-in.

Does frag.hugo see my conversations?

No. We only see what the assistant passes to a tool, such as a search term or a domain. For the public tools we neither store nor log these inputs. The one exception is the website check: like every Hugo Check, the scanner logs the address it checks.

Does my AI provider see what frag.hugo returns?

Yes. Whatever a tool returns becomes part of the conversation and is seen by the provider of your assistant, for example Anthropic, Microsoft or OpenAI. For personal data, use a plan with a data processing agreement; the DSGVO-Prüfstand (in German) shows which plans qualify.

Can the assistant report a data breach without me?

No. For a data breach the assistant first shows a preview with the deadline and any missing details. Only after you explicitly confirm does frag.hugo create the record in your account. Nothing is sent to the supervisory authority automatically: you get a draft notification and report through the authority’s own channel.

Does the assistant decide whether a breach must be reported?

No. It states the 72-hour deadline of Art. 33 GDPR and the competent authority. Whether a report is required is decided by your company and your data protection officer. The assistant is no substitute for legal advice in an individual case.

How do I disconnect?

In the frag.hugo app, under Settings, you see every connected application with its date and can disconnect each one. A connection also ends by itself after 90 days without use.

Does the connection apply to my whole company?

No, to your account. The assistant may only do what your account may do in the app: if you cannot log data breaches there, you cannot do it through the assistant either.