Privacy · Updated November 2026

GDPR-compliant AI note takers and EU data residency

Answer in brief

A note taker cannot make your meetings GDPR-compliant on its own. You stay the controller: under Article 28 GDPR you may only use processors that give sufficient guarantees, under a contract that sets out the processing. What you can check is where recordings are stored and processed, which sub-processors transcribe and summarise, whether a DPA is offered, whether your data trains models and how long it is kept.

By the vendors' own statements, meetergo (Germany), tl;dv (EU data centres) and jamie (EEA, Switzerland, UK) keep data in Europe, and Read AI offers EU hosting on Enterprise+. Otter, Fathom and Granola store data in the US, Notta in Tokyo, and Fireflies names no region outside Enterprise private storage. This page is not legal advice.

This comparison is published by meetergo GmbH, a German software company that sells an AI note taker and is one of the tools described here. Every fact about other vendors comes from their official websites as of 9 November 2026. We did not run long-term tests; “pick” is our editorial judgment for the use case named. How this guide is made.

Recording→Hosting region→Sub-processors→DPA→Retention

Six things to check

1. Region

Where data is stored and processed

Storage and processing can differ. A vendor may store notes in the EU but send audio to a transcription or LLM provider elsewhere. Ask for both, and for backups.

2. Sub-processors

Who transcribes and who summarises

Look for a public sub-processor list that names the speech-to-text and language model providers and their locations. Article 28(2) GDPR says a processor may not engage another processor without your prior specific or general written authorisation, and must tell you about changes so you can object.

3. DPA

A data processing agreement

Article 28(3) requires a contract that sets out the subject matter, duration, nature and purpose of processing and the type of data. Check whether the DPA is self-serve, on request or only on higher plans.

4. Transfers

A lawful route outside the EU

Transfers to a third country need an adequacy decision (Article 45) or appropriate safeguards such as standard contractual clauses (Article 46). For the US, Decision (EU) 2023/1795 covers organisations on the Data Privacy Framework List; check whether the vendor and its AI providers are on it.

5. Training

Is your data used to train models?

Check both the vendor and its AI providers. Some vendors bar providers from training but train their own models on de-identified data unless you opt out.

6. Retention

How long recordings are kept

Article 5(1)(e) GDPR asks that personal data is kept no longer than necessary. Prefer tools where you can set retention and delete audio once the summary exists.

Hosting, AI providers, training and retention

As stated on each vendor's own security, help or sub-processor page, checked 9 November 2026. “Not stated” means we did not find it on the pages listed in the sources.

Tool	Data stored in	Transcription and LLM providers named	Training on your data	DPA	Retention stated
meetergo AI Notes	Germany (Hetzner, Nuremberg/Falkenstein); local mode stays on your device	Mistral AI (France, Voxtral via EU endpoint) for Connect recording transcription; melious (Germany) for summaries; both zero data retention	no training on your data (AI assistant statement)	yes	cloud recordings kept 90 days to 2 years by plan, then deleted
jamie	EEA, Switzerland, UK; audio streamed for transcription, not stored	not named on the security page	never, by jamie or its model providers	not mentioned on the security page	admins set retention rules
tl;dv	EU data centres (Google Cloud, AWS, Hetzner, Wasabi); AI hosting in Europe or US selectable	Anthropic, with names and emails anonymised first	“No customer data is used to train the AI”	not mentioned on the security page	free plan recordings up to 3 months
Read AI	US (AWS us-east-1); EU and Canada hosting on Enterprise+	not stated	not stated	DPA and SCCs for EU/EEA Workspace customers	not stated
Otter.ai	US (AWS region West)	Anthropic, OpenAI (US)	states no customer data is used to train its models	not stated	not stated
Fathom	US	Anthropic, OpenAI, Google; not permitted to train on user data	Fathom trains its own models on de-identified data; opt-out available	on request for EU/UK users	data removed on account deletion, from backups 7 days later
Granola	US (AWS VPC); audio not stored	Deepgram and Assembly (transcription), OpenAI and Anthropic (summaries)	trains on anonymised data unless you opt out; off by default on Enterprise	on request	notes kept indefinitely unless deleted; retention periods on Enterprise
Notta	Japan (AWS Tokyo)	not stated	not stated	not stated	not stated
Fireflies.ai	not stated; private storage at a preferred location on Enterprise	not stated	not stated	not stated	not stated

meetergo's sub-processor list names Mistral and melious for meetergo Connect recordings and summaries but no provider specifically for the cloud notetaker in Zoom, Teams or Meet. jamie points to its Trust Center and tl;dv to its Trust Report for further documents, which we did not review.

“GDPR compliant” is a self-declaration

Most vendors in the table describe themselves as GDPR-compliant or committed to GDPR. Treat these as the vendors' own statements unless they name an approved certification under Article 42 GDPR, which none of the pages we checked does. Treat them as a starting point and verify the facts behind them: region, sub-processors, DPA, transfers, training and retention.

Certifications help with security, not with your legal basis. ISO/IEC 27001 and SOC 2 reports describe how a vendor manages security; they do not answer whether you may record a given meeting. meetergo states GDPR compliance, DPAs and ISO 27001 for EU data storage, and no SOC 2 or HIPAA. If your customers require SOC 2, Otter, Fireflies, Fathom, tl;dv, Read AI, Granola and Notta state it, and jamie lists SOC 2 Type II as pending.

Two practical points are easy to miss. Meetings often contain special categories of data, such as health details in a client call, which Article 9 GDPR restricts. And people in the meeting have a right to be informed under Article 13. Announce the recording, say why, and offer to stop.

Which tool fits which requirement

Our pick as publisher, based on the published facts above.

EU, bot-free

jamie or tl;dv

Both keep data in Europe and record without a bot. jamie states that audio is never stored and that no model provider trains on your data.

EU, with suite

meetergo AI Notes

German hosting and EU AI providers named in a public sub-processor list, with notes on the contact that booked the meeting. No SOC 2 or HIPAA stated.

US vendor, EU hosting

Read AI Enterprise+

If your team already uses Read AI, EU hosting is listed on the Enterprise+ plan, which requires 5 or more licences.

Questions and answers

Is it legal to use a US-hosted note taker for EU meetings?

It can be, if the transfer has a lawful basis under Chapter V GDPR, such as the EU-US Data Privacy Framework for listed organisations or standard contractual clauses, and you meet your other obligations. Check the vendor's DPA and sub-processors. This is not legal advice.

Which note takers name their AI providers?

On the pages we checked: meetergo (Mistral, melious), Otter (Anthropic, OpenAI), Fathom (Anthropic, OpenAI, Google), Granola (Deepgram, Assembly, OpenAI, Anthropic) and tl;dv (Anthropic).

Do I need a DPA with my note taker?

When the vendor processes personal data on your behalf, Article 28(3) GDPR requires a contract or other legal act with the content set out there. Vendors usually call this a DPA.

Is local transcription automatically GDPR-compliant?

No. Keeping audio on your own device removes the vendor as a recipient of the recording, but you still process personal data and need a legal basis, must inform participants and must store the files securely.

Which tools let me opt out of model training?

Fathom and Granola state that you can opt out of their own model training in settings. jamie, tl;dv and Otter state they do not train on customer data; meetergo states no training on your data for its AI assistant and its EU AI providers.

Continue reading

Sources

All pages accessed 9 November 2026. This page explains what to check; it is not legal advice.

Cite this entry

Best AI Meeting Note Taker. “GDPR-compliant AI note takers and EU data residency”. meetergo GmbH. Content reviewed 9 November 2026. https://bestaimeetingnotetaker.com/gdpr/