Start with permission to record

Meetings may contain personal and confidential information. Before recording and transcribing, establish the purpose, permission to record, how participants will be informed, access rights and retention periods. A server location does not answer these questions.

Distinguish storage from processing

Check where audio and transcripts are stored and where AI processes them. EU storage and EU processing are separate claims. Support access, subprocessors and optional integrations may also affect your assessment.

The GDPR does not impose a blanket requirement that all processing take place exclusively in the EU. Transfers outside the EEA have additional conditions. The European Commission explains the rules for international data transfers.

Assess providers using their documentation

A company's country of origin provides neither a general privacy approval nor a general prohibition on using its service. Two examples show why specific documents matter:

Otter.ai documents AWS storage in the US and AES-256 encryption. Its Terms of Service include a DPA in Appendix 1.
MeetGeek describes EU and US storage regions on its security page. Its data residency guide explains region-dependent processing.

For the plan you intend to use, review contracting parties, the DPA, subprocessors, processing locations, deletion rules and technical measures. Provider statements do not replace an assessment of your specific use.

Data flows documented by BonusVoice

The BonusVoice DPA describes processing of conversation content:

Data flow	Documented processing
Audio, transcripts and summaries	Storage with Hetzner in Germany
AI processing	Mistral AI in the EU
Payment processing	Separate data flow through Stripe
Optional Google sign-in	Separate data flow through Google

The EU-processing statements concern conversation content. Payment and sign-in data require separate consideration and may involve third countries. Further details are in the privacy policy.

This architecture alone does not determine whether a particular recording is lawful. Confidential client work, employment or health data may involve additional requirements.

Define how the service will be used

Document which conversations may be recorded, who may access recordings and results, and when they will be deleted. Review AI results for errors and personal information before sharing them.

According to the European Commission's explanation, a data protection impact assessment is required when processing is likely to result in a high risk to individuals' rights and freedoms. A US storage location alone is not an automatic trigger.

Start with an appropriate test

BonusVoice offers 30 free transcription minutes per month for one member. Use a recording you are permitted to process and review the transcript, speaker assignments and summary. Features and allowances vary by plan; see the plans page for details.

Try BonusVoice · Provider comparisons in German

Sources checked on 12 October 2026. This article describes selection criteria and documented data flows, not approval for a particular use.