We Read the DPAs of 12 AI Notetakers: Who Processes Your Meeting Audio, and Where

A recording of a sales or interview call is one of the most sensitive things a company creates. It carries identifiable voices, names, deal terms, salary figures, and sometimes health or immigration detail. So the question a data protection officer actually needs answered is narrow: once your notetaker captures that audio, who processes it, in which country, and how long do they keep it?

Marketing pages rarely answer that. The binding answers live in the documents vendors are legally required to publish: their Data Processing Agreement (DPA), their sub-processor list, and their privacy and security pages. So we read them. Over 14 September 2026 we retrieved the public DPAs, sub-processor lists and trust pages of eleven AI notetakers, extracted where audio is processed, which sub-processors touch it, the default retention, and whether the vendor trains AI on your content. We include Numi in the same table, on the same terms. Every cell is backed by the vendor's own source, linked below, with the retrieval date, so you can verify each claim yourself.

The comparison table: 12 AI notetakers, from their own documents

Read the table as a starting point for your own due diligence, not a compliance verdict. Every one of these tools can be operated lawfully by an EU controller with the right DPA, transfer mechanism and risk assessment. What the table shows is the raw geography and retention you are signing up for by default, before you configure anything. All external rows were retrieved on 2026-09-14; the Numi row is from its published sub-processor list dated 2026-07-03.

Legend: EU/EEA = processed in the EU or EEA by default. Mixed = a selectable or split posture (for example US default with an EU option, or UK hosting with disclosed US processing). US = processed in the United States on the pages we could load. Full disclosure: Numi publishes this table and is one of the vendors in it.

What the table actually shows?

Four patterns are worth pulling out, because they cut across the marketing.

1. EU processing is the exception, not the norm. Only tl;dv, Modjo and Numi process by default inside the EU or EEA. Jiminny and Gong let you choose an EU region but do not default to it. Everyone else, Fireflies, Otter, Fathom, Avoma and Clari Copilot, processes in the United States, and Metaview stores on AWS UK while disclosing US and German processing in its DPA. If your requirement is "meeting audio stays under EU jurisdiction end to end," most of this category does not meet it out of the box.

2. Storage residency is not processing residency. Fireflies is the clearest example: its EU option, on the Enterprise tier, stores data in the EU but, in its own words, processes it in the US. The recording still travels to the US to be worked on. Under GDPR it is the processing and the access that determine jurisdiction, not only where the bytes rest. When a vendor advertises an "EU region," read whether it covers storage, processing, or both.

3. Even EU-resident tools carry US-owned sub-processors. Modjo hosts in France and commits contractually to no training, which is a genuinely strong posture. But its named AI sub-processors, OpenAI, Microsoft and Google, are US-owned companies operating EU data centers. tl;dv is a German company hosting in the EEA, and its AI partner is Anthropic, a US company. EU residency is not the same as EU corporate control, and a US-owned processor in an EU region can still fall within US extraterritorial reach. This is the residency-versus-jurisdiction gap in practice, and it is where sovereignty-focused buyers should spend their attention.

4. Training on your content splits the field. Otter and Fathom train their own in-house models on de-identified meeting content by default (Fathom offers an opt-out; we could not confirm one for Otter). ZoomInfo's policy permits training LLMs. tl;dv, Modjo and Metaview commit not to train. Gong says it does not train generative models, but that statement lives on a marketing trust page rather than its binding DPA, so verify it in your contract. Avoma and Clari Copilot do not publish a clear no-training commitment for meeting content at all. When the promise is not in the DPA, it is not a promise you can enforce.

How to use this for your own DPA review

If you are running vendor due diligence, the table is the input, not the output. Turn each column into a question you put to the vendor in writing, and hold the answer against their DPA rather than their sales deck:

1. Where is audio processed, not just stored? Ask for the processing region explicitly, and confirm whether an "EU region" covers processing or only storage.
2. Who is in the sub-processor chain, and where is each one? Get the current list, and check the corporate ownership of the AI and transcription vendors, not only their data-center location.
3. What is the default retention, and can you shorten it? If auto-deletion is gated to an Enterprise tier, your data persists by default. Confirm the number and the tier.
4. Is the no-training commitment in the binding DPA? A statement on a trust page is marketing. A clause in the DPA is enforceable. Ask for the latter, and confirm it flows down to sub-processors.
5. Which transfer mechanism carries your data, and how stable is it? Most US vendors rely on the EU-US Data Privacy Framework, the third transatlantic transfer basis after Safe Harbor and Privacy Shield were struck down. Name it in your records and monitor its status.

For a deeper structured version of this, see our 5-question AI vendor due diligence checklist and our per-vendor breakdowns of Fireflies, Otter, tl;dv, Fathom, Metaview, Chorus, Avoma, Jiminny and Modjo.

Where Numi fits, honestly

We built Numi so that the audio never leaves EU infrastructure. Recordings are transcribed by a self-hosted Whisper model on Hetzner in Frankfurt, so the audio itself is not sent to a third-party transcription vendor at all. That is the part of the chain most of this category routes through a US-owned processor.

The honest caveat, and the reason we put ourselves in the same table on the same terms, is the coaching step. Numi's coaching model is customer-selectable. We are rolling out a self-hosted EU coaching model where transcript text also stays inside our EU infrastructure. Until a customer is moved to it, coaching runs on Anthropic under Standard Contractual Clauses and zero-retention terms, which means transcript text (not audio) is processed by a US-owned provider. We do not claim "no US processing" as an absolute, because for that step it would not be true. What we do commit to, in our DPA and sub-processor list, is that audio stays in the EU, content is never used to train public models, and every sub-processor is disclosed with its location and safeguard.

Methodology and limitations

We retrieved each vendor's public DPA, privacy policy, sub-processor list and security or trust page on 14 September 2026 (Numi's figures are from its published sub-processor list dated 3 July 2026). We extracted only what the documents actually state. Where a claim appears on a marketing page but not the binding DPA, we flag it. Where the wording is scoped narrowly (for example a no-training pledge that only covers one data source), we say so rather than generalizing it.

Some sub-processor lists are gated. Fireflies' list is a JavaScript application that did not render, Fathom's sits behind a Vanta signed API, Metaview's full schedule is NDA-gated, and Avoma's page returned an HTTP 403. In those cases we cite only the vendors we could confirm from a page that loaded, and we mark the gap rather than filling it from a third-party summary. This is a point-in-time snapshot: sub-processors, regions and retention settings change, so treat the vendors' own live pages, linked below, as the authority and re-check before you rely on any single cell.

Sources: verify every row yourself

Each vendor's primary sources, with the URL we retrieved on 2026-09-14 (Numi: 2026-07-03). Where a source failed to load, we say so.