Two regulations changed vendor due diligence for European buyers. NIS2 (Directive (EU) 2022/2555) makes essential and important entities responsible for supply-chain security, including the security of their ICT vendors, under its Article 21 risk-management measures. DORA (Regulation (EU) 2022/2554) puts financial-sector firms under a formal ICT third-party risk regime, with a register of providers and contractual requirements. Both push the same duty downward: you are now accountable for the security posture of the tools you buy.
AI meeting tools sit in a sensitive spot. They ingest recorded conversations, transcripts, and the coaching or notes generated from them, which is often the most candid data your company produces. Yet most vendors will not answer specific security questions in writing; they point you at a badge and a slogan.
This is the 25-question security questionnaire we think every buyer should send to an AI meeting or notetaker vendor, mapped to what NIS2 and DORA actually expect you to collect. To make the point, we answer all 25 for Numi, in writing, on this page. Where the honest answer is "not yet," we say so. Anchor documents: our published, dated sub-processor list, our Article 28 data processing agreement, and the where-your-call-data-goes page.
Domain A: Governance, certification, and AI Act posture
Q1. Which security certifications does your company itself hold, versus which are held only by your infrastructure providers?
Why it matters: Vendors routinely present their cloud host's ISO 27001 badge as if it were their own. The two are not the same.
Numi's answer: Numi is in open beta. Numi the company does not yet hold an independent ISO 27001 or SOC 2 certification, and we will not imply otherwise. Our core hosting provider, Hetzner (Frankfurt), is ISO 27001 certified, and our disclosed sub-processors carry ISO 27001 and/or SOC 2 Type II (for example Cloudflare, Sentry, PostHog EU), each named in our published sub-processor list. Ask every vendor to draw this exact line; a company that blurs it is telling you something.
Q2. Are you a provider or a deployer of the AI system under the EU AI Act, and what documentation do you keep?
Why it matters: The role determines who carries which obligation, and it must be explicit in the contract.
Numi's answer: For the conversation-intelligence models Numi operates, Numi acts as the provider; the customer using Numi in their sales process is the deployer. We maintain technical documentation of the models and data flows. AI meeting tools are not high-risk under Annex III by default, but the Article 50 transparency duty applies, meaning participants must be able to know an AI system is processing the meeting.
Q3. Do you use customer data, including audio, transcripts, prompts, or outputs, to train or fine-tune any model?
Why it matters: "Improve our services" clauses are often training clauses in disguise, and usually opt-out.
Numi's answer: No. Content data (audio, transcripts, coaching output) is processed strictly on behalf of the customer as controller and is never used to train publicly accessible AI models. While a customer is on the third-party coaching option (the Claude model from Anthropic), that runs under zero-retention API terms, so prompts are not used for training. This is committed in our AVV, not only on a webpage that can change.
Q4. Do you provide an Article 28 GDPR data processing agreement before signature, and does it name sub-processors?
Why it matters: A DPA you only see after signing is not leverage.
Numi's answer: Yes. Our Article 28 AVV is available to review before you commit, and it incorporates our published, dated sub-processor list by reference. We notify customers at least 30 days before adding or replacing any sub-processor that touches content data, with a right to object and, if unresolved, to terminate the affected service.
Q5. Where is your published sub-processor list, and how current is it?
Why it matters: A DPO should never have to infer a vendor's supply chain from marketing copy.
Numi's answer: It is public at /legal/subprocessors, versioned and dated. Each entry names the legal entity, processing country, purpose, data categories, and the transfer safeguard in place.
Domain B: Data residency and processing location
Q6. In which countries is our data stored and processed? These can differ.
Why it matters: "Stored in the EU" says nothing about where processing happens.
Numi's answer: Stored and processed in the EU, in Frankfurt, Germany, on Hetzner. For core content the storage location and the processing location are the same; there is no store-in-EU, process-in-US gap.
Q7. Is speech-to-text transcription done in-house or handed to a third-party transcription vendor?
Why it matters: Many "EU" notetakers ship your raw audio to a US transcription API.
Numi's answer: In-house. Transcription runs on a self-hosted Whisper large-v3-turbo model on Numi's own Frankfurt infrastructure. Audio never leaves Numi's EU infrastructure and is not sent to a separate transcription vendor.
Q8. Which sub-processors, if any, receive transcript text, and under what safeguard?
Why it matters: Transcript text is content, and its path is often undisclosed.
Numi's answer: Only the coaching-model processor for the option a customer is on. On Numi's self-hosted EU coaching model (rolling out), no third-party LLM receives transcript text. On the Claude option, transcript text, never audio, goes to Anthropic under EU Standard Contractual Clauses and zero-retention terms. Text-only embeddings for search run under zero-retention terms as well; the current, dated state of every text-processing sub-processor is on the sub-processor list, which is the authority.
Q9. Do any US-headquartered sub-processors touch content, meaning audio, transcripts, or coaching output?
Why it matters: Edge and analytics vendors are fine; content vendors are the real question.
Numi's answer: Core content processing stays in the EU. The one optional content-touching US transfer is the Claude coaching model (Anthropic, US), under SCC and zero-retention, and only while a customer is on that option; the self-hosted EU coaching model removes even that. Infrastructure and edge vendors such as Cloudflare handle only IP address and request metadata, never audio, transcripts, or coaching. All of this is disclosed in the list.
Q10. How do you address CLOUD Act and FISA 702 exposure from any US vendors in the chain?
Why it matters: An EU data centre alone does not defeat US extraterritorial reach.
Numi's answer: We use a control-not-origin framing and do not claim immunity. EU data centres alone do not defeat the CLOUD Act if a US-controlled entity holds the keys. Numi's design keeps core processing under a single EU provider with self-hosted transcription, which minimises the surface where a US-controlled processor could be compelled, and we disclose the residual exposure in the list so you can assess it under Chapter V of the GDPR.
Domain C: Access control, encryption, and tenant isolation
Q11. Is data encrypted in transit and at rest, and with what?
Why it matters: This is table stakes, but it belongs in the contract, not a blog claim.
Numi's answer: Yes. TLS 1.2 or higher in transit and encryption at rest, set out in the technical and organisational measures of our AVV.
Q12. How is internal access to customer content controlled?
Why it matters: Least privilege and logging decide how bad an insider or breach event gets.
Numi's answer: Role-based access controls and pseudonymisation, with audit logging of access, per our documented technical and organisational measures.
Q13. Is customer data logically isolated between tenants?
Why it matters: Multi-tenant leakage is one of the most common SaaS failure modes.
Numi's answer: Yes. Numi's data model is workspace-scoped, so each customer's content is isolated per workspace and access is enforced against that scope.
Q14. Can you export audit logs of who accessed our data and when?
Why it matters: You cannot investigate an incident you cannot reconstruct.
Numi's answer: Access audit logging is part of our technical and organisational measures. As an open-beta company we provide logs and their format under the AVV on request rather than through a self-serve export console today; we would rather state that plainly than imply a maturity we have not reached.
Q15. What authentication options do you support, such as SSO and MFA?
Why it matters: Weak auth undoes every other control.
Numi's answer: Numi uses email magic-link authentication today. SSO and SAML for team plans are on the roadmap, not yet shipped, and we will say so rather than list them as available.
Domain D: Sub-processors and ICT third-party risk (DORA)
Q16. Do you maintain a register of ICT third-party service providers?
Why it matters: DORA Article 28 expects financial entities to keep exactly this inventory for their providers.
Numi's answer: Our published sub-processor list functions as that register for content-processing vendors: named entity, country, purpose, data categories, and safeguard. It is the kind of named, current inventory DORA's register is built around.
Q17. Will you support our right to audit, or provide audit reports?
Why it matters: Article 28(3)(h) GDPR and DORA both contemplate audit rights.
Numi's answer: The AVV provides for controller audit rights and data-subject assistance under Article 28. As an open-beta company we do not yet have a third-party SOC 2 report to hand over; what we offer is the AVV, the dated sub-processor list, this questionnaire, and direct written answers.
Q18. How do you notify us of sub-processor changes?
Why it matters: Silent supply-chain changes break your own compliance.
Numi's answer: At least 30 days before adding or replacing any content-touching sub-processor, with a right to object and to terminate the affected service if the objection cannot be resolved.
Q19. What is our exit and concentration risk? Can we get our data out?
Why it matters: Lock-in is an ICT risk under DORA and a practical one for everyone else.
Numi's answer: Content is exportable, and on termination the AVV covers export and deletion. The core stack runs on one EU provider (Hetzner) plus open-source, self-hostable components (Whisper for transcription, an open-source coaching model), which lowers lock-in rather than deepening it.
Q20. Do you subcontract transcription or coaching to undisclosed fourth parties?
Why it matters: The chain is only as trustworthy as its least-visible link.
Numi's answer: No undisclosed parties. Transcription is self-hosted, coaching is either self-hosted or the single disclosed Claude option, and the sub-processor list is the complete content-processing chain.
Domain E: Incident response, breach notification, and resilience (NIS2)
Q21. What is your breach notification commitment and timeline?
Why it matters: As controller you owe your supervisory authority a 72-hour notification under Article 33 GDPR, and you can only meet it if your processor tells you fast.
Numi's answer: The AVV binds Numi to notify the customer without undue delay on becoming aware of a personal-data breach, so the controller can meet its own 72-hour GDPR deadline.
Q22. How do you monitor for and detect incidents?
Why it matters: You cannot report what you never detect, and NIS2 raises the bar on detection.
Numi's answer: Backend error monitoring runs through Sentry in its EU (Frankfurt) region with server-side PII scrubbing, alongside access audit logging. Neither receives audio, transcripts, or coaching content.
Q23. How does NIS2 apply to this relationship?
Why it matters: If you are an essential or important entity, your obligations reach your vendors.
Numi's answer: If you fall under NIS2, your Article 21 supply-chain security measures extend to Numi as a vendor. We support that by publishing our security posture, keeping content in the EU, and answering this questionnaire in writing, which is the evidence NIS2 expects you to collect about ICT suppliers.
Q24. What are your backup, recovery, and data-durability measures?
Why it matters: Resilience and continuity are explicit DORA and NIS2 concerns.
Numi's answer: Data is held on Hetzner in Frankfurt across a PostgreSQL database and MinIO object storage, encrypted at rest. Backups of the database and object storage are maintained on EU infrastructure; specific recovery-point and recovery-time commitments are covered in the AVV and available on request rather than quoted as marketing numbers here.
Q25. How mature is your security program, honestly?
Why it matters: The most useful answer a vendor can give is an honest one.
Numi's answer: Numi is in open beta. We run on ISO 27001-certified infrastructure and disclosed, certified sub-processors, we self-host transcription in the EU, and we contract our commitments in an Article 28 AVV. But Numi the company does not yet hold its own ISO 27001 or SOC 2 certification, and we will not pretend otherwise. The signal you should want from any early-stage vendor is not a wall of badges; it is a vendor willing to answer all 25 of these in writing. That is what this page is.
Send these 25 to every AI meeting tool on your shortlist, and compare the answers you get back. If you want to check ours against the source documents, they are linked at the top: the dated sub-processor list, the Article 28 AVV, and the where-your-call-data-goes page. For the procurement-and-contract angle rather than the security angle, see our 5-question AI vendor due diligence checklist and the sovereignty-washing checklist.