← Blog

AI Call Intelligence and GDPR: Where the Major Tools Send Your Data

The short version

Most conversation intelligence tools EU teams evaluate, Otter, Avoma, Chorus by ZoomInfo, Fireflies, and Gong, are US companies that host in the United States and transfer EU call data out under the Data Privacy Framework and Standard Contractual Clauses. Two of the tools here keep data in the EU: Modjo (a French company) and, as an option, Jiminny (a UK company with an EU environment in Ireland). Even those often route AI through US-headquartered sub-processors operating in EU regions, which is EU residency rather than full EU sovereignty. Every claim below is drawn from each vendor's own current documents, retrieved 2026-07-26, and links to a detailed, source-quoted page.

Where each tool sends your call data

The table summarizes the disclosed posture of each tool. "EU data region" means the vendor documents storing and processing customer data in the EU. "AI sub-processors" is where the transcription and analysis actually run, which frequently differs from where storage sits. Read the linked page for each tool for the exact quotes and retrieval dates.

Tool Company and HQ Where data is processed EU data region AI sub-processors Transfer basis
Otter.ai Otter.ai, Inc. (US, Delaware) US (AWS) No OpenAI, Anthropic (US) SCCs + DPF
Avoma Avoma, Inc. (US) US (AWS) No US transcription and AI vendors SCCs + DPF
Chorus by ZoomInfo ZoomInfo Technologies LLC (US) US No OpenAI, Anthropic, Google, Groq (US) SCCs + DPF
Fireflies.ai Fireflies.ai, Inc. (US) US No US AI vendors SCCs + DPF
Gong Gong.io, Inc. (US) US No US AI stack SCCs + DPF
Jiminny Jiminny Holdings Ltd (UK) EU (Ireland) or US (Ohio) EU option OpenAI (US), Gladia (EU) SCCs + DPF
Modjo RINGO SAS / Modjo (France) EU (AWS France) Yes OpenAI, Microsoft, Google (EU regions, US-owned) GDPR Ch. V
Numi Numi (EU) EU Yes Self-hosted, open-source (no US AI vendor) EU residency, Art. 28 AVV

Sources: each vendor's own DPA, privacy policy, sub-processor list, and security or trust pages, retrieved 2026-07-26. Numi's row reflects EU data residency, self-hosted open-source transcription with no US AI provider in the loop, and a GDPR Article 28 processor agreement (Auftragsverarbeitungsvertrag).

Residency is not sovereignty

The single most useful distinction when reading these documents is between residency and sovereignty. Residency is where the data physically sits. Sovereignty is which jurisdiction can compel it. A US company can offer strong paperwork, a signed DPA, Standard Contractual Clauses, Data Privacy Framework certification, ISO and SOC 2 attestations, and still be reachable by US legal process such as the CLOUD Act, because that reach comes from statute rather than contract. Equally, a vendor can host in the EU and still route AI through a US-owned processor operating in an EU region, which keeps the data in the EU but leaves the corporate nexus in the US. Each detailed page below untangles which of these applies to a given tool.

Detailed data pages, one per tool

Each of these quotes the vendor's own documents directly, with retrieval dates, and states plainly where the vendor is genuinely solid as well as where the gaps are.

For a broader buyer's guide to the category, see the best AI meeting assistant for European sales teams and our guide to Gong alternatives for the DACH region in 2026.

Feature and pricing comparisons

These pages compare Numi with each tool on features and pricing rather than data practices. They complement the data pages above: use the data pages to answer "where does my call data go," and these to answer "what does each tool do." Numi vs Gong · Numi vs Chorus · Numi vs Avoma · Numi vs Jiminny · Numi vs Modjo · Numi vs Fireflies · Numi vs Clari Copilot · Numi vs tl;dv.

Frequently asked questions

Which call intelligence tools keep your data in the EU?

Of the tools compared here, Modjo (a French company hosting on AWS in France) offers the clearest EU-residency posture, and Jiminny (a UK company) offers a genuine EU environment hosted primarily in Ireland. The US-headquartered tools, Otter, Avoma, Chorus by ZoomInfo, Fireflies, and Gong, host in the United States and transfer EU data out under Standard Contractual Clauses and the Data Privacy Framework. Even the EU-hosting tools often use US-headquartered AI sub-processors operating in EU regions, which is EU residency rather than full EU sovereignty.

What is the difference between data residency and data sovereignty?

Residency is where data physically sits. Sovereignty is which jurisdiction can compel it. A vendor can offer EU residency for storage while its US parent, US employees, or a US sub-processor still sits within reach of US legal process such as the CLOUD Act. That is why this comparison separates where each tool stores data from who owns the processors in the chain.

Are US tools like Gong and Chorus illegal under GDPR?

No. They can be used lawfully by an EU controller who signs the vendor's Article 28 DPA, relies on Standard Contractual Clauses or the Data Privacy Framework for the transfer, and completes a transfer impact assessment. The point of this comparison is not that US tools are unlawful, it is that they transfer EU call data to the US under a framework, which is a different risk profile from a provider that keeps the data and its AI processing in the EU.

How was this comparison sourced?

Every entry is drawn from the vendor's own current documents, its Data Processing Addendum, privacy policy, sub-processor list, and security or trust pages, fetched on 2026-07-26. Each tool has a detailed page that quotes those documents directly with retrieval dates. Where a document could not be retrieved, the detailed page says so rather than inventing the content.

Numi keeps call audio, transcription, storage, and coaching under EU jurisdiction, with no US AI provider in the loop, so your DPA is backed by control, not just a contract.

Get Early Access