--- title: "EU-Hosted AI Meeting Notes and GDPR: What to Check | In Parallel" description: "A GDPR checklist for AI meeting note-takers: where data is stored and processed, sub-processors, model training, the DPA, retention and access." url: https://www.in-parallel.com/guides/eu-ai-meeting-notes-gdpr --- Buying guide # EU-hosted AI meeting notes and GDPR: what to check An AI note-taker records what people say in meetings, which makes it one of the more sensitive tools a company can buy. “EU-hosted” on a landing page is where the questions start, not where they end. In short Before buying an AI meeting note-taker under GDPR, check where recordings and transcripts are stored and where transcription and model inference run, which sub-processors handle the data and in which region, whether your data trains any model, that a DPA is available, and how retention and access are controlled. Ask for the DPA and sub-processor list in writing. Updated 22 October 2026 [Get started](https://www.in-parallel.ai/) [Book a demo](https://www.in-parallel.com/demo) ## Storage is not the same as processing A tool can store data in the EU and still send audio to a transcription or language-model provider elsewhere. Ask where each step runs: the meeting bot, transcription, summarisation, storage and backups. - Where is the recording stored, and for how long? - Which provider transcribes the audio, and in which region? - Which model writes the summaries, and where does it run? ## Read the sub-processor list The sub-processor list shows who else touches your data. Check each vendor’s purpose and region, and how you will be told when the list changes. In Parallel lists six, all processing data in the EU: Amazon Web Services for hosting and models on Amazon Bedrock, AssemblyAI for transcription, PostHog for product analytics, Postmark for email, Stripe for billing and Intercom for support chat. ## Training, contracts and retention Ask whether recordings, transcripts or extracted notes are used to train models, the vendor’s or anyone else’s. Then ask for the DPA and security evidence, and check that you set retention and that access follows your own permissions. - In Parallel never trains models on your data - The DPA, SOC 2 letter and sub-processor list are available through trust.in-parallel.com - Data is encrypted at rest and in transit, with retention windows you control - Access is scoped by workspace, with SSO and SCIM available ## Your side of the obligation GDPR does not end with the vendor. Participants should know a note-taker is present and why, and your record of processing should name the tool. Your data protection officer should review the DPA and sub-processor list before rollout, not after. FAQ ## Common questions **Where does In Parallel store and process meeting data?** In the EU. Hosting and model inference run in Frankfurt on Amazon Web Services and Amazon Bedrock, and all six sub-processors, including AssemblyAI for transcription, process data in the EU. **Does In Parallel train AI models on meeting recordings?** No. Your meetings, decisions, plans and commitments are used to provide the service and are never used to train models. **Where can I get In Parallel’s DPA and sub-processor list?** Through the trust portal at trust.in-parallel.com. In Parallel will also send the DPA, SOC 2 letter and sub-processor list on request and walk your team through any concern. Keep exploring [Security](https://www.in-parallel.com/security) | [Own your context](https://www.in-parallel.com/own-your-context) | [In Parallel Notes](https://www.in-parallel.com/notes) | [How to choose a meeting intelligence platform](https://www.in-parallel.com/guides/choose-meeting-intelligence-platform) ## Start with your next meeting. Bring your team in. Use every surface, including every other team's. From €29 per user per month, billed monthly, no commitment. [Get started](https://www.in-parallel.ai/) [Book a demo](https://www.in-parallel.com/demo) 30-minute demo. We'll show you how meeting signals become a shared record of decisions, owners and risks.