Can You Keep Your AI Notetaker's Data in the EU?

The short answer

Usually not, and the tools that come closest still send your meetings to the United States to be transcribed and summarized.

Granola says it stores all data on AWS servers in the United States and that EU data residency is not available yet. Otter's privacy policy names Amazon Web Services, based in the US, as its cloud provider and relies on the EU-U.S. Data Privacy Framework for transfers; we found no EU storage option described there. Fireflies is the exception that proves the point: on its Enterprise plan you can keep stored meeting data in the EU, and its own help page adds, in a note, that the data will be stored in the EU but processed in the US.

So the real question is not which tool is EU hosted. It is which of your requirements is actually written down, and whether a given tool meets that one.

Storage and processing are two different answers

A meeting notetaker does work on your data before it stores anything. Audio goes to a speech to text service, the transcript goes to a language model for the summary and action items, and only then are the results saved. Each of those steps can run somewhere different.

Fireflies documents this split better than most. With Private Storage your transcripts, summaries and recordings rest in a region you pick, or in your own AWS S3 or Google Cloud bucket, while transcription and summarization still run on Fireflies servers in the United States. That is a real improvement for data at rest. It is not what a clause saying data must not leave the EU asks for, because the audio of every call still crosses the Atlantic while it is being worked on.

When you read a vendor's residency page, look for the word processed. If the page only talks about where data is stored, assume processing happens somewhere else until someone tells you in writing that it does not.

A region setting is not the same as a region

Some products let an admin choose a storage region in settings. Picking EU in a dropdown feels like the job is done. Whether it is depends on whether anything in the product reads that choice when it writes your data.

Driffle is a useful example because its own app is blunt about it. The admin settings include a data residency field with US, EU and Asia Pacific options. Next to it the app says Driffle does not yet enforce regional storage, that the selection is recorded as a preference only, and that it does not move existing data or restrict where new data is written. That warning exists because a region setting that changes nothing is exactly the kind of feature a security reviewer would otherwise take at face value.

There is a second, smaller detail in Driffle's code that is worth copying as a test for any vendor. The transcription service can be pinned to a regional endpoint, but only to endpoints on a fixed list, and in production that list holds only the default global endpoint. If someone configures a region that is not on the list, the service refuses to start rather than quietly sending audio to the global endpoint. Ask a vendor what their system does when a region is configured but not available. Silent fallback is the answer you do not want.

What GDPR asks for, and what your client asks for

GDPR does not require personal data to stay in the EU. It requires a lawful basis for sending it elsewhere, such as Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. Granola's DPA includes the EU and UK clauses, Otter certifies to the Data Privacy Framework, and Fireflies is listed on it too. For many European teams, a signed DPA with one of those mechanisms is all their own policy needs.

A client contract can ask for more. Public sector work, health, financial services and some large enterprise clients write the country of storage, and sometimes of processing, into the agreement. If you sit in their calls with a notetaker running, their clause covers your notetaker. Read the clause before you read any vendor page, because it tells you whether you need lawful transfer, EU storage, or EU processing, and those rule out very different sets of tools.

Four questions to send before you sign

1. In which countries is my meeting data stored, including backups and failover? 2. In which countries is audio transcribed and the summary generated, and by which subprocessors? 3. If I choose a region in settings, is it enforced for new data, and is existing data moved? 4. What happens if the region I choose is unavailable: does the system stop, or fall back to another region?

Ask for the answers in writing, ideally as part of the DPA or order form. A sales call that says EU hosting is coming soon is not an answer to any of the four.

Where Driffle stands today

Driffle stores customer data on AWS in the United States, with us-east-1 as the primary region and us-west-2 for failover. Transcription runs through Deepgram and AI processing through AWS Bedrock, both listed on the subprocessor page. EU residency is on the roadmap and is not available today, and the region setting in the app is a recorded preference, as described above. If EU storage or EU processing is a hard requirement in your contracts, Driffle is not the right tool for those calls yet, and the privacy page asks you to say so before signing up.

If lawful transfer under a DPA is enough for you and you want notes without a bot in the call, Driffle is available for Apple Silicon Macs at driffle.ai/download.