Start with what you actually need
Every feature brings its own data processing. A plain audio call is different from a recorded meeting with a transcript and an AI summary. So write down first what you really use:
- Meetings with external guests who have no account?
- Permanent voice rooms for a team or community?
- Recordings – and who may watch them afterwards?
- Transcripts, captions or AI summaries?
- Phone dial-in?
- Chat, files and notes in the same place?
This list decides which of the following questions matter most for you. If you never record, retention of recordings is a side issue. If you transcribe every meeting, the AI questions come first.
Questions to ask a provider
A serious provider can answer these in writing, usually with a link to a public page. If answers stay vague, that is an answer too.
- Who is the operator, and which law applies? Name, country of registration and the jurisdiction of the contract.
- Where are servers, file storage and backups? Ask for all three. Backups are often forgotten.
- What leaves the EU, and why? Typical examples are network protection services, payment providers and optional sign-in with external accounts.
- Is there a current list of subprocessors? And how are customers told about changes?
- Is a data processing agreement (DPA) available? For organisations, this is required under Article 28 GDPR.
- How is data encrypted? In transit, at rest – and is anything end-to-end encrypted? If so, what does not work there?
- What are the default retention periods for recordings, transcripts and chat? Can admins shorten them?
- How are participants informed when recording or transcription starts?
- Can you export your data and delete it completely – per person and for the whole team?
Our GDPR checklist for tools has these questions in a form you can work through with your team.
How to read a subprocessor list
A subprocessor list names the companies that process personal data on the provider’s behalf. It usually has three columns: name, purpose and location. Read it like this:
Look at the locations
Mark every entry outside the EU/EEA, and entries with vague locations such as “global”.
Match purposes to your use
A payment provider only sees billing data. A transcription or AI service may see your meeting content. The second matters far more.
Check the transfer basis
For transfers outside the EU/EEA, the provider should name the legal basis, for example an adequacy decision or standard contractual clauses.
Check completeness and freshness
Placeholders or a list without a date are a warning sign. So is a list that never changes while the product clearly does.
The DPA: what to look for
If your organisation uses a tool for work, the provider processes personal data on your behalf. Article 28 GDPR then requires a contract. Check at least that the DPA covers:
- subject matter, duration, purpose and the kinds of data processed
- processing only on your documented instructions
- confidentiality of the people who handle the data
- technical and organisational measures
- rules for subprocessors and how you are informed about changes
- support with data subject requests and data breaches
- deletion or return of data at the end of the contract
- your right to audits or information
This article is a practical aid, not legal advice. For your specific case, ask your data protection officer or a lawyer.
Where does the AI run?
AI features are where a lot of content flows: whole conversations, turned into text. Ask specifically:
- Which features use AI – captions, transcripts, summaries, search?
- Does the provider run the models itself, or does it call an external AI service? If external: which one, and where?
- Is content used to train models?
- Who can switch AI off – the organisation, the team, each meeting? Can a single person opt out?
- Are AI results labelled, and are they suggestions or automatic decisions?
- How long are transcripts kept?
How Coviqo answers these questions
We built Coviqo so that these answers are easy to find:
- Operator
- Luxembourg
- Servers, file storage, backups
- Germany (EU)
- AI
- Speech recognition and language model on servers we operate; no external AI providers, no training with your content
- What leaves the EU
- Network protection by a CDN/proxy provider in front of website and app, the payment provider, optional sign-in providers and integrations you choose – see Why a European platform
- Subprocessors
- Public list, the same as in the privacy policy
- DPA
- Available for organisations, concluded in the settings
- Transcripts
- Kept 90 days by default in new spaces; everyone can opt out of being transcribed
Details are on Why a European platform. For voice apps in particular, see the voice app checklist.
Frequently asked questions
Is a tool with EU servers automatically GDPR-compliant?
No. Server location is one factor. The operator, subprocessors, the contract, retention and how features like recording and AI work matter just as much – and so does how you use the tool.
Do small clubs and communities need a DPA?
If an organisation, such as a registered club, uses a tool to process its members’ personal data, a DPA under Article 28 GDPR is generally required. If in doubt, ask your data protection officer.
What is the difference between encryption at rest and end-to-end encryption?
With encryption at rest, data is stored encrypted on the server, but the provider can still process it, for example for search or transcription. With end-to-end encryption, only the participants can read the content – which also means server-side features like AI do not work.
In the User Guide
Step-by-step instructions