Choosing a GDPR-compliant collaboration tool: the checklist

• Is there a data processing agreement (DPA) under Art. 28 GDPR, and how do you conclude it?
• Who is controller and who is processor for which data?
• Are the technical and organisational measures (TOMs) described?
• Is there a list of subprocessors with their location?
• How are you told about new subprocessors?

• Where are database, files, backups and the media servers for calls?
• Which data leaves the EU – and why?
• On which basis are transfers made: adequacy decision, EU–US Data Privacy Framework, standard contractual clauses?
• Which law is the provider subject to, and where is it based?

• Are connections encrypted, and is content encrypted at rest?
• Is end-to-end encryption available – and what doesn't work then (search, AI, recording)?
• Who manages the keys?
• Are there roles and permissions down to single rooms?
• Single sign-on, two-factor authentication, enforced for everyone if needed?
• Is there an audit log of admin actions and accesses?

• Where do transcription, translation and summaries run – with the provider or with an external AI service?
• Is content used to train models?
• Can AI features be switched off per organisation, space or meeting?
• Can individual people object to being transcribed?
• Can people see which AI features processed their content?

• Can you set retention periods, for example for recordings?
• Is there a deletion concept – including backups?
• Can every person export their own data (Art. 15 and 20 GDPR)?
• Can you export a whole workspace, and in which formats?
• What happens to your data when the contract ends?

DPA

For content in organisation spaces, Coviqo is the processor under Art. 28 GDPR. On Business and Enterprise, admins read, download and conclude the DPA in the organisation settings.

Location

Database, files, backups, media servers for calls and the AI run in data centres in Germany. The operator is based in Luxembourg. Details on Why Europe.

Subprocessors

Listed with purpose and location on Why Europe and in the privacy policy – the same list in both places.

Third countries

Cloudflare (USA) protects website and app and processes connection data. Payments run through Stripe. Sign-in providers and integrations only when you choose them. Basis: Data Privacy Framework or standard contractual clauses.

Encryption

TLS for all connections. Content is stored encrypted with a separate key per space (AES-256-GCM) – server-side, not end-to-end. Direct messages can be end-to-end encrypted on every plan, whole rooms from Business.

Access control

Roles and permissions per space, category and room, two-factor authentication, audit log. Single sign-on (SAML, OIDC, SCIM) and required MFA from Business.

AI

Transcription, translation and summaries run on Coviqo's own servers. Content is not sent to external AI providers and not used to train third-party models. Anyone can opt out of being transcribed.

Deletion

Deleted accounts are erased after a grace period (14 days by default). Backups are kept for at most 12 months. When a space is permanently deleted, its key is deleted too. Organisations can shorten retention periods for recordings.

Export

Every person can export their data as a ZIP archive with a PDF report. Space owners and admins can export a whole space – rooms, messages, notes, tasks, events, members and files.

More on technical measures: Security.