GDPR-compliant AI note takers: 31 meeting tools checked

United States: Avoma hosts all its software in Amazon Web Services facilities in the USA

“Avoma hosts all its software in Amazon Web Services (AWS) facilities in the USA.”

Source: avoma.com · Checked on 19 October 2026

DPA in the terms.

Yes: the Avoma Data Processing Addendum is part of the Terms of Use by reference and is published at avoma.com/data-processing-addendum; it includes EU standard contractual clauses

“The terms of the Avoma Data Processing Addendum”

Source: avoma.com · Checked on 19 October 2026

Published.

Yes, public list at trust.avoma.com/subprocessors with 15 entries; AI providers listed: OpenAI, Anthropic, Baseten, plus Braintrust (AI observability); transcription by Deepgram and Rev

“Here are the subprocessors that Avoma uses to process data in its infrastructure and business operations.”

Source: trust.avoma.com · Checked on 19 October 2026

On the list.

Active (Avoma; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Customer personal data is returned or deleted within 30 days after the service ends, or sooner on request; retention periods during the subscription are not specified

“Avoma will return Customer Personal Data to Customer or delete such data within thirty (30) days after termination of the Services or sooner upon Customer’s request.”

Source: avoma.com · Checked on 19 October 2026

2 named: SOC 2 Type II and ISO/IEC 42001:2023; GDPR support is claimed but not as a certificate

“We maintain SOC 2 Type II and ISO/IEC 42001:2023 certifications and support GDPR compliance.”

Source: avoma.com · Checked on 19 October 2026

No opt-out described. Gong's trust page says customer data is never used to train generative AI, so nothing to switch off for that; the privacy policy's AI/machine-learning product-improvement purpose has no opt-out stated.

“No. Your data is never used to train generative AI models, and it’s never shared with or exposed to the public domain.”

Source: gong.io · Checked on 19 October 2026

United States by default (AWS); EU storage on AWS is available to new customers.

“New Gong customers can decide to store their data in data centers in either the US or EU. The default storage location is in the US.”

Source: help.gong.io · Checked on 19 October 2026

EU hosting available.

Yes. New customers can choose to store data in EU data centres (AWS); the default is the US. The page does not say which plans or how it is requested.

“New Gong customers can decide to store their data in data centers in either the US or EU.”

Source: help.gong.io · Checked on 19 October 2026

DPA on request.

Yes. The Gong DPA is incorporated into the Terms and Conditions by reference and prevails over them on data protection; no separate signing needed.

“The terms of the Gong Data Processing Addendum (“DPA”) are hereby incorporated by reference and govern Gong’s Processing of Personal Data included in Customer Data.”

Source: gong.io · Checked on 19 October 2026

Published.

Yes, public list at https://www.gong.io/legal/sub-processors: 9 entries. AI/cloud providers: Amazon Web Services, Google Cloud EMEA, Microsoft Ireland (application AI functionality); no other model vendor named.

“This page provides the name, purpose and location for each Sub-processor.”

Source: gong.io · Checked on 19 October 2026

On the list.

Active (Gong; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.gov · Checked on 19 October 2026

Up to 3 years or the contract duration, whichever is shorter; a custom period can be requested (admins configure retention). All data is permanently deleted 30 days after contract termination.

“By default, Gong retains customer data for up to three years or the duration of your contract — whichever is shorter.”

Source: gong.io · Checked on 19 October 2026

6 certifications named: SOC 2 Type 2, ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018 and ISO/IEC 27701; the trust page also lists PCI DSS SAQ-D and a CSA STAR registry entry.

“ISO/IEC 27001:2022 Information Security Management System (ISMS) ISO/IEC 27017 Information security controls for cloud services”

Source: gong.io · Checked on 19 October 2026

United States: all software is hosted on AWS in the USA

“Grain hosts all its software in Amazon Web Services (AWS) facilities in the USA.”

Source: grain.com · Checked on 19 October 2026

Published.

Yes, public list at grain.com/grain-subprocessors: 18 entries (7 with access to recordings or payment data, 11 with basic data); AI providers: Anthropic, OpenAI, AssemblyAI, Rev AI

“The following processors have access to video/audio streams, recordings of meetings, and/or payment information:”

Source: grain.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Grain Intelligence'

Source: dataprivacyframework.gov · Checked on 19 October 2026

Admins can set a workspace-wide auto-deletion period for recordings and anyone can delete individual recordings at any time; no default period stated

“Set workspace-wide auto-deletion policies to automatically delete recordings after a defined period.”

Source: support.grain.com · Checked on 19 October 2026

1 named: SOC 2 Type II

“Grain is SOC 2 Type II certified.”

Source: grain.com · Checked on 19 October 2026

European Economic Area, on Amazon Web Services servers.

“Personal data processed by RINGO on behalf of the Client and RINGO’s websites and databases are hosted by Amazon Web Services on servers located in the European Economic Area”

Source: modjo.ai · Checked on 19 October 2026

EU hosting available.

Yes, by default: data is hosted in the EEA, and the DPA says data processed by the AI features is hosted exclusively within the EU. No setting is needed.

“All data processed within this framework is hosted exclusively within the European Union, in accordance with the requirements of the RGPD.”

Source: modjo.ai · Checked on 19 October 2026

DPA on request.

Yes: a Data Processing Agreement is attached to the Order Form and the General Terms, so it applies to every client contract.

“This Data Protection Agreement is attached to the Order Form and the General Terms and Conditions of Sales Modjo.”

Source: modjo.ai · Checked on 19 October 2026

Published.

Yes, public: https://www.modjo.ai/en/trust-center/subprocessors lists 9 entries, all marked EU. AI providers: OpenAI, Microsoft, Google Cloud Platform. Also AWS, Datadog, Sentry, Deepl, Recall, Neo4j.

“OpenAI is used for AI capabilities, such as smart recording summarisation, automatic CRM filling, and the generation of personalised content for strategic and commercial purposes.”

Source: modjo.ai · Checked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, RINGO SAS trading as Modjo, Neuilly-sur-Seine, France)

“These General Terms and Conditions (hereinafter “T&Cs”) are applicable to commercial relations between the company RINGO (trading under the name MODJO), a simplified joint stock company”

Source: modjo.ai · Checked on 19 October 2026

Admins set the retention period for recordings and transcripts (Security Settings > Data Retention Policy); new clients since 20 Nov 2024 get defaults, changeable any time. AI subcontractors keep data up to 90 days. After termination data is inaccessible in 24 hours, deleted from production after 30 days.

“The retention period can be set by the client. For new clients since November 20, 2024, default retention periods have been introduced. The Client may change these retention periods at any time.”

Source: modjo.ai · Checked on 19 October 2026

No: AI features cannot be switched off. The DeepL translation sub-processor only receives data when a user activates translation for a record.

“Artificial intelligence features are an integral part of the product and cannot be deactivated.”

Source: modjo.ai · Checked on 19 October 2026

Japan: data is stored in an AWS data centre in Tokyo

Source: support.notta.ai · Checked on 17 October 2026

Japan (EU adequacy).

Not applicable (vendor in Japan; the DPF covers US organisations). Search 'Notta' returned no results

Source: dataprivacyframework.gov · Checked on 18 October 2026

Files stay until deleted; deleted files are removed from the Trash after 30 days. Workspace-wide auto-deletion is an Enterprise feature

Source: support.notta.ai · Checked on 17 October 2026

SOC 2 Type II and ISO 27001; Notta also lists GDPR, CCPA, APPI and HIPAA compliance

Source: notta.ai · Checked on 17 October 2026

Partly. Business owners can block public sharing, hide the member list, lock email changes and restrict access by IP address; disabling AI features is Enterprise only

Source: support.notta.ai · Checked on 17 October 2026

Trains on your data, with no documented way to stop it.

Yes for Rev's own speech-recognition and AI models: customer content is analysed by them and can be used for continuous training. Rev says it is not used to train any generative AI model, and the models are not shared with third parties.

“your Customer Content will be analyzed by our ASR models and other Rev artificial intelligence models and may be used for continuous training of those models.”

Source: rev.com · Checked on 19 October 2026

DPA on request.

Yes: the Data Processing Addendum is part of the Terms of Service and applies when Rev processes personal data for the customer; no signing step is described.

“If Rev processes any personal data of individuals on behalf of Customer, the parties agree to comply with the terms of the Data Processing Addendum, the terms of which are incorporated into this Agreement.”

Source: rev.com · Checked on 19 October 2026

Not public.

Yes, within the public DPA (Annex III): 18 entries; 7 apply to Rev.com (AWS, Azure, Google, Recall.ai, CoreWeave, Braintrust, eClerx) and the rest to rev.ai or SmartDepo.law. Mostly US; Speechmatics US/UK, eClerx India. Updated list on request to legal@rev.com.

“Rev keeps an up-to-date copy of all Subprocessors available upon request to legal@rev.com.”

Source: rev.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Rev.com'

Source: dataprivacyframework.gov · Checked on 19 October 2026

No fixed period for files and transcripts is published. Rev destroys personal data at the customer's written request; backups can be kept longer. Rev keeps its own call recordings with you for 12 months (not customer content).

“Rev shall destroy all Personal Data at Customer’s written request, except to the extent Applicable Law requires storage of the Personal Data.”

Source: rev.com · Checked on 19 October 2026

SOC 2 Type II, with a SOC 3 report available; PCI compliance as a merchant; GDPR. HIPAA is for the enterprise tier and CJIS for the Unlimited plan, so not Pro. 2 audited reports (SOC 2, SOC 3).

“including CJIS, HIPAA*, SOC 2 Type II compliance, and our SOC 3 report is available for review.”

Source: rev.com · Checked on 19 October 2026

Not listed.

No listing found for search term 'Tactiq'

Source: dataprivacyframework.gov · Checked on 19 October 2026

A meeting can be archived and is then deleted automatically after 30 days, or purged by hand; the terms say content is deleted immediately when the account is cancelled; Business adds advanced data retention

“You can archive a meeting in Tactiq and either wait for it to be deleted automatically in 30 days or purge it from the archive manually.”

Source: help.tactiq.io · Checked on 19 October 2026

2 named: SOC 2 Type II and ISO 27001; the plan table also lists GDPR and HIPAA compliance

“Tactiq has SOC-2 Type II compliance to ensure your meeting data is protected”

Source: tactiq.io · Checked on 19 October 2026

€13.33 / user / mo.

EUR 13.33 per user per month, billed annually (Team plan, 1 to 20 users); VAT treatment not shown

“EUR €13.33 user/mo billed annually”

Source: tactiq.io · Checked on 19 October 2026