Noota and the GDPR: AI training, data location and DPA

Doesn't train on your data.

No: Noota says conversations are not used to train its models or anyone else's, on any plan including Free.

Vendor's wording: “Your conversations are not used to train our models, or anyone else's, on any plan including Free.”

Source: noota.ioThree things we never do - Never trainChecked on 19 October 2026

For EU customers: data centres in Belgium and the Netherlands, on Google Cloud Platform.

Vendor's wording: “For EU customers, in data centres in Belgium and the Netherlands, on Google Cloud Platform.”

Source: noota.ioFAQ: Where is my data stored?Checked on 19 October 2026

EU hosting available.

Yes by default: EU customer data stays in the EU. A stricter sovereign environment (Scaleway in Paris, European sub-processors only) is an Enterprise option, not part of Business.

Vendor's wording: “The sovereign environment is an Enterprise option: hosting on Scaleway in Paris and on Bleu, a SecNumCloud trusted cloud, with Mistral and open-weight models.”

Source: noota.ioHosting: SovereignChecked on 19 October 2026

DPA in the terms.

Yes, a DPA exists and is shared through Noota's Trust Center after a quick review by Noota; the page does not tie it to a particular plan.

Vendor's wording: “Request access in the trust center: the ISO 27001 certificate, the penetration testing reports, the security assurance plan, the policies, the DPA and the AI Act analysis are shared after a quick review by our team.”

Source: noota.ioFAQ: How do I get the security documentationChecked on 19 October 2026

Published.

Yes, public: 7 providers on the security page and in the trust centre (https://trust.noota.io/): Google Cloud Platform, Scaleway, Mistral AI (language models), Gladia (transcription), Recall, Brevo, Bastion Technologies. Page also names Claude, Gemini via Vertex AI.

Vendor's wording: “The live list is published in the trust center, with update notifications.”

Source: noota.ioSub-processors: Seven providers, all hosted in EuropeChecked on 19 October 2026

EU or Swiss vendor.

Not applicable (EU-based vendor, NOOTA, Toulouse, France)

Vendor's wording: “NOOTA, located at 13 Rue Sainte Ursule 31000 Toulouse and registered with the Registre du Commerce et des Sociétés de Toulouse under the number 888965951”

Source: noota.ioOpening paragraphChecked on 19 October 2026

Any meeting can be deleted at any time and is erased from production and backups within 24 hours. Admin-set retention (1 day to 3 years) is for Enterprise; Business has unlimited storage. Free accounts archive after 30 days. All data is purged when the contract ends.

Vendor's wording: “Delete any meeting at any time: it is erased from production and backups within 24 hours, with no delayed copies.”

Source: noota.ioFAQ: Can I delete my dataChecked on 19 October 2026

ISO 27001 certified and SOC 2 Type II. The trust centre says it publishes 6 compliance certifications in total; only the ISO 27001 certificate is listed by name, and certificates are request-only.

Vendor's wording: “Yes. Noota is ISO 27001 certified.”

Source: trust.noota.ioFAQ: Does Noota have ISO 27001 certification?Checked on 20 October 2026

Partly: admins can switch sentiment analysis off for the whole organisation, and users or admins can turn Noota off for specific meetings. No single switch for all AI features is described. Business adds 'admin controls'.

Vendor's wording: “Administrators can switch sentiment analysis off for the whole organisation.”

Source: noota.ioControls: User privacy controlsChecked on 19 October 2026