Outreach and the GDPR: AI training, data location and DPA

Trains on your data, with no documented way to stop it.

Yes for call transcription: Outreach says its speech-recognition model trains on your content. No general statement found for other features; terms allow aggregated use of customer data to improve the service. Privacy page says customer data is used 'to provide our service and improve our platforms'.

Vendor's wording: “Outreach's delivers real-time call transcription by using a customized speech recognition model that trains on your content to learn the terms that are important to your business or industry.”

Source: outreach.ioAutomated speech recognitionChecked on 19 October 2026

Amazon Web Services, United States & Ireland (primary hosting). Google Cloud (US & Belgium) is used for storage, AI and enrichment.

Vendor's wording: “Infrastructure and primary hosting provider for Outreach Engage and data warehouse for all Outreach products. United States & Ireland”

Source: outreach.ioInfrastructure SubprocessorsChecked on 19 October 2026

EU hosting available.

Yes: Outreach says EU citizen data is hosted in the EU for customers with data-residency requirements; how it is switched on and which plan is not described.

Vendor's wording: “We support customers with organizational requirements around data residency, with EU citizen data hosted in the EU.”

Source: outreach.ioData localizationChecked on 19 October 2026

DPA in the terms.

Yes. A Data Processing Agreement is incorporated by reference into the Terms of Service.

Vendor's wording: “each Party will comply with the obligations set forth in this Data Processing Agreement, which is incorporated by reference into these Terms.”

Source: outreach.ioYour DataChecked on 19 October 2026

Published.

Yes: https://www.outreach.io/sub-processors, 32 entries (last modified July 13, 2026). AI/model providers listed: Anthropic, OpenAI (platform LLM providers), Google Cloud (Gemini), Microsoft Azure, Databricks (ML/AI models).

Vendor's wording: “Anthropic, PBC Outreach Platform LLM Provider United States”

Source: outreach.ioList of Outreach Sub-ProcessorsChecked on 19 October 2026

On the list.

Active (Outreach; EU-US DPF, Swiss-US DPF, UK Extension)

Source: dataprivacyframework.govSearch 'Outreach'Checked on 19 October 2026

Admins can set retention rules for voice recordings, meeting recordings and emails; admins can process right-to-be-forgotten deletions. No fixed default or post-cancellation deletion period is published.

Vendor's wording: “We enforce company policies for retention of Outreach Voice recordings, Meeting recordings, and Emails with flexible configurations based on the length of times data should be stored prior to deletion.”

Source: outreach.ioData retentionChecked on 19 October 2026

6 named: SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, HIPAA, Cloud Security Alliance STAR.

Vendor's wording: “### SOC 2 Type II ### ISO 27001 ### ISO 27701 ### ISO 42001 ### HIPAA ### Cloud Security Alliance (CSA)”

Source: outreach.ioComplianceChecked on 19 October 2026