EU hosting and server location: Where Bliro stores transcripts

AI This article was created with the help of AI.

Key takeaways

• EU hosting is a chain of four stations: audio stream, transcription, storage, CRM handover - not a single server location.
• In the example case, audio is encrypted and streamed in real time without intermediate buffering; no audio or video recording is ever created.
• Transcription runs on EU servers in Ireland.
• Transcripts and notes are stored in MongoDB Atlas on Microsoft Azure servers in Frankfurt am Main.
• Anyone processing entirely within the EU does not need a third-country transfer basis such as the EU-U.S. Data Privacy Framework or SCCs.

Why "EU hosting" is four questions, not one

You know it from vendor conversations: "Our data is stored in the EU." One sentence, one checkbox, on to the next point. But for you as a CRM manager, that is not an answer. Because an AI sales assistant is not a hard drive with a location. It is a chain of processing steps, and every step can take place somewhere different from the one before it. If you only check the platform's server location, you see one station of the chain and miss three.

The chain has four stations. First: Where does the audio flow while the conversation is happening? Second: Where does the transcription run, and what is left behind there? Third: Where are transcripts and notes stored permanently? Fourth: What goes from the assistant into the CRM, and who hosts that CRM? Each station has its own location, its own sub-processor, and its own transfer basis. A single server statement makes exactly this distribution invisible.

The four questions you can ask any vendor, concretely:

1. Is the audio buffered, cached, or recorded during the conversation, and if so, where?
2. At which company and in which country does the actual transcription - the conversion of speech into text - take place?
3. On which infrastructure and in which region are transcripts and notes stored permanently?
4. Which data leaves the assistant for the CRM, and in which region does the CRM provider host its instances?

As a running example, this article uses a vendor that fully discloses the chain: processing of conversation data takes place in the EU, from real-time streaming through transcription to permanent storage.^[1] The next four sections walk through the stations one by one, exactly as you can question them with any other vendor.

Station 1: Where does the audio flow during the conversation?

The first station is the most sensitive, because this is where most tools differ between what they claim and what technically happens. The question is not "Does the vendor store audio?" but: What happens to the audio signal in the second your sales colleague is speaking in a customer meeting?

In the example case, the conversation audio is encrypted and streamed in real time, without intermediate buffering, to the transcription provider.^[2] The signal is not buffered locally, it does not land in any queue on the device, and it is continuously discarded within seconds once the words have been transcribed. At no point is an audio or video file of the conversation created - neither on servers nor locally.^[3] For you, that means: there is no archive of voice files you would need to account for in your data deletion concept planning.

There is one single, clearly named exception: the optional VoiceID enrollment for speaker identification. A short browser-based recording of your own voice is created and stored securely on the vendor's servers so you don't have to re-enroll it every time you use the tool. Such narrow exceptions should be explicitly named in the vendor documentation and equipped with a deletion logic.^[3]

• Audio is transmitted encrypted via real-time streaming, without intermediate storage
• No local buffer, continuously discarded after the words are transcribed
• No audio or video recording of the conversation, neither locally nor on the server side
• The only exception: the optional VoiceID voice sample, deleted upon re-enrollment or profile deletion

Station 2: Where is transcription done, and what stays there?

The second station is the place where speech becomes text. This is worth a closer look, because a vendor's headquarters tells you nothing about where its subprocessors operate. A company based in Munich can run transcription in the US, and a US-based company can process data in the EU. So always ask about the subprocessor, not the brand.

In the example case, transcription runs at Speechmatics. Speechmatics' models run on servers in Ireland, meaning in the EU, and the finished transcript is returned to the user from there. The audio itself is not stored.^[2] Processing at Speechmatics is governed by their public Data Processing Agreement and is audited through their ISO 27001 certification as well as further external audits.^[2]

In this example, transcription runs in Ireland, not in Germany. Anyone promising "exclusively German servers" is describing storage here, not processing. Both are in the EU, but they are two different locations with two different subprocessors. This is exactly the distinction you should check in every vendor's subprocessor list.

Station 3: Where are transcripts and notes stored permanently?

The third station is the one most relevant to you as a CRM manager: the permanent storage location. This is where the data lives that persists for months, this is where your deletion periods apply, and this is where the data processing agreement comes into play.

In the example case, all conversation transcripts are stored on the vendor's platform, which you access via the website. The transcripts are stored in MongoDB Atlas on German servers of the cloud provider Microsoft Azure in Frankfurt am Main.^[4] The permanent storage location is therefore a German data center site of a major cloud provider, not a data center in a third country.

In this case, the data processing agreement and other legal and compliance documents are available centrally in the vendor's Trust Center.^[4] That is exactly where you should look for the documents you need for your vendor assessment with every vendor.

• Permanent storage: MongoDB Atlas on Microsoft Azure servers in Frankfurt am Main
• Access via the vendor's platform, transcripts and summaries included
• DPA and compliance documents centrally in the Trust Center

Station 4: What goes into the CRM, and who hosts it?

The fourth station is the one most often missing from privacy reviews: the handover. The chain does not end with the assistant. What the assistant produced from the conversation goes into your organization's internal systems, and thus into an infrastructure the AI vendor no longer controls.

In the example case, transcripts and summaries go into the customers' internal systems, such as CRM systems like Salesforce or HubSpot; Microsoft Dynamics 365 and SAP are also natively integrated.^[4][3] From the moment of handover, the infrastructure of the CRM vendor or of your own instance applies, including its region settings. So an AI assistant with EU hosting can feed data into a CRM hosted in a different region, if your instance is configured that way.

As a CRM manager, you should therefore also check the hosting region of your CRM system, not just that of the AI assistant. A chain is only as strong as its weakest link, and the last link belongs to you.

• Native handover to Salesforce, HubSpot, Microsoft Dynamics 365 and SAP
• From handover onward, your CRM instance's region setting applies
• Check both locations: AI assistant and CRM hosting

Third-country transfers, Data Privacy Framework and Standard Contractual Clauses: what is not needed

Why these four stations matter at all becomes clear when it comes to third-country transfers. Transfers of personal data to third countries require a legal basis under Chapter V of the GDPR. Two routes are common: the adequacy decision for the EU-U.S. Data Privacy Framework, adopted by the European Commission on 10 July 2023, or the Commission's modernised Standard Contractual Clauses. Both mean effort: reviewing certification lists, writing transfer impact assessments, adapting clauses, maintaining documentation.^[5][6]

With processing that takes place in Ireland and Frankfurt, this transfer assessment disappears entirely. There is no third-country transfer for you to document, because the processing stays within the EU. The transfer to the UK company Speechmatics is covered by the UK adequacy decision, which the EU Commission renewed on 19 December 2025 and which is limited until 27 December 2031. Standard Contractual Clauses or other transfer mechanisms are not needed for this.^[7]

Even so, you should document which sub-processors exist, in which country each one processes data, and on which legal basis each transfer rests. This documentation is what enables you to respond to an authority request or an audit in minutes instead of days.

• EU processing in Ireland and Frankfurt: no transfer assessment under Chapter V GDPR needed
• UK transfer to Speechmatics: covered by the extended UK adequacy decision
• Document anyway: sub-processors, locations, legal bases for each entry

How to cross-check a vendor's sub-processor list against the DPA

Art. 28 GDPR requires that a processor names its sub-processors and binds them to the same obligations as itself. For you, this means: the sub-processor list is not an appendix you skim over, but the document in which the four stations of the data chain become visible. This is exactly where you cross-check what the vendor promises and what is contractually recorded.

The cross-check runs in four steps:

1. Put the vendor's sub-processor list and the appendix of the data processing agreement (DPA) side by side.
2. Check each entry: Does the stated location match what is written in the DPA appendix?
3. Check each entry: What function does the sub-processor serve, i.e. which of the four stations does it cover?
4. Check each entry: On which transfer basis does the processing rest, if a third country is involved?

Here is what the fully traced chain of the example vendor looks like: The audio is transmitted encrypted via real-time streaming without intermediate buffering, and no recording is created.^[3] Transcription runs at Speechmatics on EU servers in Ireland, bound by a public data processing agreement and audited through their ISO 27001 certification.^[2] Permanent storage of transcripts and notes sits in MongoDB Atlas on Microsoft Azure servers in Frankfurt am Main.^[4] Handover to the CRM happens natively to Salesforce, HubSpot, Microsoft Dynamics 365 and SAP; from there, the region setting of your instance applies. Four stations, four clearly named locations, no gap between claim and contract.

If you want to work through this for your next vendor review, you will find Bliro's sub-processor list and DPA directly in the Trust Center at trust.bliro.io.^[8]

Sources

1. https://help.bliro.io/en/articles/9502217-bliro-and-gdpr
2. https://help.bliro.io/en/articles/7870440-where-does-bliro-process-the-data-it-uses-for-real-time-transcription
3. https://www.bliro.io/de/fakten
4. https://help.bliro.io/en/articles/7870465-where-does-bliro-save-the-transcripts
5. https://ec.europa.eu/commission/presscorner/detail/en/ip_23_3721
6. https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng
7. https://www.datenschutz-guru.de/eu-kommission-verlangert-angemessenheitsbeschlusse-fur-uk
8. https://trust.bliro.io/