VoiceDock · Flireo B.V.
EU-hosted.
You choose the models.
The proof behind VoiceDock's security posture, in one place. EU hosting, a plainly-named sub-processor list, a GDPR-compliant DPA, and where each part of the stack runs.
Data residency
EU hosting
Frankfurt (data) · Nuremberg & Falkenstein (real-time) · Helsinki (voice)
Infrastructure
ISO 27001 · SOC 2
Certified EU cloud regions and hosting
Standard DPA
GDPR Art. 28
Ready to sign, at no additional cost
Sub-processors
16 listed
Every one named, with transfer basis
Compliance & certifications
Certified where it counts, honest about the rest
Certifications are attributed to the layer that actually holds them. We never claim a certification Flireo does not itself hold.
Certified EU infrastructure
Our platform runs on ISO 27001 and SOC 2 Type II certified EU cloud regions and hosting. These certifications are held by our infrastructure providers, not by Flireo.
GDPR & EU transfers
GDPR-aligned by design. Where a sub-processor processes outside the EEA, transfers run under EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Our hosting is EU-only: EU (Germany: Frankfurt for platform data, Nuremberg with a standby in Falkenstein for real-time media; Finland: Helsinki for the VoiceDock voice).
Data Processing Agreement
A ready-to-sign, GDPR Article 28-compliant Standard DPA is included at no additional cost, whichever configuration you run. See the document hub below.
Document hub
Everything a reviewer needs, self-serve
Public documents are readable inline and can be saved as a PDF. Documents marked confidential are released through the reviewer document room once access is approved. Every document is version-controlled, so what you read is always the current version.
Agreements & policies
Data Processing Agreement
Confidential · effective 2026-10-22
Data Processing Agreement — full text
Confidential · effective 2026-10-22
Terms and Conditions
Signed PDF · effective 2026-01-01
Privacy Policy
Readable · effective 2026-10-22
Fair Use Policy
Readable · effective 2026-08-01
Cookie Policy
Readable · effective 2026-10-09
Data & residency
EU Data Sovereignty
Confidential · effective 2026-10-22
Data Retention & Deletion
Confidential · effective 2026-10-06
Sub-processors
Confidential · effective 2026-10-27
Security & resilience
Security Overview
Confidential · effective 2026-10-06
Incident Response & Breach Notification
Confidential · effective 2026-08-01
Business Continuity & Disaster Recovery
Confidential · effective 2026-10-22
Vulnerability Disclosure Policy
Readable · effective 2026-08-01
Knowledge base
Security Questionnaire
Confidential · effective 2026-10-22
Sub-processors
Every sub-processor, named plainly
No hidden parties. Where a processor has a US parent operating in an EU region, we say so and state the transfer basis. Last reviewed 2026-10-06.
| Sub-processor | Purpose | Data residency | Transfer basis | Certifications |
|---|---|---|---|---|
| Hetzner Online GmbHcall audio, orchestration, text spoken by the VoiceDock voice | Voice infrastructure hosting (real-time media and orchestration, and the VoiceDock voice) | Germany (Nuremberg, with a standby in Falkenstein) for real-time media and orchestration; Finland (Helsinki) for the VoiceDock voice, where Hetzner operates the data centre through its affiliate Hetzner Finland Oy (EU). Gunzenhausen is the registered office, not a data centre | EU entity (Germany). No transfer mechanism required | ISO 27001ISO 27018ISO 27701 |
| Supabase, Inc.account data, call records, transcripts, recordings | Managed database and storage hosting | Germany (Frankfurt, eu-central-1) | EU SCCs 2021/914, completed in Schedule 2 of the executed DPA: Module Two where Flireo is controller (account data), Module Three where Flireo is processor on a customer's behalf (call data). Docking clause (Clause 7) excluded; Clause 9(a) Option 2 with a 30-day sub-processor notice period; Clause 17 Option 1, Irish law; Clause 18, courts of Ireland. UK and Swiss addenda included. | SOC 2 Type IIISO 27001 |
| Telnyx LLCcall audio (telephony leg), CDRs, phone numbers, SMS content, SMS sender and recipient numbers, SMS delivery status | Telephony (SIP inbound/outbound, numbers) and SMS | Telephony: EU points of presence. SMS: United States (Telnyx's primary region), with delivery through the recipient's mobile network. | HQ USA, EU SCCs in place | SOC 2ISO 27001 |
| Vercel Inc.dashboard traffic, site traffic | Dashboard and site hosting | EU region functions | HQ USA, EU SCCs in place | SOC 2 Type 2 |
| Stripebilling data | Payment processing | EU / Ireland | EU contracting entity; onward transfer to Stripe, LLC under EU SCCs | PCI DSS Level 1SOC 1/2 |
| Sentry (Functional Software, Inc.)error events, stack traces, request metadata | Server-side application error monitoring (crash reports and stack traces) | EU (Frankfurt, Germany) — organisation data-storage region set to European Union | HQ USA. Their DPA relies primarily on the EU-US Data Privacy Framework, with the 2021/914 SCCs as the stated fallback should the Framework be invalidated. Verified against their published DPA on 2026-07-28. No separate EU entity; their SCC schedule names the Irish Data Protection Commissioner as the competent supervisory authority. | SOC 2 Type IIISO 27001 |
| Resendemail addresses | Transactional email | EU (eu-west-1, Ireland) | HQ USA. Their DPA relies on the EU-US Data Privacy Framework (and its UK extension) alongside the 2021/914 SCCs for transfers out of the EEA. Incorporated automatically on entering their agreement; no separate signature. Verified against their published DPA and terms on 2026-07-28. | SOC 2 |
AI providers
Engaged only when an agent is configured to use them
Which of these apply differs per agent. Two columns matter most to reviewers and are stated plainly: whether the provider trains on call data, and how long they keep it.
| Provider | Purpose | Data residency | Training | Retention |
|---|---|---|---|---|
| Google (Gemini Developer API, via Google AI Studio) | Realtime speech-to-speech, text-to-speech and post-call analysis | No EU data residency on any tier. Google's terms state that data may be stored transiently or cached in any country where Google or its agents maintain facilities, and Google's data-residency product list does not include the Gemini Developer API. Vertex AI is the only EU-resident route. | Not used for model improvement on the paid tier, which applies to any project with an active Cloud Billing account. On the unpaid tier Google does use submitted content to develop its products and human reviewers may read it. | Not published. Google's terms state prompts and responses are logged "for a limited period of time" for policy enforcement, without a number. Zero data retention is available for paid projects on approval. |
| Google (Vertex AI) | Realtime speech-to-speech, language model, speech-to-text, text-to-speech and post-call analysis, when the agent uses Vertex AI | europe-west4 (Netherlands) or Google's EU multi-region, depending on the model, selected at the Google Cloud project and Vertex API level | Not used to train or fine-tune Google models | No persistent storage after the call; implicit caching is disabled at project level. Google may retain prompts up to 90 days in the region of origin where automated safety classifiers flag content for abuse review. |
| Mistral AI | Language model inference and speech-to-text (Voxtral) | European Union by default. A US endpoint exists but is an explicit opt-in that VoiceDock does not use. Core inference runs on Microsoft (Sweden, Norway), CoreWeave (EEA) and their own Mistral Compute (France). Their security tooling provider, CrowdStrike, operates in the EEA and the United States, and their CDN and traffic-routing provider, Cloudflare, operates worldwide from locations close to the customer; neither is an inference path. | Excluded by default on the Scale plan; enabled by default on the free tier. Opt-out is available in the admin console for API traffic. | Thirty rolling days for abuse monitoring. Zero retention exists but is Scale-plan only, stateless endpoints only, and granted on application |
| Gladia | Speech-to-text | VoiceDock uses their EU-West region by default; a US region can be selected per assistant. The contract's Annex I states data localisation as "Europe, USA", and Annex III lists Gladia Inc. (United States) for storage and processing of voice and transcripts; further sub-processors in that annex, including OpenAI, Meta, Together, DeepL, Private AI and Mistral, also have the United States in scope. EU by default, not EU-only. | Excluded. Their privacy notice §1.3 states that the datasets used to test and improve their models are publicly available CC-BY corpora and that "the Datasets do not contain any voice recordings from the use of the AI Service". Separately, their security page confirms paid plans are excluded from model training; only free-plan data is used. | Twelve months. Annex I of the contract defines the data retention period as "the length of time Gladia, as a vendor, stores customer data after it has been processed or received" and sets it at "Standard (12 months)". Zero retention is available as an enterprise feature and Flireo has not taken it, so twelve months applies to call audio and transcripts routed through this provider. |
| Deepgram, Inc. | Speech-to-text | European Union. VoiceDock sends every request to Deepgram's EU endpoint, on which Deepgram states processing stays within the EU. | Excluded. VoiceDock sends Deepgram's model-improvement opt-out with every request. It is fixed in the platform and cannot be switched off per assistant. | Requests sent with the model-improvement opt-out are retained only for as long as needed to process them. |
| ElevenLabs (Eleven Labs Inc.) | Text-to-speech, speech-to-text (Scribe), and realtime voice agents (ElevenLabs Realtime, combining speech recognition, language model and speech synthesis) | Hosting in the United States, the Netherlands and Singapore. EU data residency is an Enterprise feature. Note that residency limits storage only: their documentation states processing may still occur outside the selected location, including by affiliates and sub-processors. Only the combination of EU residency, Zero Retention Mode and API use restricts processing to the EU. | Disabled on Flireo's account. ElevenLabs enables training by default on non-Enterprise accounts, including paid self-serve API use; the "Improve the models for everyone" setting under Terms and privacy, Data use has been switched off on our account, confirmed 2026-07-28. Customers using their own ElevenLabs key control this setting themselves and should check it. | Two years by default for agent conversation data (transcripts and audio recordings held separately), configurable per agent down to scheduled deletion. Zero Retention Mode is Enterprise-only. |
| OpenAI Ireland Ltd | Language model inference, and realtime speech-to-speech through GPT-Live | Outside the EEA by default, primarily the United States. A Europe region (eu.api.openai.com) keeps both storage and processing in the EEA and Switzerland, but it can only be selected when a project is created, cannot be applied to existing projects, and is subject to eligibility via sales. GPT-Live sessions support data residency in the United States and Europe; VoiceDock connects to the default endpoint (api.openai.com). | Not used to train or improve models unless explicitly opted in | Thirty days for abuse-monitoring logs, and that includes GPT-Live sessions (/v1/live/sessions), which carry the call audio. Session storage, which keeps a recording of a completed GPT-Live session for thirty days, is off by default and VoiceDock does not turn it on. The audio transcription and translation endpoints are listed with no retention. Zero retention is available for eligible customers on prior approval, and GPT-Live sessions are eligible. |
| xAI (X.AI LLC) | Realtime speech-to-speech, language model inference and text-to-speech | United States. Their EU privacy addendum states all personal information is processed in the US, and every entry on their sub-processor list is US-based except one UK subsidiary. Marketing pages mention "EU data residency options" but no EU endpoint is documented and the previously indexed regional endpoint now returns not-found. | Not used to train on API inputs or outputs without explicit permission | Thirty days, encrypted at rest, for abuse auditing. Zero data retention is available and, uniquely among these providers, self-serve from the console |
| Inworld (Theai, Inc.) | Text-to-speech | United States. All ten of their published sub-processors are US-located. EU data residency is listed as an Enterprise feature on their pricing page and an EU portal exists, but no technical documentation describes what stays in the EU. | Their terms state they do not train generally available models on non-public materials, except for feedback and content flagged for trust and safety review. Their speech-to-text documentation states audio is never used for training by Inworld or any upstream provider. Their terms also grant a licence to use materials to "operate, maintain, and improve the Services". | Not published. Zero data retention exists but is configured per workspace via their sales team |
On your own API keys. Supplying your own provider key changes who pays, not who processes. We still route the audio and make the call from our infrastructure, so the provider remains our sub-processor and stays on this list. What your key does change is the account settings, which are then yours to control: retention and training defaults differ per provider, and the table above states them.
Security practices
How the platform protects call data
Encryption in transit and at rest
Traffic to and from the dashboard, the API, our AI providers and storage is encrypted in transit; call records, transcripts and recordings are encrypted at rest in the EU region.
Per-tenant isolation
Each organisation's data is isolated: row-level security on every table, and every backend query scoped to one organisation. One customer can never read another customer's calls or configuration.
Vault-managed secrets
Provider keys and credentials are held as managed secrets, never in plaintext config, and scoped to the organisation that owns them.
Bring your own keys (BYOK)
Use your own provider accounts. The provider stays our sub-processor; the account settings, such as retention and training, are yours to control.
GDPR mode
A per-assistant setting in which call transcripts, recordings, summaries and analysis results are not retained. The Standard DPA applies with or without it.
Recording consent
Recording and consent are configurable per assistant, and how long calls are kept is yours to set per organisation, so you can meet the consent and data-minimisation rules your use case requires.
Data residency
Sovereign by architecture, not by promise
The platform is hosted in the EU and stores its data there. Whether call content stays in the EU depends on the AI providers each assistant uses, and the sub-processor list states where each one processes. For workloads that need absolute CLOUD Act immunity, we offer on-premise deployment.
Request the EU data sovereignty explainer- Platform data (DB, storage)
- Frankfurt, eu-central-1
- Real-time media & orchestration
- Nuremberg, standby Falkenstein, Germany
- VoiceDock voice (beta)
- Helsinki, Finland
- Generative AI (Vertex path)
- europe-west4, Netherlands
- Transfer basis outside the EEA
- EU SCCs or Data Privacy Framework
- CLOUD Act immunity option
- On-premise deployment
Not sure which configuration you need?
Answer a few questions and get an indicative view of the VoiceDock configuration that fits your requirements and your likely compliance posture. It is an estimate, not legal advice, and takes about a minute.
Request a security review
Need something for your vendor assessment?
Tell us what your due diligence needs, whether that is the signed DPA, a filled security questionnaire, or a conversation with the people who run the infrastructure. We answer these ourselves.