Convo is a European-built, GDPR-compliant AI meeting assistant. It captures meeting audio locally on your device, and no recording bot joins the call. Audio is sent only to our transcription provider, which deletes it right after processing and never uses it to train models. Convo encrypts data with AES-256 and gives users full control over their data, deletable anytime. This bot-free, minimal-retention architecture makes Convo suitable for confidential sales calls, legal discussions, and regulated industries in Europe and beyond.

Privacy & Compliance

Security and compliance, built in.

Enterprise-grade security from a GDPR-compliant, European-built AI meeting assistant. Audio is captured locally with no bot, and you stay in control of your data.

The paperwork your legal team asks for.

A DPA, residency options, and consent workflows, ready to go.

Data Processing Agreement

A GDPR-compliant DPA covering our processing activities, so your organization meets its regulatory requirements for conversation data.

  • GDPR Article 28 compliant
  • Standard contractual clauses
  • Data minimization guarantees
Request a DPA

Data residency

Flexible residency options to meet your geographic and regulatory requirements.

  • US data centers (primary)
  • EU data centers (Q3 2026)
  • Regional compliance support
Discuss options

Consent management

Consent workflows for multi-party conversations, so recording stays ethical and compliant.

  • Multi-party consent workflows
  • Automated consent documentation
  • Granular permission controls
View framework

Everything a security review needs.

Policies, whitepapers, and reports, ready to download.

Available

Data Processing Agreement

GDPR-compliant DPA template

Download PDF
Available

Security Whitepaper

Technical security overview

Download PDF
Available

Incident Response Policy

Security incident procedures

Download PDF
Available

Data Retention Policy

Retention and deletion procedures

Download PDF
Available

Consent Management Framework

Multi-party consent workflows

Download PDF
Coming soon

Penetration Test Report

Third-party security assessment

Get notified

A security program across every domain.

Access, data, infrastructure, and incident response.

Access controls & authorization

Live
Multi-factor authentication Completed
Role-based access control Completed
Access audit logging Completed
Regular access reviews In progress

Data protection & privacy

Live
AES-256 encryption Completed
Automated backups Completed
Data minimization Completed
Secure data deletion Completed

Infrastructure security

Live
24/7 monitoring Completed
Automated patching Completed
Network segmentation In progress
Intrusion detection Completed

Incident response & compliance

Live
Incident detection Completed
Response procedures Completed
Customer communication Completed
Regulatory reporting In progress

The specifics, in writing.

Policies and timelines you can hand to procurement.

Data retention & deletion

Default retention period30 days
Maximum retention (configurable)7 years
Data deletion on requestWithin 30 days
Account termination cleanupWithin 90 days

Incident response

Detection time (goal)< 15 minutes
Initial response time< 1 hour
Customer notificationWithin 72 hours
Regulatory reportingAs required

Access & audit

Access log retention1 year
Data access monitoringReal-time
User access reviewsQuarterly
Audit report availabilityUpon request

Data processing

Primary data locationUnited States
Encryption in transitTLS 1.3
Encryption at restAES-256
Subprocessor updates30 days notice

FAQ

Security & compliance questions

Questions about compliance?

Our security team can walk through your requirements and share documentation. See the enterprise plan for what's included, or the vendor profile for procurement details.