Convo is a European-built, GDPR-compliant AI meeting assistant. It captures meeting audio locally on your device, and no recording bot joins the call. Audio is sent only to our transcription provider, which deletes it right after processing and never uses it to train models. Convo encrypts data with AES-256 and gives users full control over their data, deletable anytime. This bot-free, minimal-retention architecture makes Convo suitable for confidential sales calls, legal discussions, and regulated industries in Europe and beyond.
Privacy & Compliance
Security and compliance, built in.
Enterprise-grade security from a GDPR-compliant, European-built AI meeting assistant. Audio is captured locally with no bot, and you stay in control of your data.
The paperwork your legal team asks for.
A DPA, residency options, and every sub-processor named.
Data Processing Agreement
A GDPR-compliant DPA covering our processing activities, so your organization meets its regulatory requirements for conversation data.
- GDPR Article 28 compliant
- Standard contractual clauses
- Data minimization guarantees
Data residency
Flexible residency options to meet your geographic and regulatory requirements.
- US data centers (default)
- EU data residency on request
- Regional compliance support
Consent management
Consent workflows for multi-party conversations, so recording stays ethical and compliant.
- Consent wording you can copy
- Granular permission controls
- Delete any call at any time
Everything a security review needs.
Policies, whitepapers, and reports, ready to download.
A security program across every domain.
Access, data, infrastructure, and incident response.
Access controls & authorization
LiveMulti-factor authentication In progress
Role-based access control Completed
Access audit logging In progress
Regular access reviews In progress
Data protection & privacy
LiveAES-256 encryption Completed
Automated backups Completed
Data minimization Completed
Secure data deletion Completed
Infrastructure security
Live24/7 monitoring Completed
Automated patching In progress
Network segmentation In progress
Intrusion detection In progress
Incident response & compliance
LiveIncident detection Completed
Response procedures Completed
Customer communication Completed
Regulatory reporting In progress
The specifics, in writing.
Policies and timelines you can hand to procurement.
Data retention & deletion
Conversation retentionUntil you delete it
Similarity index segmentsDeleted after 60 days
Data deletion on requestWithin 30 days
Account deletionWithin 30 days
Incident response
Initial response time< 1 hour
Customer notificationWithin 72 hours
Regulatory reportingAs required
Incident contactivan@itsconvo.com
Access & audit
Access audit loggingIn progress
Security questionnairesAnswered by the founders
Penetration testNot yet commissioned
SOC 2Targeting 2027
Data processing
Primary data locationUnited States
Encryption in transitTLS 1.3
Encryption at restAES-256
Subprocessor updates30 days notice
Sub-processors: AI & transcription
AssemblyAITranscription, US
SonioxPolish transcription, EU
OpenAIAI suggestions, US
AnthropicAI suggestions, US
GoogleAI suggestions, US
Sub-processors: infrastructure
NeonPostgres, AWS us-east-1
RailwaySimilarity index
Cloudflare R2Files and recordings
VercelWeb app and API
SentryError monitoring
BrevoProduct email
StripeBilling
FAQ
Security & compliance questions
Yes. Convo is a European-built AI meeting assistant that operates under GDPR: AES-256 encryption in transit and at rest, Data Processing Agreements available, every sub-processor named on this page, and your conversations are never used to train AI models. Audio is captured locally on your device and no bot joins the call.
We keep your conversation data until you delete it. There is no automatic expiry. You can delete any call from your dashboard or with the API, and if you want everything gone, ask us and we remove your account and its conversation data within 30 days. The similarity index that powers search holds transcript segments for 60 days and then drops them.
Convo is a two-person company, so access to customer data is limited to the two founders, and only when support or debugging requires it. We use role-based access controls. Customer data is never used for training AI models and is never shared with third parties beyond the sub-processors named on this page.
We have an incident response plan, published on this page, and we begin response within 1 hour of confirming an incident. Customers are notified within 72 hours of any incident affecting their data, and we provide a written incident report including remediation steps.
Yes. Delete any conversation from your dashboard or with the API at any time. If you want everything removed, ask us and we delete your account and its conversation data within 30 days.
Conversation data is stored in the United States today, with Neon on AWS us-east-1, and transfers run under the standard contractual clauses. EU data residency is available on request: tell us what your policy requires and we will scope it with you before you sign, rather than after.
Convo does not run a consent workflow on your behalf. Telling the people in the meeting that the call is being captured is your responsibility under your own law, and our consent framework document gives you wording you can put in a calendar invite or say at the top of a call. No bot joins the call, so nothing announces itself for you.
Convo is GDPR compliant and provides Data Processing Agreements. SOC 2 is in progress and we are targeting certification in 2027; we will update this page when it is certified rather than claim it early. We do not currently offer HIPAA compliance or sign BAAs, so Convo is not the right fit for teams handling protected health information. For data privacy we use AES-256 encryption, role-based access, and local audio capture with no bot in the call.
Not today. Convo does not redact sensitive content, and we do not keep a searchable audit trail of who accessed what and when. Access audit logging is in progress and this page will say so when it ships. What you do get: data kept only until you delete it, role-based access, AES-256 encryption, a named sub-processor list, and local capture with no bot in the call. If redaction or an audit trail is a hard requirement for your review, tell us early and we will say plainly whether we can meet it.
Convo is GDPR compliant with built-in privacy controls including data minimization, right to erasure, and data portability. We provide Data Processing Agreements (DPAs) and maintain records of processing activities.
Convo runs on managed platforms, so Vercel, Neon, Railway and Cloudflare handle infrastructure and operating-system patching. We apply application dependency updates ourselves, prioritised by severity and shipped without undue delay on our normal release cycle.
We provide security questionnaire responses and the documentation on this page. Convo is founder-run, so the founders answer your questionnaire directly instead of routing it through a security team, and will join a call with your reviewers.
Questions about compliance?
The founders answer security questionnaires directly and will join a call with your reviewers. See the enterprise plan for what's included, or the vendor profile for procurement details.