--- title: "Privacy & Compliance — Enterprise Security Standards" description: "GDPR compliance, AES-256 encryption, and enterprise-grade security. How Convo meets your organization's compliance requirements." canonical: https://www.itsconvo.com/features/privacy-compliance markdown: https://www.itsconvo.com/features/privacy-compliance.md last-updated: 2026-10-14T22:06:41.000Z --- # Privacy & Compliance > GDPR compliance, AES-256 encryption, and enterprise-grade security. How Convo meets your organization's compliance requirements. Source: https://www.itsconvo.com/features/privacy-compliance Convo is a European-built, GDPR-compliant AI meeting assistant. It captures meeting audio locally on your device, and no recording bot joins the call. Audio is sent only to our transcription provider, which deletes it right after processing and never uses it to train models. Convo encrypts data with AES-256 and gives users full control over their data, deletable anytime. This bot-free, minimal-retention architecture makes Convo suitable for confidential sales calls, legal discussions, and regulated industries in Europe and beyond. ## Security and compliance, built in. Enterprise-grade security from a GDPR-compliant, European-built AI meeting assistant. Audio is captured locally with no bot, and you stay in control of your data. [Request a DPA](mailto:ivan@itsconvo.com?subject=DPA%20Request&body=Hi%2C%20I%20would%20like%20to%20request%20a%20Data%20Processing%20Agreement%20for%20our%20organization.) [Security whitepaper](https://www.itsconvo.com/security-whitepaper-convo.pdf) ## The paperwork your legal team asks for. A DPA, residency options, and every sub-processor named. ### Data Processing Agreement A GDPR-compliant DPA covering our processing activities, so your organization meets its regulatory requirements for conversation data. - GDPR Article 28 compliant - Standard contractual clauses - Data minimization guarantees [Request a DPA](mailto:ivan@itsconvo.com?subject=DPA%20Request&body=Hi%2C%20I%20would%20like%20to%20request%20a%20Data%20Processing%20Agreement%20for%20our%20organization.) ### Data residency Flexible residency options to meet your geographic and regulatory requirements. - US data centers (default) - EU data residency on request - Regional compliance support [Discuss options](mailto:markus@itsconvo.com?subject=Data%20Residency%20Options&body=Hi%2C%20I%20would%20like%20to%20discuss%20data%20residency%20options%20for%20our%20organization.) ### Consent management Consent workflows for multi-party conversations, so recording stays ethical and compliant. - Consent wording you can copy - Granular permission controls - Delete any call at any time [View framework](https://www.itsconvo.com/consent-management-framework-convo.pdf) ## Everything a security review needs. Policies, whitepapers, and reports, ready to download. Available ### Data Processing Agreement GDPR-compliant DPA template [Download PDF](https://www.itsconvo.com/data-processing-agreement-convo.pdf) Available ### Security Whitepaper Technical security overview [Download PDF](https://www.itsconvo.com/security-whitepaper-convo.pdf) Available ### Incident Response Policy Security incident procedures [Download PDF](https://www.itsconvo.com/incident-response-policy-convo.pdf) Available ### Data Retention Policy Retention and deletion procedures [Download PDF](https://www.itsconvo.com/data-retention-policy-convo.pdf) Available ### Consent Management Framework Multi-party consent workflows [Download PDF](https://www.itsconvo.com/consent-management-framework-convo.pdf) Coming soon ### Penetration Test Report Third-party security assessment [Get notified](mailto:ivan@itsconvo.com?subject=Pen%20Test%20Report) ## A security program across every domain. Access, data, infrastructure, and incident response. ### Access controls & authorization Live Multi-factor authentication In progress Role-based access control Completed Access audit logging In progress Regular access reviews In progress ### Data protection & privacy Live AES-256 encryption Completed Automated backups Completed Data minimization Completed Secure data deletion Completed ### Infrastructure security Live 24/7 monitoring Completed Automated patching In progress Network segmentation In progress Intrusion detection In progress ### Incident response & compliance Live Incident detection Completed Response procedures Completed Customer communication Completed Regulatory reporting In progress ## The specifics, in writing. Policies and timelines you can hand to procurement. ### Data retention & deletion Conversation retention Until you delete it Similarity index segments Deleted after 60 days Data deletion on request Within 30 days Account deletion Within 30 days ### Incident response Initial response time < 1 hour Customer notification Within 72 hours Regulatory reporting As required Incident contact ivan@itsconvo.com ### Access & audit Access audit logging In progress Security questionnaires Answered by the founders Penetration test Not yet commissioned SOC 2 Targeting 2027 ### Data processing Primary data location United States Encryption in transit TLS 1.3 Encryption at rest AES-256 Subprocessor updates 30 days notice ### Sub-processors: AI & transcription AssemblyAI Transcription, US Soniox Polish transcription, EU OpenAI AI suggestions, US Anthropic AI suggestions, US Google AI suggestions, US ### Sub-processors: infrastructure Neon Postgres, AWS us-east-1 Railway Similarity index Cloudflare R2 Files and recordings Vercel Web app and API Sentry Error monitoring Brevo Product email Stripe Billing FAQ ## Security & compliance questions **Is Convo a GDPR-compliant AI meeting assistant built in Europe?** Yes. Convo is a European-built AI meeting assistant that operates under GDPR: AES-256 encryption in transit and at rest, Data Processing Agreements available, every sub-processor named on this page, and your conversations are never used to train AI models. Audio is captured locally on your device and no bot joins the call. **How long do you retain conversation data?** We keep your conversation data until you delete it. There is no automatic expiry. You can delete any call from your dashboard or with the API, and if you want everything gone, ask us and we remove your account and its conversation data within 30 days. The similarity index that powers search holds transcript segments for 60 days and then drops them. **Who has access to our data?** Convo is a two-person company, so access to customer data is limited to the two founders, and only when support or debugging requires it. We use role-based access controls. Customer data is never used for training AI models and is never shared with third parties beyond the sub-processors named on this page. **What happens if you experience a security breach?** We have an incident response plan, published on this page, and we begin response within 1 hour of confirming an incident. Customers are notified within 72 hours of any incident affecting their data, and we provide a written incident report including remediation steps. **Can we delete our data at any time?** Yes. Delete any conversation from your dashboard or with the API at any time. If you want everything removed, ask us and we delete your account and its conversation data within 30 days. **Do you offer EU data residency for GDPR?** Conversation data is stored in the United States today, with Neon on AWS us-east-1, and transfers run under the standard contractual clauses. EU data residency is available on request: tell us what your policy requires and we will scope it with you before you sign, rather than after. **How do you ensure conversation consent compliance?** Convo does not run a consent workflow on your behalf. Telling the people in the meeting that the call is being captured is your responsibility under your own law, and our consent framework document gives you wording you can put in a calendar invite or say at the top of a call. No bot joins the call, so nothing announces itself for you. **Is Convo compliant with SOC 2 and HIPAA?** Convo is GDPR compliant and provides Data Processing Agreements. SOC 2 is in progress and we are targeting certification in 2027; we will update this page when it is certified rather than claim it early. We do not currently offer HIPAA compliance or sign BAAs, so Convo is not the right fit for teams handling protected health information. For data privacy we use AES-256 encryption, role-based access, and local audio capture with no bot in the call. **Does Convo offer compliance-grade redaction and searchable audit trails?** Not today. Convo does not redact sensitive content, and we do not keep a searchable audit trail of who accessed what and when. Access audit logging is in progress and this page will say so when it ships. What you do get: data kept only until you delete it, role-based access, AES-256 encryption, a named sub-processor list, and local capture with no bot in the call. If redaction or an audit trail is a hard requirement for your review, tell us early and we will say plainly whether we can meet it. **How do you handle GDPR compliance?** Convo is GDPR compliant with built-in privacy controls including data minimization, right to erasure, and data portability. We provide Data Processing Agreements (DPAs) and maintain records of processing activities. **What is your approach to security patching?** Convo runs on managed platforms, so Vercel, Neon, Railway and Cloudflare handle infrastructure and operating-system patching. We apply application dependency updates ourselves, prioritised by severity and shipped without undue delay on our normal release cycle. **How can we audit your security practices?** We provide security questionnaire responses and the documentation on this page. Convo is founder-run, so the founders answer your questionnaire directly instead of routing it through a security team, and will join a call with your reviewers. ## Questions about compliance? The founders answer security questionnaires directly and will join a call with your reviewers. See the [enterprise plan](https://www.itsconvo.com/enterprise) for what's included, or the [vendor profile](https://www.itsconvo.com/vendor-profile) for procurement details. [Ask a security question](mailto:ivan@itsconvo.com?subject=Security%20Inquiry) [Enterprise inquiries](mailto:markus@itsconvo.com?subject=Enterprise%20Compliance)