Data protection
GDPR-compliant transcription for research interviews
Recordings are processed and stored in the EU, the transcription service keeps no copy once the transcript lands, and the data processing agreement and sub-processor list are published. All of it applies on the free plan.
What is guaranteed, on every plan
Processed and stored in the EU
The application and its storage sit in European regions and audio is transcribed on a European endpoint running in AWS Dublin, with the processor contracting to keep the data in region. No plan routes audio elsewhere.
No copy left behind
The transcription service deletes its copy once the transcript lands, which is verified end to end in production rather than only contracted for. Your own recordings and transcripts stay until you delete them.
The Article 28 paperwork, published
The data processing agreement and the sub-processor list with countries are on the site, readable before you sign up, on Free as well as paid plans. Nothing here is gated behind a sales conversation.
Six questions to put to any transcription vendor
The same six appear on ethics applications, university procurement reviews, and supplier assessments. They are worth asking before a recording moves rather than after.
- Is there a written data processing agreement?
- Article 28 requires one between controller and processor before any personal data moves, and it has to be in place before the first file transfers rather than after. Ask whether it is available without a sales call, and on the plan you actually intend to use.
- Where is the audio processed, and by whom?
- The vendor is rarely the only party. Most transcription products call a speech recognition service underneath, which is a sub-processor in its own right and often sits in a different country from the application. Ask for the list and the countries, not just the vendor's own location.
- What leaves the EEA, and under what safeguard?
- Sending recordings to a processor outside the EEA is an international transfer, which needs an adequacy decision, standard contractual clauses, or another approved mechanism. A vendor with EU-resident storage and a US transcription engine is still making a transfer.
- How long is anything retained, and can that be configured?
- Retention is the question ethics committees ask most precisely, because consent forms usually name a period. Ask what the processor keeps after the transcript is produced, whether zero retention is available at all, and whether configuring it requires a paid tier or an account manager.
- Is the material used to train models?
- Ask about the vendor and the sub-processor separately, and ask for the answer in the terms rather than in the marketing. Some products train by default below their enterprise tier, and some distinguish training their own systems from sharing data externally.
- Who else can access the recordings?
- Human review is a legitimate part of some services. Where it exists, the committee will want to know who those reviewers are and under what obligation they work.
Where the tools land
Residency and retention on the plans a researcher or a small team can actually buy, rather than on an enterprise tier.
| Data handling | Phonotheca | Otter.ai | Trint | Happy Scribe |
|---|---|---|---|---|
| EU processing on the entry paid plan | Included | Not included | Not included | Included |
| EU processing at any price | Included | Not included | On Business, quoted | Included |
| What the service retains afterwards | Nothing once the transcript lands | Retention configured through an account manager, on a paid tier | Not published | Files kept until you delete them |
Residency answers a written requirement, not every requirement
In UK, Irish, Dutch, and Nordic institutions the jurisdictional requirement is usually written down, and in any project whose ultimate client sits in Europe it tends to be contractual. Those are the cases where an EU-resident processor settles the question outright.
Elsewhere the gate is procurement rather than geography. Universities require an approved supplier, and the approved lists published in this category are still human typing bureaux. What opens that door is documentation, which is why the DPA, the sub-processor list, and the governance statement are public pages rather than attachments sent after a call.
The honest limit is certification. Where a procurement form requires SOC 2 Type II, this does not have one and larger vendors do.
For US institutional review insteadThe same terms on every plan
EU processing, zero retention, and the published DPA are not gated by tier.
Free
Enough to see a corpus take shape.
$0forever
3 audio hours, once
- Unlimited projects, interviews, and tags
- Full-text search across every transcript
- Markdown, CSV, and REFI-QDA export
Solo
A study's worth of interviews, every month.
$12per month
20 audio hours a month
- Hours reset on your renewal date
- Everything in Free, never gated
Pro
RecommendedFor a fieldwork season or a whole cohort.
$29per month
50 audio hours a month
- Hours reset on your renewal date
- Everything in Solo
Prices are in USD, tax added at checkout. Compare the plans
Common compliance questions
- Is AI transcription allowed under GDPR at all?
- Yes. Nothing in the regulation prohibits automated processing of interview recordings. What it requires is a lawful basis, a written processor agreement, a safeguard for any transfer outside the EEA, data minimisation, and retention you can state. A transcription product meets those or it does not, and the answer is the same whether a person or a model produces the text.
- Does EU hosting alone make a tool compliant?
- No, and residency has stopped being a useful shortcut. Several European transcription tools now host in the EU, so the question moves to the things underneath it, which sub-processors are involved, what they retain, and whether the paperwork exists on the plan you are on rather than on an enterprise tier.
- What do I paste into my ethics application?
- The data governance statement is written to be linked or quoted directly. It names the processors and countries, states retention, confirms the signed DPA, and states that nothing trains on customer content. Consent templates in circulation ask for a link to the vendor's data governance statement, and that page is the link.
- Do you have SOC 2 or a HECVAT?
- Neither, currently. Where procurement requires SOC 2 Type II, larger vendors including Happy Scribe hold it and this does not. What is available is the DPA, the sub-processor list with countries, EU-only processing, and a governance statement written against the questions review boards ask.
- Is the free plan covered by the same terms?
- Yes. EU processing, zero retention at the transcription service, the published DPA, and no training on customer content apply on Free exactly as on Solo and Pro. Nothing about data handling is a paid feature.
- What about UK data protection after Brexit?
- The UK GDPR keeps the same structure, and the EU holds an adequacy decision for the UK, so EU-resident processing is a straightforward answer for a UK institution. UK universities are among the places where a written jurisdictional requirement appears most often.
- Can I get a signed copy of the DPA?
- Yes. The published version is the one that applies, and a countersigned copy for your records comes on request.
- Where does US institutional review fit?
- Differently, and it has its own page. Across IRB and campus IT guidance the requirement is a named processor and a data classification level rather than a European address, so /us-research-data answers those questions in the order those forms ask them.
Keep reading
Send the governance statement to your committee
It answers the six questions above in the order the forms ask them.