GDPR and EU hosted video conferencing

EU hosted is not the same as GDPR compliant. This guide explains the difference, what to ask a vendor, and what the big tools say about where your calls run.

By RespireSoft. Published 1 November 2026. Prices and product status checked 1 November 2026. 7 min read.

If you work with people in the EU, you will be asked whether your video conferencing tool is "GDPR compliant". The honest answer is that a tool cannot be compliant on its own. You are compliant, or not, depending on how you use it. A tool can make that easy or hard. This post explains what matters, what the main vendors say on their own pages (checked on 1 November 2026) and what to ask before you sign. It is not legal advice. If the stakes are high, talk to a data protection lawyer or your own data protection officer.

A video call creates personal data: faces, voices, names, email addresses, IP addresses, chat, recordings, transcripts and sometimes the content of what people say. Under GDPR, you decide why and how that data is used, which makes you the controller. The vendor that runs the call for you is usually the processor. Four things follow.

You need a lawful reason to process the data, such as a contract or consent. Recording a meeting usually needs people to be told, and sometimes needs their consent.
You need a data processing agreement with the vendor (GDPR Article 28). It says what the vendor may do with the data, which sub-processors it uses and how it helps you answer requests.
Transfers outside the EU need a basis. That can be an adequacy decision, such as the EU-US Data Privacy Framework for certified US companies, or standard contractual clauses.
You keep data only as long as you need it. That includes recordings and transcripts.

None of this says the servers must be in the EU. Hosting in the EU simply makes the transfer question smaller. It does not remove the other duties, and a US company's EU data centre can still involve staff or support outside the EU.

EU hosted, EU owned, EU only#

Vendors use these words loosely, so separate them.

EU hosted: the servers that carry your calls are in the EU.
EU data at rest: recordings, transcripts and files are stored in the EU, while live traffic may go elsewhere.
EU owned: the company is based in the EU, which can matter if you worry about non-EU laws reaching the data.
EU only sub-processors: every company that touches the data, including speech and translation services, is in the EU.

Ask which of these a vendor means. The last one is the hardest to promise, and the one that matters most if you use captions or AI.

What the main vendors say#

Zoom#

Zoom's GDPR page says European customers on eligible paid accounts can choose data centre regions for real-time meeting traffic. Recordings can be stored locally or in a local data centre. But the same page says customer content is stored in the US by default and that "Customer Content, Account Data, and Diagnostic Data are still stored in the U.S." even when a storage location is chosen. Zoom acts as a processor, has a data processing addendum in its terms, and relies on the EU-US Data Privacy Framework and standard contractual clauses for transfers. The page does not name the plans that include the controls. Check your own account.

Microsoft Teams#

Microsoft's EU Data Boundary documentation, read 1 November 2026, says it commits to store and process customer data and pseudonymised personal data for Microsoft 365 and other enterprise services in the EU and EFTA, with limited exceptions listed in separate pages. Customers with a sign-up location in the EU or EFTA are in scope, but customers who bought Multi-Geo are not. The page covers all in-scope services, and we did not find Teams meeting detail on this page, so read the services list for Teams.

Google Meet#

Google Workspace data regions let admins pick United States, European Union or no preference. They are supported on specific editions such as Business Standard and Plus and Enterprise Standard and Plus, and data processing location controls need higher editions. The page covers data at rest. It does not list Meet, and it points to a separate page for covered data, which we did not read. If you rely on this, check that page for Meet.

Whereby#

Whereby's GDPR statement says European users connect to a data centre physically in the EEA. In small rooms of up to two people, audio and video usually travel peer to peer with end to end encryption. In larger rooms, streams are decrypted and re-encrypted at video routers, so end to end encryption does not apply the same way. Whereby says it is a controller for call data and otherwise a processor. The page names no certifications.

Jitsi#

Jitsi is open source. Its security page says self-hosting removes the need to trust a third party, and describes end to end encryption for audio and video in supported browsers, not chat or polls. On the public meet.jit.si service, room creators need an account, and the service uses Amplitude, Datadog and Crashlytics for analytics. If you want full control, host it in the EU yourself, and take on the work of servers and updates.

Interprefy#

For interpretation, Interprefy's homepage claims ISO 27001 certification, "built in Switzerland and hosted in Europe", and that content is never used to train models. It refers to "European rules" and does not name GDPR on that page, so ask directly.

Digital Samba#

Its pricing page says it is headquartered in Barcelona and links a privacy and GDPR statement, but makes no explicit hosting claim on that page. Other pages of the vendor make EU hosting claims we did not verify, and the claims we saw did not all agree, so ask in writing where media servers run and which sub-processors are involved.

RespireSoft Meet#

This is our product, so here is a plain account of what we say and what we do not.

Where calls run. Calls and recordings run on our own server in Gravelines, France (EU). Captions and translation use outside speech services, so we do not claim EU only sub-processors. We hold no certification and offer no signed data processing agreement.
End to end encryption. Connections are encrypted in transit. Calls go through our servers so that captions, translation and recording can work, so they are not end to end encrypted.
Recording. A meeting is not recorded unless the host switches recording on. Recordings, transcripts and chat are kept 30 days by default and are deleted with their room. A recording is at most 240 minutes.
Speech and translation. Captions and spoken translation send the speech of the meeting to speech and translation services that work for us, only while those features are on. Our privacy page does not name them. If your meeting has no captions or translation, that does not apply.
Access. Rooms can be secret link or private, with a waiting room and a lock. Developers hand each person a short-lived token that works in one room, and secret API keys never go to a browser.
What we do not claim. We do not publish a certification such as ISO 27001 or SOC 2, and this post is not a statement that you will be compliant by using us. Ask us about a data processing agreement and sub-processor list before you rely on us.

See the security and EU hosting page, the privacy page, and the limits for retention and size. Developers can delete a room and its recordings at any time.

A checklist before you choose#

Map the data. What does a call create? Video, voice, chat, recordings, transcripts, translations and logs.
Ask where each lives, live and stored, and in which country.
Get the data processing agreement and the sub-processor list, including speech services.
Check transfers. If any data leaves the EU, what is the legal basis?
Turn off what you do not need. Recording and transcription are off unless needed.
Set retention. Choose a number of days and delete on time.
Tell people. Show a notice at the start of a recorded or transcribed call.
Decide on children, health or legal calls. These have stricter rules and may need a specialist.
Write it down. Keep a short record of why you picked the tool and what you checked.

AI features need their own check#

Captions, translation and notes add processors. The audio goes to speech and translation services, and the text may go to a language model. Ask whether the vendor trains models on your content (Interprefy says it never does), where those services run, and whether you can turn them off per meeting. Our multilingual meeting guide covers the practical side of translated calls, and the live translation roundup lists what each big tool offers.

Questions people ask#

Is Zoom GDPR compliant? Zoom provides a data processing addendum and EU data centre options on eligible paid accounts, and says customer content is stored in the US by default. Whether your use is compliant depends on your settings and your own duties.

Do I need EU hosting at all? Not strictly. GDPR allows transfers with a valid basis. Many organisations choose EU hosting to make the paperwork simpler.

Can I use a free tool? You can, but a free consumer tool often lacks a data processing agreement. Check before using it for customer or staff calls.

Is end to end encryption required? No. It is a security choice. It also stops server side features such as captions and recording in many tools.

If you build video into your own product, start with the docs and the video call API comparison. For a branded setup, see white label video options.