GDPR and AI meeting summaries: which endpoint to use

Transcription in Autorec runs on your machine. The AI summary is the one step that can leave it. If you turn it on, the transcript goes to an LLM provider you pick, and from that moment that provider is a processor of whatever personal data the meeting contained.

This post is about choosing that provider. It is not legal advice; your data protection officer or counsel decides what your legal basis and risk appetite allow. Facts about providers below are from their own documentation, checked in October 2026. Policies change, so check the linked pages before you rely on a row.

What Autorec actually sends

Autorec’s AI summary is off until you add a provider in Settings → AI Summary. When it runs, one HTTPS request goes straight from your computer to the API Base URL you configured. There is no Autorec server in between.

The request body contains:

your summary prompt, as the system message
the transcript text, as the user message
the model name and the maximum summary length

It also carries any extra request fields you add yourself under Extra request fields (JSON), such as provider routing options. Those are settings, not data about the meeting. Nothing else goes out. That means no audio, video, screenshots, file names or participant list. The whole transcript is sent, so a long meeting means a lot of text.

The title and summary that come back are saved next to the recording on your disk. Your API key sits in Autorec’s local config, and it is optional for local servers.

The audio and video, which hold voices and faces, never leave the machine. Text does, and text is still personal data when people say names, health details or salaries out loud. A transcript isn’t anonymous just because it’s only text.

Our GDPR and HIPAA post covers the recording side: legal basis, consent, retention. Everything there still applies. This post adds the vendor step.

Autorec's AI Summary settings with the provider dropdown open, showing presets grouped into aggregators, first-party APIs, fast inference, local servers and Custom

What to check before you pick a provider

Four questions decide most of it.

Where is the data processed? The EU is not a magic word, but it takes most of the transfer question off the table. Processing in the US needs a transfer mechanism and a transfer assessment.

Is there a data processing agreement? If the provider handles personal data on your behalf, Article 28 requires a contract. Check that you can accept one without a sales call.

How long is the content kept? Many API providers keep prompts for a short period for abuse monitoring even when they don’t train on them. “Zero retention” is usually an agreement you request, not the default.

Is the content used for training? For API traffic this is now rarely the default among the big names, but it is not uniform, and it can differ between a free tier and a paid one.

EU-hosted providers

Mistral

Mistral is the first EU option in Autorec’s provider list (Provider → Mistral, base URL https://api.mistral.ai/v1, default model mistral-small-latest).

Region: Mistral’s help center says data is hosted in the European Union by default, and in the United States only if you explicitly use its US API endpoint. Mistral also lists subprocessors, some outside the EU, in its Trust Center.
DPA: Mistral publishes a Data Processing Addendum under its commercial terms.
Training: this is the row to read carefully. Mistral’s help center says that on pay-as-you-go you have the right to opt out of training at any time, and describes the switch: in Mistral Studio, Privacy → Anonymous improvement data. The free Studio mode states that Mistral may use your data to train its models. The consumer chat product and the API have separate toggles. So do not assume; open the Privacy page on the account whose key you put in Autorec and check it.
Retention: Mistral offers a Zero Data Retention option for supported API calls, including chat completions, on paid plans. You request it through support and Mistral can approve or decline. Mistral’s own help pages I could reach don’t state the default retention period for API content, so I won’t print a number. Ask or read the DPA.

Scaleway

Scaleway’s Generative APIs are hosted in Paris and advertise OpenAI compatibility, including a chat completions endpoint. There is no preset in Autorec, so pick Custom… and enter the base URL from Scaleway’s console.

According to Scaleway’s data privacy page, it does not collect, read, reuse or analyse prompts or outputs, and it does not use them to train models. The exception is a misuse or fault investigation, where data may be stored for up to two weeks. The page names Scaleway as the processor and points to its privacy policy and AI service conditions for the contractual side.

IONOS

IONOS AI Model Hub describes OpenAI-compatible endpoints and says all processing happens in its German data centres (Berlin) and that customer data is never used for model training. I found no stated retention period, so ask them before putting meeting content through it. Use Custom… here too.

Others

OVHcloud AI Endpoints and Aleph Alpha are also European. I could not confirm their current terms and API compatibility from primary pages while writing this, so they are not in the table.

US providers

OpenAI and Anthropic both have presets in Autorec. Their API defaults are better than people assume. The open question is the US transfer, not the training.

OpenAI: its documentation says API data is not used to train its models unless you opt in, and that abuse monitoring logs are retained for up to 30 days by default. Zero Data Retention needs prior approval. EU data residency (the eu.api.openai.com prefix) is a project setting, and it comes with conditions such as Zero Data Retention or modified abuse monitoring, and not every model is supported.
Anthropic: its privacy centre says inputs and outputs for API users are deleted from the backend within 30 days, and that commercial products’ inputs and outputs are not used for training by default. Its DPA with Standard Contractual Clauses is incorporated into the Commercial Terms automatically. I could not confirm an EU-only processing option, so I’m not claiming one.

At a glance

Provider	Processing region	Retention	Training	DPA
Mistral	EU by default; US endpoint opt-in	ZDR on request for paid plans; default period not stated on pages I checked	Opt-out toggle in Studio; free tier may be used	Published addendum
Scaleway	Paris, France	No prompt storage; up to two weeks for fault investigation	Not used	Processor terms in privacy policy and AI conditions
IONOS	Germany (Berlin)	Not stated	Never used, per IONOS	Not checked
OpenAI	US; EU residency optional with conditions	Up to 30 days (abuse logs); ZDR by approval	Not used unless you opt in	Not checked
Anthropic	Not stated as EU-only	Deleted within 30 days	Not by default	Incorporated in Commercial Terms

“Not checked” means I did not read it, not that it doesn’t exist.

Gateways add a party

An aggregator such as OpenRouter in front of a model makes the aggregator a processor too, plus whichever company runs the model. You can restrict that, including with request-level options such as OpenRouter’s zero-data-retention flag, which you can set in Extra request fields (JSON). Our OpenRouter privacy post goes through the settings. If you are going for a clean paper trail, one direct contract with one EU provider is simpler to document than a routing layer.

When local is the better answer

An EU endpoint reduces the risk. A model on your own machine removes the processor altogether: no vendor, no DPA, no transfer, no retention question. For meetings with health data, legal privilege, HR cases or anything under a strict client NDA, that is often the easier decision to defend.

The cost is hardware and quality. A small model on a laptop writes a rougher summary than a large hosted one, and long transcripts are slow. Our local LLM guide shows how to point Autorec at Ollama or LM Studio.

A reasonable split:

routine internal meetings: an EU-hosted endpoint with training off and a signed DPA
sensitive meetings: a local model, or no summary at all and a plain transcript

You can switch providers in Settings at any time, and summaries are generated per recording, so the split doesn’t have to be all or nothing.

A short checklist

Pick the provider and accept its DPA on the account whose key you will use.
Confirm the training setting on that account, not in general.
Request Zero Data Retention if the provider offers it and your risk calls for it.
Tell participants that an AI provider processes the transcript. Your recording notice should name the category of processor.
Write the provider into your record of processing activities.
Leave Auto-summarize after transcription off for meetings you want to review first.

Autorec keeps the audio on your machine and shows you exactly what text leaves it. The contracts and the policy are yours to sort out. For the recording side, see the GDPR and HIPAA guide, and for why we skip meeting bots, the no-bot recorder post.