Where are my audio files stored during transcription?

Since the Schrems II ruling by the CJEU (2020) and the ongoing debate around the 2023 EU-US Data Privacy Framework, "where does my data live?" has become the GDPR question — and many transcription providers answer it less transparently than they should.

The usual options:

1. US cloud API (OpenAI, AssemblyAI, Deepgram, Google Cloud Speech). Audio is processed in AWS, GCP, or Azure in the US. Even when the provider offers EU regions, the US Cloud Act and FISA 702 allow US intelligence to compel access — exactly what the CJEU rejected in Schrems II. The 2023 EU-US DPF closes part of the gap but is being legally challenged (Schrems III is in motion).

2. EU cloud region of a US provider (AWS Frankfurt, Azure West Europe). Data sits physically in the EU, but the provider is a US corporation. Better under GDPR, but still in a gray zone because of the Cloud Act.

3. EU-owned cloud (OVH, Hetzner, IONOS). Provider and servers in the EU. Clearly GDPR-compliant, no Cloud Act exposure.

4. Provider-owned hardware. The transcription provider runs its own infrastructure in owned or leased data centers — typically in the EU. No sub-processing to hyperscalers. Highest data sovereignty.

DeepScript falls into category 4: all transcription processing runs on our own hardware in data centers in Falkenstein and Nuremberg (Hetzner). Stripe (payments) and our email sender are the only sub-processors — neither sees audio or transcripts.

Questions to ask any provider: - Which data centers are used for audio processing? (Address, country) - Who operates those data centers? (Sub-processors) - What is the provider's legal entity (registered office, group structure)? - Are there US subsidiaries that could compel access? - How long are audio and transcript stored? - Is storage encrypted? Who holds the keys?

If answers stay vague or come back as "depends on capacity," that's a red flag — GDPR compliance requires traceable, documented answers.