Private, GDPR-Compliant Meeting Transcription

Private, GDPR-aligned meeting transcription means durable transcripts are stored in a disclosed region, encrypted, isolated per user, and never used to train AI models. Nod stores notes in Supabase Postgres in Ireland (AWS eu-west-1), AES-256 at rest, with per-user Row-Level Security. Hosted inference may occur outside the EU; Groq may retain transient error or abuse logs for up to 30 days unless Zero Data Retention is enabled.

If you handle EU data — or you just have to justify a tool to your legal or security team — "we're GDPR compliant" on a marketing page isn't enough. You need to know where the data lives, how it's secured, whether it trains a model, and how a deletion request actually works. This article answers those questions for AI meeting transcription, with the specific facts you'd cite in a vendor review.

What makes meeting transcription "GDPR-compliant"?

GDPR doesn't certify products; it sets principles you have to be able to demonstrate. For an AI note taker, the ones that matter most are concrete:

• Lawful basis. There's a clear reason to process the data — here, performing the service you signed up for (Art. 6(1)(b), contract), plus narrow legitimate-interest uses like quota enforcement and a consent audit log.
• Data minimization. You only keep what you need. The strongest possible version for transcription is not storing the audio at all — keeping only the text you'll actually use.
• Storage limitation and residency. Data is kept where you expect, for only as long as needed, and is deletable.
• Security of processing (Art. 32). Encryption in transit and at rest, access isolation, backups.
• Purpose limitation. Your data isn't quietly reused for something else — most importantly, not used to train models.
• Data-subject rights. You can access, export, correct, and erase your data, and know who the subprocessors are.

A tool is "GDPR-compliant" in any useful sense only when it can point to a real answer for each of these — not a badge. The rest of this article maps Nod to each one, with links to the policy pages that back the claims.

Where is your transcript actually stored?

Data residency is usually the first question a DPO asks, so here's the direct answer. Nod stores everything in the European Union — specifically Supabase Postgres running on AWS eu-west-1 (Ireland). Your transcripts, summaries, search embeddings, and account profile all live in that region.

The security around them:

• AES-256 encryption at rest in Postgres, with daily encrypted backups retained on a rolling basis.
• TLS 1.2+ in transit (TLS 1.3 by default; older protocols rejected), including for direct database connections.
• Per-user Row-Level Security on every table, so one account cannot read another account's private rows. Membership shares nothing by default. Public summary links and early-access conversation or folder shares are separate, deliberate, revocable actions.

This is the foundation GDPR's Article 32 ("security of processing") is asking about, and it's all documented in Nod's Security & Privacy page, including the infrastructure table and the how-data-flows diagram.

Does the AI train on your meetings?

No — and this is where a lot of "private" tools quietly fall down, because the product might not train on your data while an upstream model provider does. Nod closes both gaps.

Nod does not train any model on your data, and it requires the same no-training boundary from subprocessors. Transcription runs primarily on Groq, whose agreement prohibits training on inputs and outputs, with OpenAI/OpenRouter fallbacks. LLM and fallback routes use OpenRouter with Zero Data Retention, and every "may train on request data" route — paid and free — is disabled. Groq may retain transient error or abuse logs for up to 30 days unless Zero Data Retention is enabled. Search embeddings are generated in-region by Supabase's built-in model inside an Edge Function, so your transcript text isn't sent to an external embedding provider at all.

The net effect: your meetings are used to produce your notes and nothing else. They don't become training data for anyone. The exact configuration is spelled out in the model-training section of the Security page.

How Nod maps to GDPR

Here's each principle, mapped to what Nod actually does.

Data minimization

The single biggest minimization choice is that Nod stores no audio. Sound is held in memory for roughly five seconds per chunk to transcribe, then released — no file, no waveform, no cloud recording. Only the transcript and summary are kept. You can't lose what was never written. Beyond that, Nod doesn't embed analytics or advertising SDKs, doesn't track you across the web, and doesn't read your calendar, email, or contacts.

Storage limitation and residency

Data stays in the EU (eu-west-1) and is deletable on your terms. Deleting a meeting in the app is a soft delete — it moves to a trash that's permanently purged after 30 days by a nightly job. Account-level deletion is honored within 30 days. Retention windows for each data type (meetings, transcripts, usage metadata, backups) are published in the Privacy Policy.

Security of processing (Art. 32)

AES-256 at rest, TLS 1.2+ in transit, per-user Row-Level Security on every table, daily encrypted backups, and server-side isolation of secrets (API keys never touch your Mac). This is the concrete Article 32 checklist most reviews want to see.

Purpose limitation

Your transcripts are used to generate your notes and power your own searchable history — nothing else. No training, no secondary use, no selling of personal data. OpenRouter routes use Zero Data Retention; Groq's documented exception is transient error or abuse logging for up to 30 days unless Zero Data Retention is enabled.

Data-subject rights and subprocessors

Nod supports the GDPR rights you'd expect: access (a copy of your data), portability (export of transcripts and summaries in a machine-readable format, Art. 20), rectification, erasure (full account deletion, plus per-meeting deletion you control), restriction, and objection to legitimate-interest processing. Requests are acted on within 30 days. The complete rights list is in the Privacy Policy, and the third parties that process your data are named in the Subprocessors list. Note that recording consent is a separate duty that's on you, not the tool — see consent and GDPR for a regional reference.

Capture is local, processing is in the cloud — what that means

It's worth being precise so you don't over- or under-state this in a vendor review. Nod's audio capture is local on your Mac, and no audio is ever stored. But the transcription and summarization run in the cloud, not on your device. The short audio chunks and the transcript text are sent over an encrypted connection to inference services, processed, and released.

Nod is therefore local capture plus cloud inference — not a fully on-device, offline model. The cloud-hop boundary is no training plus disclosed provider retention: OpenRouter routes use Zero Data Retention, while Groq may retain transient error or abuse logs for up to 30 days unless Zero Data Retention is enabled. If your requirement is that nothing leaves the machine under any circumstances, choose an on-device Mac note taker. For EU-data reviews, separate durable EU storage from inference that may happen outside the EU.

A couple of practical notes for adoption: Nod supports 35 languages (English, Spanish, French, German, Italian, Portuguese, Dutch, Swedish, Norwegian, Danish, Finnish, Polish, Ukrainian, Russian, Serbian, Romanian, Catalan, Galician, Estonian, Turkish, Hebrew, Arabic, Persian, Hindi, Marathi, Bengali, Urdu, Vietnamese, Mandarin, Cantonese, Japanese, Korean, Afrikaans, Zulu, and Xhosa), and is macOS-only (no iOS or web app). It's transparent on its own policy pages that there's no SOC 2 audit yet — that's disclosed honestly rather than glossed over, which is the kind of thing a careful reviewer would rather know up front.

Try Nod

Nod is a bot-free AI notepad for macOS that captures your Mac's own audio, stores no recording, and keeps your transcripts encrypted in the EU with no model training. If you want private, searchable meeting notes you can defend to a security review, start with a free 14-day trial, no credit card (see pricing). You can download Nod for Mac, or read the broader case for meeting notes without a bot first.