Security
Your conversations, protected and kept in Europe
Recordings, transcripts, emails and metadata are encrypted at rest and in transit, hosted in the EU and never used to train AI models. GDPR compliant, run on ISO 27001 practices, with a SecNumCloud-compatible sovereign option when your security team needs it.
encryption at rest, TLS 1.2 / 1.3 in transit
to erase a deleted meeting everywhere, backups included
uptime across our core services, monitored 24/7
of your data used to train AI models, sold or shared
Certifications
Audited, certified, documented
The standards we follow and the regulations we have assessed ourselves against. Every document is in the trust center.
ISO 27001
Information security management
Practices
Our information security management follows ISO 27001 practices. The documentation is available in the trust center.
SecNumCloud
Sovereign hosting
Compatible
A SecNumCloud-compatible architecture with European sub-processors only, for organizations that need sovereign deployment.
GDPR
EU data protection
Compliant
EU-only hosting for EU customers, an appointed DPO, DPIAs for sensitive uses, data-subject requests handled within 30 days.
EU AI Act
AI regulation
Assessed
A qualification analysis of our AI systems under the AI Act, available on request, and an AI ethics implementation guide.
DORA
Financial sector resilience
Aligned
For banks and insurers: business continuity and disaster recovery plan, incident response, third-party management.
CCPA
California privacy
Aligned
Consumer rights over personal information are supported for customers who need them.
Sovereign
Three things we never do
Most of this page describes controls. This part describes decisions — the ones that do not change with a plan, a price or a customer.
Hosting
European by default, sovereign when you need it
Every other platform decides for you: one cloud, one set of models, one jurisdiction. Noota runs in Europe by default and ships a fully sovereign environment with European sub-processors only. Your security team picks the one that clears their review, without giving up a single feature.
ISO 27001 practices
GDPR compliant
ISO 27001 practices
GDPR compliant
Standard
European by default
The default for most teams. Everything stays in the EU, with the full model range available.
Data and AI processing inside the European Union
Outbound calls display your own number
Nothing held back from the feature set
Google Cloud
Vertex AI
Claude
Gemini
Mistral
Sovereign
European sub-processors only
The level above: a supply chain where every sub-processor is European, with no US-controlled entity anywhere in it.
Scaleway in Paris for hosting, Bleu for the trusted cloud
Mistral and open-weight models on European infrastructure
Own security assurance plan and disaster recovery plan
Scaleway
Telnyx
Mistral
Open weights
Bleu
Public bodies
Banks & insurers under DORA
Health & legal
Groups that refuse EU transfers
The sovereign environment is an Enterprise option: hosting on Scaleway in Paris and on Bleu, a SecNumCloud trusted cloud, with Mistral and open-weight models.
Controls
Ten families of controls, in plain words
The same controls as in our trust center, from encryption to what happens to your data the day you leave.
Sub-processors
Seven providers, all hosted in Europe
Each one works under a data processing agreement, may not keep your data longer than necessary, and has its access reviewed every quarter.
The live list is published in the trust center, with update notifications.
The sovereign alternative
Chosen by people from the best organisations around the world
.svg){kind=logo}
%201.svg){kind=logo}
.svg)
.svg)
and thousands of other teams across Europe.
FAQ
Questions about security
Certifications, where your data lives, how long it is kept, and what the enterprise options add.
Still have a question? Talk to our team
Which standards does Noota follow?
Noota is GDPR compliant, follows ISO 27001 practices and offers a SecNumCloud-compatible architecture. The trust center also documents our alignment with the EU AI Act, DORA and CCPA.
How do I get the security documentation for my review?
Request access in the trust center: the ISO 27001 certificate, the penetration testing reports, the security assurance plan, the policies, the DPA and the AI Act analysis are shared after a quick review by our team.
Where is my data stored?
For EU customers, in data centres in Belgium and the Netherlands, on Google Cloud Platform. With the sovereign environment, hosting moves to Scaleway in Paris and every sub-processor in the chain is European.
Is my data used to train AI models?
No. Your recordings, transcripts, emails and metadata are never used to train any model, ours or our providers'. We do not sell or share your data.
Can I delete my data, and how long is it kept?
Delete any meeting at any time: it is erased from production and backups within 24 hours, with no delayed copies. On Enterprise, administrators set retention from 1 day to 3 years. Free accounts are archived after 30 days. When a contract ends, all data is purged.
Do you support SSO and user provisioning?
Yes, on the Enterprise plan: single sign-on with Azure AD or SAML, automatic provisioning and off-boarding, plus owner, admin and member roles.
What is the sovereign environment?
An option for organisations that cannot rely on US-controlled providers: hosting on Scaleway in Paris and on Bleu's trusted cloud, Mistral and open-weight models on European infrastructure, and only European sub-processors, with its own security assurance and disaster recovery plans. Public bodies, banks and insurers under DORA, health and legal teams choose it.
