European Data Residency: Your Data Stays in Europe

EU Data Residency: A Commitment, Not Just a Checkbox

When European users trust VoxScriber with their audio files and transcriptions, they're sharing some of their most sensitive business content — interviews, meetings, lectures, medical recordings. We take that trust seriously.

That's why we've built a hard technical guarantee: all data at rest for users in the European Economic Area (EEA) is stored exclusively within the European Union, in Cloudflare R2 infrastructure located in European data centers.

---

What "Data at Rest" Means

"Data at rest" refers to data that is stored persistently — not data moving through a network during processing. For VoxScriber, this includes:

• Audio and video files uploaded for transcription
• Transcription results (text, speaker labels, timestamps)
• Account data (profile information, billing history)

All of the above, for EU-region accounts, is stored in our dedicated EU bucket — isolated from our US/Brazil infrastructure.

---

How Our EU Storage Works

Dedicated EU Infrastructure

We operate two separate Cloudflare R2 storage regions:

Region	Bucket	Users
US/Brazil	vpt-db-us	BR, US, and other regions
European Union	vpt-db-eu	All EEA countries

When you register on a European domain (vozparatexto.pt, voix2texte.fr) or when our system identifies your region as EU/EEA, all your data is routed to the EU bucket automatically — no action needed on your part.

At-Rest Encryption

All files stored in either bucket are encrypted with AES-256 before being written to disk. This means even in the unlikely event of unauthorized physical access to a data center, your data remains protected.

Cloudflare R2 EU Data Centers

Cloudflare R2 stores data in European data centers with no cross-border egress to non-EU regions. Our EU bucket is configured with a jurisdictional restriction ensuring data cannot be replicated outside EU territory.

---

What Happens During Processing

Audio transcription requires sending your file to an AI engine. We use AssemblyAI, OpenAI Whisper, and ElevenLabs — all leading services with GDPR-compliant Data Processing Agreements (DPAs) in place.

Key facts about processing:

• Processing is ephemeral — providers receive the audio, return the transcription, and delete the source file immediately
• No AI provider retains your audio after processing
• Standard Contractual Clauses (SCCs) govern any data transfers under GDPR Article 46
• We rely on the providers' EU Standard Contractual Clauses to legitimize transfer where applicable

This is a common and GDPR-compliant model: the data is processed outside the EU transiently, but it is stored exclusively within EU territory.

---

Your GDPR Rights

As an EU user, you have full rights under the GDPR:

• Right of access — request a copy of all your data
• Right to erasure — request permanent deletion ("right to be forgotten")
• Right to portability — export your data in structured formats
• Right to object — object to specific processing activities
• Right to restriction — limit how we process your data

To exercise any of these rights, contact us at privacidade@vozparatexto.com.br. We respond within 30 days (and within 72 hours for breach notifications, per GDPR requirements).

---

Countries with EU Data Residency

Data residency in the EU applies automatically for users from:

Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the United Kingdom.

---

Transparency and Accountability

We believe GDPR compliance should be visible and verifiable, not just a policy statement. Our technical architecture enforces data residency at the infrastructure level — not just as a promise.

If you have questions about our data practices, please review our Privacy Policy or contact our Data Protection contact at privacidade@vozparatexto.com.br.