Trust Center
InterMIND runs on EU infrastructure across France, Germany and Ireland. This page shows where your data goes at every hop, how long we keep it, and which AI touches what. It states only what we can back up — in code, in configuration, or in a signed contract. Service Operator and Contracting Entity: Golden Fish CSP LLC (UAE). Publisher and Intellectual Property Owner: MindMeeting OÜ (EE).
Where a meeting actually runs
Every hop a meeting takes, and where that hop happens:
| Hop | Provider | Region |
|---|---|---|
| Web app and API | Vercel | Frankfurt (fra1) |
| Realtime server — chat, presence, transcript words in transit | Fly.io | Paris (CDG) |
| Meeting media, speech recognition, live voice translation | Own engine (Mind API, intra-group) | OVH, France |
| Post-meeting AI summaries | Mistral | EU, zero data retention |
| Document translation | DeepL | Cologne, Germany |
| Database | Neon (Postgres) | Frankfurt (AWS eu-central-1) |
| Recordings, attachments, documents | Tigris object storage | EU multi-region (Frankfurt + Amsterdam) |
| Transactional email | Resend | Ireland (eu-west-1) |
| Product analytics | PostHog | EU Cloud (opt-out by default, consent-gated) |
| Error monitoring | Sentry | EU (Germany); no meeting content in error reports |
Some of these providers are US companies operating EU regions. That is stated plainly, not hidden: each transfer is covered by a DPA plus Standard Contractual Clauses and/or the EU–US Data Privacy Framework. The full registry — every subprocessor, what it processes, and its safeguards — is on the subprocessors page.
AI on your meeting content
- Live speech recognition and voice translation run on our own engine, hosted at OVH in France — not on a third-party AI cloud.
- Every AI call on meeting content — post-meeting summaries, shared-document summaries, editor assistance, support replies — is pinned in code to Mistral's EU API with zero data retention: prompts are not stored by the provider and are not used for training. This is not a policy we remember to follow; it is a hard-coded constraint on every call site.
- Document translation goes to DeepL (Cologne) and is not retained for training.
- Meeting audio is never stored. Speech persists as text only — word-level transcripts. Translated voice audio is streamed to participants and never written to disk.
What we store, and for how long
| Data | Retention |
|---|---|
| Meeting audio and video | Not stored. If the host records, the recording (mp4) is kept as a private object until the host deletes the session's artifacts or the account is deleted |
| Transcripts, chat, documents | Kept until you delete them — there is no automatic expiry. Hosts can irreversibly delete per-session artifacts; account deletion removes everything |
| Guest accounts | Expire 24 hours after creation and are hard-deleted by a cleanup job that runs every 6 hours |
| Calendar and drive OAuth tokens | Stored encrypted (AES-256-GCM), removable by disconnecting the integration |
| Unreferenced chat attachments | Swept by a daily cleanup job after 48 hours |
Account deletion is email-confirmed and complete: stored files are removed first, then the database records, then the billing customer at our payment provider. It is a hard delete, not a flag.
Payments
Card data never touches InterMIND servers. Checkout and card handling are fully hosted by our payment providers — Stripe, and Paddle as merchant of record in selected countries. We store your plan and billing email; the card stays with the payment provider.
EU AI Act
InterMIND's AI does three things: speech recognition, translation, and meeting summaries. None of these is a prohibited practice or a high-risk use under Annex III of the EU AI Act (Regulation 2024/1689). We do not do biometric identification or categorisation, and we do not do emotion recognition — the engine transcribes and translates what is said; it does not profile who says it. Translation, transcription and AI recaps are explicit product features users switch on, not silent processing. We track the Act's guidance as obligations phase in and will update this page when they apply to us.
Certifications — the honest version
We do not yet hold ISO 27001 or SOC 2, and we will not write "in progress" until an audit has actually started. What we offer instead is verifiability: this page and the subprocessors list state only what is enforced in code or in contract, and the documents below are ready for procurement review.
Documents
- Security & Data Protection whitepaper (PDF) — where meeting data goes, at every hop, and what we do not have yet
- Data Processing Agreement — summary PDF; the binding DPA is signed per customer
- Service Level Agreement — PDF
- Subprocessors
- Privacy Policy
- Terms of Service
A completed CAIQ-Lite (CSA Cloud Controls Matrix self-assessment) is available on request. Questions, or need a signed copy of the DPA or transfer safeguards: privacy@mind.com.