Trust Center
InterMIND runs on EU infrastructure across France, Germany and Ireland. This page shows where your data goes at every hop, how long we keep it, and which AI touches what. It states only what we can back up — in code, in configuration, or in a signed contract. Service Operator and Contracting Entity: Golden Fish LLC (UAE). Publisher and Intellectual Property Owner: MindMeeting OÜ (EE).
Where a meeting actually runs
Every hop a meeting takes, and where that hop happens:
| Hop | Provider | Region |
|---|---|---|
| Web app and API | Vercel | Frankfurt (fra1) |
| Realtime server — chat, presence, transcript words in transit | Fly.io | Paris (CDG) |
| Meeting media, speech recognition, live voice translation | Own engine (Mind API, intra-group) | OVH, France |
| Post-meeting AI summaries | Mistral | EU, zero data retention |
| Voice-note transcription (speech-to-text) | The speech service of your account's AI gateway (default: Azure AI Speech) | Sweden Central (EU) by default; the region of the gateway your organization selected |
| Document translation | DeepL | Cologne, Germany |
| Database | Neon (Postgres) | Frankfurt (AWS eu-central-1) |
| Recordings, attachments, documents | Tigris object storage | EU multi-region (Frankfurt + Amsterdam) |
| Transactional email | Resend | Ireland (eu-west-1) |
| Product analytics | PostHog | EU Cloud (opt-out by default, consent-gated) |
| Error monitoring | Sentry | EU (Germany); no meeting content in error reports |
Some of these providers are US companies operating EU regions. That is stated plainly, not hidden: each transfer is covered by a DPA plus Standard Contractual Clauses and/or the EU–US Data Privacy Framework. The full registry — every subprocessor, what it processes, and its safeguards — is on the subprocessors page.
AI on your meeting content
- Live speech recognition and voice translation run on our own engine, hosted at OVH in France — not on a third-party AI cloud.
- Every AI call on meeting content — post-meeting summaries, shared-document summaries, editor assistance, support replies — is pinned in code to Mistral's EU API with zero data retention: prompts are not stored by the provider and are not used for training. This is not a policy we remember to follow; it is a hard-coded constraint on every call site.
- Document translation goes to DeepL (Cologne) and is not retained for training.
- Meeting audio is never stored. Speech persists as text only — word-level transcripts. Translated voice audio is streamed to participants and never written to disk.
What we store, and for how long
| Data | Retention |
|---|---|
| Meeting audio and video | Not stored. If the host records, the recording (mp4) is kept as a private object until the host deletes the session's artifacts or the account is deleted |
| Transcripts, chat, documents | Kept until you delete them — there is no automatic expiry. Hosts can irreversibly delete per-session artifacts; account deletion removes everything |
| Guest accounts | Expire 24 hours after creation and are hard-deleted by a cleanup job that runs every 6 hours |
| Calendar and drive OAuth tokens | Stored encrypted (AES-256-GCM), removable by disconnecting the integration |
| Unreferenced chat attachments | Swept by a daily cleanup job after 48 hours |
Account deletion is email-confirmed and complete: stored files are removed first, then the database records, then the billing customer at our payment provider. It is a hard delete, not a flag.
Payments
Card data never touches InterMIND servers. Checkout and card handling are fully hosted by our payment providers — Stripe, and Paddle as merchant of record in selected countries. We store your plan and billing email; the card stays with the payment provider.
EU AI Act
InterMIND's AI does three things: speech recognition, translation, and meeting summaries. None of these is a prohibited practice or a high-risk use under Annex III of the EU AI Act (Regulation 2024/1689). We do not do biometric identification or categorisation, and we do not do emotion recognition — the engine transcribes and translates what is said; it does not profile who says it. Translation, transcription and AI recaps are explicit product features users switch on, not silent processing. We track the Act's guidance as obligations phase in and will update this page when they apply to us.
Certifications — the honest version
We do not yet hold ISO 27001 or SOC 2, and we will not write "in progress" until an audit has actually started. What we do have is published: our CSA STAR Level 1 self-assessment (CAIQ-Lite v4.1.0, 138 questions) is listed in the public CSA STAR Registry, answered under the same rule as this page — an honest No wherever a formal control does not exist. Beyond that we offer verifiability: this page and the subprocessors list state only what is enforced in code or in contract, and the documents below are ready for procurement review.
We also hold Cyber Essentials (IASME, the NCSC-backed UK scheme; certified September 2026). It is an assessor-verified self-assessment of the five baseline controls — firewalls, secure configuration, user access control, malware protection and security update management — across every device and cloud account that touches organisation data, renewed annually. It certifies the operating entity's baseline, not the service architecture, so we do not present it as a substitute for ISO 27001 or SOC 2. Certified 2026-09-03, recertification due 2027-09-03. Verify it on the BlockMark Registry or in IASME's public certificate search.
Documents
- Security & Data Protection whitepaper (PDF) — where meeting data goes, at every hop, and what we do not have yet
- Data Processing Agreement — summary PDF; the binding DPA is signed per customer
- Service Level Agreement — PDF
- Subprocessors
- Privacy Policy
- Terms of Service
Our completed CAIQ-Lite (CSA Cloud Controls Matrix self-assessment) is published in the CSA STAR Registry; a PDF copy is available on request. Questions, or need a signed copy of the DPA or transfer safeguards: privacy@intermind.com.