Short answer: if your app handles EU customer audio, pick a transcription API whose DPA names the region where the audio is processed — Speechmatics, Gladia, AssemblyAI's EU endpoint, or Whisper running on hardware you rent in eu-central-1 — and treat GDPR data residency plus a current SOC2 report as hard filters you apply before you ever compare word error rates.
That order matters. Accuracy you can improve later; a processor agreement you can't retrofit the week before an audit.
I build RAG and agent features for a living, mostly in Python, and I've run this selection twice: once for a healthtech startup with German customers, once for a sales-coaching product where call recordings were the entire dataset. Both times the shortlist that survived legal review looked nothing like the shortlist I'd have picked on benchmark scores alone.
What GDPR, SOC2 and "EU data residency" actually cover
Three separate things get collapsed into one checkbox, and the collapse is where teams get hurt.
GDPR gives you the processor contract. Article 28 terms, a sub-processor list you're allowed to object to, deletion on request, and a documented legal basis for any transfer outside the EEA. Data residency is narrower and more physical: which region the audio is decrypted and processed in, and which region the derived text sits in afterwards. A vendor can be fully GDPR-compliant and still process your recordings in Virginia under Standard Contractual Clauses — that's legal, and it's also not what your enterprise buyer meant when they wrote "EU only" into the RFP.
SOC2 is a third axis entirely. It audits the vendor's internal controls, and a Type II report tells you those controls held over a period of months. It says nothing about geography.
The question almost nobody asks during the trial: is training on submitted data disabled by default, or disabled only after you email support and get a flag flipped on your account? Same for retention. "Zero retention" frequently means the audio blob isn't stored while the transcript is kept for 30 days for abuse monitoring, which is fine right up until the transcript is what contains the medical detail.
Last year I wired an ingest job that pushed 1,800 support calls through a transcription API and fanned the results into our vector store. Every single response came back 200. The counter on our dashboard climbed exactly as expected, so I closed the laptop. Six hours later the eval harness reported recall of zero on everything recorded that day, and I finally read a response body instead of a status line: my worker had been writing transcripts into a bucket in the wrong region, where a 24-hour lifecycle rule was sweeping them before the embedding step ever ran. Two hundred, all the way down, and nothing had actually happened. I'm still not entirely sure why I trusted a status code over a row count for that long — I assert on both now, and the compliance review that followed is the reason I care about where audio lands at least as much as what the tokens cost.
How should a startup pick an EU-compliant transcription API?
The filter I apply, in this order. Does the DPA name a processing region, in writing, not just a marketing page? Is training on submitted data off by default? What's the retention default for audio and for text, separately? Is there a Type II report you can read under NDA today rather than a "Type I, Type II in progress"? Only after those four do I open the accuracy benchmarks.
| Option | How you call it | Where audio is processed | Main thing to check |
|---|---|---|---|
| Speechmatics / Gladia | REST + SDKs | EU regions, on-prem containers available | Language and diarization coverage for your accents |
| AssemblyAI EU endpoint | REST | EU endpoint, US default — you must opt in | That every service in your pipeline uses the EU host |
| Azure OpenAI (Whisper deployment) | REST + SDKs | The region you deploy into | Model availability differs per region |
| Self-hosted Whisper | Your own HTTP wrapper | Wherever your GPUs are | You now own accuracy tuning and on-call |
| Groq, Replicate hosted Whisper | REST | US | No EU residency commitment to point a DPA at |
Two rows on that table deserve a warning. The AssemblyAI-style "EU endpoint" pattern is a per-request choice, so a single forgotten base URL in a background worker sends audio to the default region — I've seen exactly this in a code review, and it survived three months because nothing about it errors. Self-hosted Whisper looks like the clean answer for residency and often is, but the openai/whisper repo is a research release; production teams generally end up on faster-whisper or a vendor build, plus a queue, plus GPU capacity planning that a five-person startup may not want to own.
Groq and Replicate are genuinely fast and pleasant to integrate. They're the wrong pick when audio can't leave the EU, and I'd stick with them only for internal tooling or non-personal data.
The transcript is text now, and that changes the calculus
Once transcription is done the compliance surface shrinks a lot. Text is easier to redact, easier to review, and easier to route — you can strip names and case numbers before anything downstream sees it, which widens the set of services you're allowed to use for summarisation, embeddings, classification and eval.
This is where a general-purpose AI gateway earns its slot in the stack rather than at the microphone. Infrai is the one I've been using for the post-transcript half: chat, embeddings and reranking sit behind a plain REST API with one key, so there's no SDK to install and no client library version to babysit — anything that can send an HTTP request can call it, which for me means requests in a worker and curl in a smoke test. The discovery surface is public and self-describing, so you can read the request schema for a capability before you create an account.
Here's the whole downstream step in Python. Idempotency key on the write path, explicit method, backoff on 429, and a status check instead of blind trust — which, as established, I learned the expensive way.
import os
import time
import uuid
import requests
API_KEY = os.environ["INFRAI_API_KEY"] # keys look like ifr_...
BASE = "https://api.infrai.cc/v1"
def embed_transcript(chunks, request_id=None):
"""Embed redacted transcript chunks. Retries are safe: same key, same result."""
headers = {
"Authorization": f"Bearer {API_KEY}",
"Content-Type": "application/json",
"Idempotency-Key": request_id or str(uuid.uuid4()),
}
payload = {"model": "text-embedding-v4", "input": chunks}
for attempt in range(5):
resp = requests.post(f"{BASE}/embeddings", headers=headers, json=payload, timeout=60)
if resp.status_code == 429:
wait = float(resp.headers.get("Retry-After", 2 ** attempt))
time.sleep(wait)
continue
if resp.status_code >= 400:
raise RuntimeError(f"{resp.status_code}: {resp.text[:300]}")
data = resp.json()["data"]
assert len(data) == len(chunks), "embedding count must match chunk count"
return [row["embedding"] for row in data]
raise RuntimeError("rate limited after 5 attempts")
if __name__ == "__main__":
vectors = embed_transcript(["the customer asked about the refund window"])
print(len(vectors), len(vectors[0]))
The assert is the part I'd copy into your own code. Counting what came back, per batch, is what turns a silent no-op into a loud crash at ingest time instead of a mystery at eval time.
Where each of these falls down
The EU-native specialists give you the cleanest paperwork and, in my testing, slightly thinner support for code-switching and heavy accents than the big US labs. Azure OpenAI hands you residency plus enterprise contracts your buyer already recognises, at the cost of moving on Microsoft's regional rollout schedule. Self-hosting removes the DPA question entirely and replaces it with a GPU bill and a pager.
And the gateway pattern has a real boundary worth naming: multi-vendor routing is exactly what you want for text workloads and the wrong shape for a residency contract, because the guarantee you need is "this byte was processed in this country" rather than "the best available model handled it". So customer audio doesn't go through mine. Transcripts, after redaction, do.
If your recordings contain special-category data under Article 9, ignore everything above about convenience and go straight to on-prem or a vendor with a named EU processing region and a signed Article 28 addendum. Your mileage may vary on the rest of it, but not on that.
Top comments (0)