EU Data Sovereignty

VoiceDock enables EU-hosted voice AI calls with strong data residency guarantees, ensuring your data is processed and stored exclusively within the European Union. For organizations with the highest compliance requirements, we also offer fully on-premise deployment options.

VoiceDock is the platform, Flireo B.V. is the company that operates it, and HMS Sovereign is the orchestration technology that runs your calls. See VoiceDock, Flireo & HMS Sovereign for how the three relate.

EU Data Residency - When configured with Gladia, Mistral, and Local TTS, your voice AI data is processed and stored exclusively within the European Union, on ISO 27001 and SOC 2 Type II certified infrastructure.

Infrastructure & Hosting

VoiceDock's infrastructure is built around two EU-resident layers:

• Real-time voice processing runs on dedicated servers provided by Hetzner Online GmbH in Nuremberg, Germany. Call audio, orchestration and local TTS are handled here, on hardware dedicated to our platform.
• Platform data (configuration, call records, recordings) is stored in a certified European cloud region in Frankfurt, Germany — infrastructure certified to ISO 27001 and SOC 2 Type II, operating under GDPR with EU Standard Contractual Clauses in place at the sub-processor level.

This means:

• Data residency: All data is stored and processed exclusively within the EU (Germany)
• Certified security: Storage infrastructure is independently audited (ISO 27001, SOC 2 Type II)
• GDPR by design: Every sub-processor in the chain operates under GDPR, with EU SCCs where applicable — the full list is available in our Data Processing Agreement

Data residency and certified security are core platform guarantees, not add-ons: under the EU configuration, your data does not leave the European Union under normal operating conditions.

The EU Stack

*Gladia routes requests to EU-West by default. Gladia manages their own infrastructure failover; in rare cases of EU-West unavailability, Gladia may fall back to non-EU servers. See Gladia section below.

VoiceDock (Platform & TTS)

Operated by Flireo B.V., a Dutch BV headquartered in the Netherlands. All application logic and TTS models run on EU-located servers in Nuremberg, Germany.

Gladia (Speech-to-Text)

French SAS headquartered in Paris. Requests are routed to their EU-West region by default.

Mistral (Language Model)

French SAS headquartered in Paris. Models trained and hosted in Europe.

Infrastructure

Real-time voice processing runs on servers provided by Hetzner Online GmbH, physically located in Nuremberg, Germany. Platform data is stored in a certified European cloud region in Frankfurt, Germany (ISO 27001, SOC 2 Type II), with EU Standard Contractual Clauses in place. The full sub-processor list — including entities, roles, locations and transfer mechanisms — is documented in our Data Processing Agreement.

Data Flow

flowchart LR
    A[Caller] --> B[VoiceDock<br/>Nuremberg, DE]
    B --> C[Gladia STT<br/>France*]
    C --> D[Mistral LLM<br/>France]
    D --> E[Local TTS<br/>Nuremberg, DE]
    E --> B
    B --> A

    style A fill:#1e40af,color:#fff
    style B fill:#f97316,color:#fff
    style C fill:#8b5cf6,color:#fff
    style D fill:#8b5cf6,color:#fff
    style E fill:#f97316,color:#fff

Note: Under normal operating conditions, data does not leave the European Union. The entire voice AI pipeline runs within EU borders (Germany and France). See the note on Gladia failover below.

Setup Guide

Step 1: Add Gladia API Key

Navigate to Integrations in your VoiceDock dashboard, or add via API:

curl -X POST https://api.hmsovereign.com/api/v1/byok \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "gladia",
    "api_key": "YOUR_GLADIA_KEY"
  }'

Get your Gladia API key at gladia.io

Step 2: Add Mistral API Key

Add your Mistral API key for EU-based language model processing:

curl -X POST https://api.hmsovereign.com/api/v1/byok \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "mistral",
    "api_key": "YOUR_MISTRAL_KEY"
  }'

Get your Mistral API key at mistral.ai

Step 3: Configure Your Assistant

Create or update your assistant with the EU-only configuration:

curl -X POST https://api.hmsovereign.com/api/v1/assistants \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "EU-Sovereign Assistant",
    "stt_config": {
      "provider": "gladia",
      "model": "solaria-1",
      "language": "en",
      "code_switching": true
    },
    "llm_config": {
      "provider": "mistral",
      "model": "mistral-medium-latest",
      "temperature": 0.7,
      "messages": [{"role": "system", "content": "Your system prompt here"}]
    },
    "tts_config": {
      "provider": "local"
    }
  }'

Step 4: Verify Configuration

Your voice AI calls are now fully EU-sovereign. Test by making a call to your assistant's phone number.

Provider Details

Gladia (Speech-to-Text)

Company: Gladia SAS (French Societe par Actions Simplifiee)

Headquarters: Paris, France

Features:

• EU-West region for GDPR-compliant processing (default)
• 90+ languages supported
• Code switching (automatic language detection mid-conversation)
• Real-time translation capabilities
• Custom vocabulary support

Recommended Settings:

{
  "provider": "gladia",
  "model": "solaria-1",
  "code_switching": true
}

Gladia infrastructure failover: Gladia routes requests to their EU-West region (France) by default. Gladia manages their own infrastructure and may automatically fail over to non-EU servers (us-east) in the event of EU-West unavailability. This is a Gladia infrastructure decision outside VoiceDock's control. For organizations that cannot accept any possibility of data leaving the EU, we recommend using on-premise STT via our Enterprise On-Premise Solutions.

Mistral (Language Model)

Company: Mistral AI SAS (French Societe par Actions Simplifiee)

Headquarters: Paris, France

Available Models:

Pricing: 5-10x more cost-effective than US alternatives

Local TTS (Text-to-Speech)

Operated by: Flireo B.V. (VoiceDock)

Headquarters: Netherlands

Features:

• Hosted entirely on VoiceDock infrastructure
• No external API calls for voice synthesis
• Low latency voice generation
• Multiple voice options available

Tip: Local TTS keeps all voice synthesis within VoiceDock's EU infrastructure in Nuremberg, ensuring complete control over the final audio output.

Recording Consent (DTMF Opt-In)

VoiceDock offers a built-in recording consent flow that lets callers actively opt in before any recording or AI processing begins. This is an opt-in feature that can be enabled per assistant.

How It Works

When enabled, the following happens before any AI interaction:

1. The caller hears a TTS-spoken consent message (using the assistant's configured TTS provider)
2. The caller presses 1 to agree — recording starts and the AI assistant begins
3. The caller presses 2 to hang up — the call ends immediately, no data is stored
4. If no key is pressed within 10 seconds, the message repeats once, then the call ends

Crucially, no audio is sent to any STT provider, no LLM is invoked, and no recording starts until the caller presses 1. The only external call before consent is the TTS synthesis of the consent message itself.

Privacy Guarantees Before Consent

Configuration

Enable the consent flow by adding recording_consent to your assistant configuration:

{
  "recording_consent": {
    "enabled": true,
    "message": "This call may be recorded and will be processed by an AI assistant. Press 1 to agree, or press 2 to hang up."
  }
}

Or via API:

curl -X PATCH https://api.hmsovereign.com/api/v1/assistants/{id} \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "recording_consent": {
      "enabled": true,
      "message": "This call may be recorded and will be processed by an AI assistant. Press 1 to agree, or press 2 to hang up."
    }
  }'

Compliance Use Cases

• GDPR Article 6/7: Explicit consent for processing voice data, with a clear opt-out path
• CCPA: Prior notice and opt-out for recording
• Regulated industries: Healthcare, finance, and legal sectors that require explicit consent before AI interaction
• Call centers: Replacing manual "this call may be recorded" announcements with a verifiable, logged consent step

**Tip: ** The consent message is spoken by your assistant's own TTS provider, so it uses the same voice your callers will hear during the conversation. No extra voice configuration is needed.

Compliance Benefits

GDPR Compliant

All AI providers in the EU configuration (Gladia, Mistral) are EU companies subject to EU data protection laws from the ground up. VoiceDock is operated by Flireo B.V., a Dutch company. Every sub-processor in the chain operates under GDPR, with EU Standard Contractual Clauses in place where a provider has a non-EU parent — the full list is in our Data Processing Agreement.

Data Residency

All processing and storage occurs within EU borders (Germany and France) under normal operating conditions. The only exception is Gladia's infrastructure failover behavior, which is outside VoiceDock's control.

Schrems II

No transatlantic transfers of call content are required under the EU configuration: audio, transcripts and recordings are processed and stored within the EU. Where a sub-processor has a US parent entity, transfers are governed by EU Standard Contractual Clauses (EU Commission Decision 2021/914) and the data itself remains in EU regions. Note the Gladia failover caveat above.

Comparison: US vs EU Stack vs On-Premise

Important for regulated industries: Organizations in healthcare, finance, government, and legal sectors often have strict data residency requirements. Our standard EU stack provides strong data residency within the EU on independently certified infrastructure. The one nuance is Gladia's potential failover behavior. For absolute data sovereignty guarantees (no possibility of data leaving the EU), see our Enterprise On-Premise Solutions.

Legal Entities

Flireo B.V. (VoiceDock)

Legal Name: Flireo B.V.

Entity Type: Dutch Besloten Vennootschap (BV)

Jurisdiction: Netherlands

Role: Platform provider, application logic, and Local TTS

Data Processing: All platform data processed on EU-located servers in Nuremberg, Germany

Gladia

Legal Name: Gladia SAS

Entity Type: French Societe par Actions Simplifiee

Jurisdiction: France

Role: Speech-to-Text processing

Data Processing: Audio transcription in EU-West region (France) by default; see failover note above

Mistral AI

Legal Name: Mistral AI SAS

Entity Type: French Societe par Actions Simplifiee

Jurisdiction: France

Role: Language Model inference

Data Processing: LLM inference on European infrastructure

Infrastructure Provider

Legal Name: Hetzner Online GmbH

Entity Type: German Gesellschaft mit beschränkter Haftung (GmbH)

Jurisdiction: Germany

Role: Real-time voice infrastructure hosting (compute)

Server Location: Nuremberg, Germany (EU)

Data Access: No application-level access. Provides compute resources only. All data is encrypted at rest and in transit. As a German entity, fully subject to EU law and GDPR.

FAQ

Is my data ever processed outside the EU?

Under normal operating conditions, no. When using Gladia + Mistral + Local TTS, all data processing occurs within the European Union (Germany and France). The one exception is Gladia's infrastructure failover: in the event of EU-West unavailability, Gladia may route requests to non-EU servers. This is a Gladia infrastructure decision outside VoiceDock's control.

Do I need Standard Contractual Clauses (SCCs)?

No. Under normal operating conditions, data never leaves the EU, so SCCs for transatlantic data transfers are not required.

What about the US CLOUD Act?

Under the EU configuration, all call content is processed and stored within the EU (Germany and France). The EU AI providers (Gladia, Mistral), Flireo B.V. (which operates VoiceDock), and our voice infrastructure provider (Hetzner Online GmbH) are EU-incorporated. Where a sub-processor has a US parent entity, such as our certified storage provider in Frankfurt, its data stays in the EU region and transfers are governed by EU Standard Contractual Clauses. For organizations that require absolute CLOUD Act immunity, with no US-parent entity anywhere in the stack, we offer fully on-premise deployment (see Enterprise On-Premise Solutions below).

Can I mix EU and non-EU providers?

Yes, but you would reduce your data sovereignty posture. For maximum compliance, use all three EU providers together.

Is there a latency difference?

EU users typically experience lower latency with the EU stack since all processing happens geographically closer (Nuremberg and France). For users outside Europe, latency may be slightly higher.

What if I need an absolute guarantee that data never leaves the EU?

The standard EU stack provides strong data residency, but Gladia's failover behavior means an absolute guarantee cannot be given for STT. For that level of certainty, we offer dedicated on-premise deployment with on-premise STT models — see Enterprise On-Premise Solutions.

Enterprise On-Premise Solutions

For enterprise clients in highly regulated industries (government, defense, healthcare, finance, and critical infrastructure) where absolute data sovereignty is required, VoiceDock offers fully on-premise and blackbox deployment options.

Blackbox On-Premise Deployment

A self-contained, turnkey appliance that runs the entire VoiceDock stack on your own hardware or in your own data center:

• Complete isolation: No external network dependencies. The entire voice AI pipeline (platform, STT, LLM, TTS) runs on infrastructure you own and control.
• No third-party involvement: No non-EU entity at any level of the stack. Full corporate sovereignty.
• Air-gapped capable: Can operate in fully air-gapped environments with no internet connectivity.
• Your security perimeter: Fits within your existing physical security, network policies, and access controls.

What Is Included

Compliance Guarantees

• Zero data egress: No data ever leaves your physical premises
• Full CLOUD Act immunity: No US or non-EU entity is involved at any level
• Schrems II irrelevant: No cross-border data transfers of any kind
• Audit-ready: Full control over logging, monitoring, and access trails
• Custom DPA: Tailored Data Processing Agreement to meet your specific regulatory requirements

Get Started

Contact our enterprise team to discuss your on-premise requirements:

• Email: enterprise@flireo.com
• Subject: On-Premise / Blackbox Deployment Inquiry

Our team will work with your IT, security, and legal departments to scope and deliver a deployment tailored to your compliance needs.

Related Documentation

• BYOK Setup Guide - Learn how to add your own API keys for any provider
• Assistant Configuration - API reference for creating and configuring assistants

Note: For more information about our EU data sovereignty offering, contact us at support@flireo.com or consult with your legal team regarding specific compliance requirements.

Last updated: July 2026