Your data never leaves the territory.
TranscribIA was designed from day one for organisations that cannot entrust their meetings to an American consumer tool. Hosting in France, strict isolation by organisation — and, if your policy requires it, you can also choose an on-premise installation within your own infrastructure.
3 pillars
Sovereignty, Security, Compliance
Sovereignty
- Hosting in France (Strasbourg data centre, French jurisdiction)
- SecNumCloud hosting (Outscale, OVHcloud SecNumCloud) available on a project basis for ANSSI requirements
- No transfers outside the EU by default
- On-premise option: installation within your infrastructure through Docker
- Configurable AI engines (European cloud or local on-premise models)
Security
- End-to-end TLS
- Encryption at rest (PostgreSQL + backups)
- Tenant isolation: 1 PostgreSQL schema per organisation
- Mandatory 2FA for administrator accounts
- Audit log of all sensitive actions
GDPR compliance
- Signable Data Processing Agreement (DPA)
- Built-in processing register
- Right to portability (full ZIP export)
- Right to erasure (tenant purge)
- Configurable retention policy
- Publicly accessible compliance pack
References to SecNumCloud and ANSSI concern French frameworks and project-specific deployment options; they do not constitute general certification of TranscribIA. This page’s language changes neither the agreed hosting location nor the contractual framework. The DPA is available in the site’s five languages; the French text is authoritative. National annexes supplement the European framework according to the project’s actual country. The template must still be completed and reviewed before signature.
2026 innovation
Identify speakers from a previous session — without a persistent database
New feature available since May 2026: automatically pre-fill speakers for a new session by reusing names from an already annotated previous session within the same tenant. An approach unique in the market, designed from day one to minimise the GDPR footprint.
Computation runs in RAM on our sovereign GPU infrastructure, then all intermediate data is destroyed before the request ends. Suggestions are shown to the user as a table of names requiring explicit validation — never silently applied automatically.
Technical safeguards
- Volatile-memory computation. No intermediate data written to disk; tmpfs only, purged at the end of the request.
- Strictly within the tenant. An organisation can use only its own previous sessions — never another customer's.
- Mandatory human validation. Each suggestion is displayed with a confidence score and must be confirmed by an operator.
- Tenant opt-in. Disabled by default; activation requires a tenant DPIA and dedicated DPA addendum.
- Scrubbed logs. No person's name, individual score or identifying information in server logs.
The absence of a persistent template does not rule out classification as biometric processing. If voice data is used to uniquely identify a person, GDPR Article 9 conditions must be examined in addition to the Article 6 lawful basis. Lawfulness depends on context and must be documented through a DPIA and DPA addendum before activation; those documents alone do not authorise processing. Our GDPR team supports you in this assessment.
A recording's journey
Four layers, in this order, without exception
Every audio file you entrust to us follows this exact chain. No step can be skipped, no exceptions are made.
Full journey audit, frequency of checks and chain of responsibility documented in the public compliance pack.
Two deployment modes
Sovereign SaaS OR on-premise — you choose
Most of our customers start with SaaS hosted in France on our sovereign infrastructure — immediate deployment, no installation required. For organisations that need it, TranscribIA is also installable on-premise, within your own infrastructure, through standalone Docker Compose architecture — no cloud dependencies, no outbound data.
On-premise is primarily intended for local authorities with stringent security requirements, hospitals bound by medical confidentiality, law firms, unions and any organisation whose internal policy prohibits SaaS. Both modes share exactly the same product.
# On-premise architecture overview
┌──────────────────────────────────────────┐
│ Utilisateurs (intranet client) │
└────────────┬─────────────────────────────┘
▼
┌──────────────────────────────────────────┐
│ Nginx reverse proxy + TLS │
└─┬───────────────────────────────────────┬┘
▼ ▼
┌─────────────────┐ ┌───────────────────┐
│ API & SPA │◄───────►│ Workers IA │
│ React SPA │ │ Queue Redis │
└──────┬──────────┘ └───────────────────┘
▼
┌─────────────────┐
│ PostgreSQL │
│ (1 schema / │
│ organisation) │
└─────────────────┘ Public documentation
For your DPOs, IT directors and buyers
The full compliance pack — processing register, DPA template, security measures, retention policy, subprocessors, architecture diagrams — is publicly accessible without an account.
The DPA is offered in five languages, under French law (GDPR Article 28), and identifies OHADJA as the processor. The French text is authoritative. The fields [to complete] must be completed by your legal department before signature.