Updated 2026-09-16

Who processes your meeting data

Khulasa uses the third parties below to run the service. This page lists them per plan, says what each one can see, and says where it processes data. It is written from the running code, not from the sales deck.

Free, Team and Business

The shared service running at khulasa.ai. Speech recognition and analysis use managed cloud models.

Who receives meeting audio: Speechmatics, in the European Union
Who receives transcripts: The Google Gemini API, with no region selection
Who receives summaries and action items: Postmark in the United States, for email; Jira as well if you connect it
Where your data is stored: France, on our own servers hosted by OVHcloud

Swipe the table sideways to see every column.

Sub-processors on the Free, Team and Business plan
Provider	What it does	What it can see	Where it processes	Transfer safeguard	On this plan
Receiving data today
OVH Groupe SAOVHcloudContracting entity: FranceWhich legal entity we contract with is being confirmed.	Hosts the servers, databases and object storage the service runs on	Meeting audio Transcript Summary, decisions and action items Meeting title Names, email addresses, organisation Internal identifiers Calendar event details	FranceThe exact datacentre is being confirmed with the provider.	Written data protection terms, as set out in our Data Processing Addendum	In use
Speechmatics LtdSpeechmaticsContracting entity: United KingdomWhich legal entity we contract with is being confirmed.	Turns meeting audio into text and separates the speakers	Meeting audio Internal identifiers Not sent yet: Glossary terms. The feature is built but does not reach this provider in the running service.	European UnionPinned to the provider's European endpoint in our configuration. The exact country is being confirmed.	Written data protection terms, as set out in our Data Processing Addendum	In use
Google LLCGemini APIContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Writes the summary, decisions, risks, next steps and action items from the transcript	Transcript Meeting title Not sent yet: Glossary terms. The feature is built but does not reach this provider in the running service.	WorldwideThis provider offers us no region selection, so processing may happen in any country in which it operates.	Written data protection terms, as set out in our Data Processing Addendum	In use
ActiveCampaign, LLCPostmarkContracting entity: United States	Delivers summary emails, invitations and account emails	Summary, decisions and action items Meeting title Names, email addresses, organisation	United StatesThis provider has no European or Middle Eastern region to choose from.	Written data protection terms, as set out in our Data Processing Addendum	In use
Stripe, Inc.StripeContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Runs subscriptions and payments. It never receives meeting content	Billing details Internal identifiers Names, email addresses, organisation	United StatesNo processing region is pinned for billing.	Written data protection terms, as set out in our Data Processing Addendum	In use
Google LLCGoogle sign-in, Google CalendarContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in, and reads calendar events so the notetaker knows which meetings to join	Names, email addresses, organisation Calendar event details	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	In use
Google LLCGoogle WorkspaceContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Receives email sent to our own addresses, including support and privacy requests	Names, email addresses, organisation	WorldwideThe data region on our own mail account is being confirmed.	Written data protection terms, as set out in our Data Processing Addendum	In use
Google LLCGoogle Analytics 4Contracting entity: United States	Measures how the public website is used, and only after a visitor accepts analytics cookies	Public website usage	WorldwideOnly on the public website, and only after you accept analytics cookies.	Written data protection terms, as set out in our Data Processing Addendum	In use
Configured, sending nothing today
Mailgun Technologies, Inc.MailgunContracting entity: United StatesWhich legal entity we contract with is being confirmed.	Alternative email delivery, implemented and ready but not currently sending	Summary, decisions and action items Meeting title Names, email addresses, organisation	United States · European UnionThe region would follow the sending domain we configure.	Written data protection terms, as set out in our Data Processing Addendum	Built, not in use
Microsoft CorporationMicrosoft sign-in, Outlook calendarContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in, and reads calendar events so the notetaker knows which meetings to join	Names, email addresses, organisation Calendar event details	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	Built, not in use
Apple Inc.Sign in with AppleContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in. It receives no meeting content of any kind	Names, email addresses, organisation	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	Built, not in use
Meta Platforms, Inc.Facebook LoginContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in. It receives no meeting content of any kind	Names, email addresses, organisation	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	Built, not in use
Google LLC, Mozilla Corporation, Apple Inc.Browser push servicesContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Delivers browser notifications. The message body is encrypted end to end before it is handed over	Delivery address and timing Meeting title Names, email addresses, organisation	Wherever your browser's vendor operatesYour browser vendor's push service decides this, not us.	Written data protection terms, as set out in our Data Processing Addendum	Built, not in use
Only when you connect them
Atlassian CorporationJira CloudContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Creates issues in your own Jira site from the action items in a meeting	Summary, decisions and action items Meeting title	Wherever your own account with them isYour Jira site's own data residency setting decides this, not ours.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
No access to meeting data
Cloudflare, Inc.Cloudflare DNSContracting entity: United States	Answers DNS queries for our domains. It is not a proxy, so it never sees traffic or meeting content	DNS query information	WorldwideDNS only. Requests go straight to our servers, so this provider never sees traffic or meeting content.	Written data protection terms, as set out in our Data Processing Addendum	In use
Internet Security Research GroupLet's EncryptContracting entity: United States	Issues the TLS certificate for our domain	Our domain name only	United States	Written data protection terms, as set out in our Data Processing Addendum	In use

Private Cloud

A dedicated deployment we operate for you. No such deployment is running today; this is what one would use.

Who receives meeting audio: Nobody outside the deployment
Who receives transcripts: Nobody outside the deployment
Who receives summaries and action items: Only if email or Jira is switched on for your deployment
Where your data is stored: The location we agree with you when we set it up

Swipe the table sideways to see every column.

Sub-processors on the Private Cloud plan
Provider	What it does	What it can see	Where it processes	Transfer safeguard	On this plan
Receiving data today
ActiveCampaign, LLCPostmarkContracting entity: United States	Delivers summary emails, invitations and account emails	Summary, decisions and action items Meeting title Names, email addresses, organisation	United StatesThis provider has no European or Middle Eastern region to choose from.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Google LLCGoogle sign-in, Google CalendarContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in, and reads calendar events so the notetaker knows which meetings to join	Names, email addresses, organisation Calendar event details	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Google LLCGoogle WorkspaceContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Receives email sent to our own addresses, including support and privacy requests	Names, email addresses, organisation	WorldwideThe data region on our own mail account is being confirmed.	Written data protection terms, as set out in our Data Processing Addendum	In use
Configured, sending nothing today
Mailgun Technologies, Inc.MailgunContracting entity: United StatesWhich legal entity we contract with is being confirmed.	Alternative email delivery, implemented and ready but not currently sending	Summary, decisions and action items Meeting title Names, email addresses, organisation	United States · European UnionThe region would follow the sending domain we configure.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Microsoft CorporationMicrosoft sign-in, Outlook calendarContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in, and reads calendar events so the notetaker knows which meetings to join	Names, email addresses, organisation Calendar event details	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Google LLC, Mozilla Corporation, Apple Inc.Browser push servicesContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Delivers browser notifications. The message body is encrypted end to end before it is handed over	Delivery address and timing Meeting title Names, email addresses, organisation	Wherever your browser's vendor operatesYour browser vendor's push service decides this, not us.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Only when you connect them
Atlassian CorporationJira CloudContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Creates issues in your own Jira site from the action items in a meeting	Summary, decisions and action items Meeting title	Wherever your own account with them isYour Jira site's own data residency setting decides this, not ours.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
No access to meeting data
Internet Security Research GroupLet's EncryptContracting entity: United States	Issues the TLS certificate for our domain	Our domain name only	United States	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Hugging Face, Inc.Hugging Face HubContracting entity: United States	Distributes the open model weights a self-hosted deployment downloads when it is installed	Nothing	United StatesContacted when the deployment is installed. Nothing is sent while the service is running.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it

On-Premise

Khulasa running on your own hardware, operated by your team. No customer installation exists today.

Who receives meeting audio: Nobody outside your infrastructure
Who receives transcripts: Nobody outside your infrastructure
Who receives summaries and action items: Only if your operator switches email or Jira on
Where your data is stored: Your own infrastructure

Swipe the table sideways to see every column.

Sub-processors on the On-Premise plan
Provider	What it does	What it can see	Where it processes	Transfer safeguard	On this plan
Receiving data today
ActiveCampaign, LLCPostmarkContracting entity: United States	Delivers summary emails, invitations and account emails	Summary, decisions and action items Meeting title Names, email addresses, organisation	United StatesThis provider has no European or Middle Eastern region to choose from.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Google LLCGoogle sign-in, Google CalendarContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in, and reads calendar events so the notetaker knows which meetings to join	Names, email addresses, organisation Calendar event details	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Google LLCGoogle WorkspaceContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Receives email sent to our own addresses, including support and privacy requests	Names, email addresses, organisation	WorldwideThe data region on our own mail account is being confirmed.	Written data protection terms, as set out in our Data Processing Addendum	In use
Configured, sending nothing today
Mailgun Technologies, Inc.MailgunContracting entity: United StatesWhich legal entity we contract with is being confirmed.	Alternative email delivery, implemented and ready but not currently sending	Summary, decisions and action items Meeting title Names, email addresses, organisation	United States · European UnionThe region would follow the sending domain we configure.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Microsoft CorporationMicrosoft sign-in, Outlook calendarContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Signs users in, and reads calendar events so the notetaker knows which meetings to join	Names, email addresses, organisation Calendar event details	Worldwide	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Google LLC, Mozilla Corporation, Apple Inc.Browser push servicesContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Delivers browser notifications. The message body is encrypted end to end before it is handed over	Delivery address and timing Meeting title Names, email addresses, organisation	Wherever your browser's vendor operatesYour browser vendor's push service decides this, not us.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Only when you connect them
Atlassian CorporationJira CloudContracting entity: being confirmedWhich legal entity we contract with is being confirmed.	Creates issues in your own Jira site from the action items in a meeting	Summary, decisions and action items Meeting title	Wherever your own account with them isYour Jira site's own data residency setting decides this, not ours.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
No access to meeting data
Internet Security Research GroupLet's EncryptContracting entity: United States	Issues the TLS certificate for our domain	Our domain name only	United States	Written data protection terms, as set out in our Data Processing Addendum	If you enable it
Hugging Face, Inc.Hugging Face HubContracting entity: United States	Distributes the open model weights a self-hosted deployment downloads when it is installed	Nothing	United StatesContacted when the deployment is installed. Nothing is sent while the service is running.	Written data protection terms, as set out in our Data Processing Addendum	If you enable it

Meeting platforms are not sub-processors

Your meeting happens on one of the platforms below, under your own agreement with that platform. The Khulasa notetaker joins it as a participant, exactly as a colleague would. We send them nothing for processing, and they are not sub-processors of ours.

Google Meet
Microsoft Teams
Zoom

Our contractual list currently names these platforms as sub-processors. That is being corrected; the description above is what the software does.

The contractual list

This page describes what the running service does. The list your Data Processing Addendum binds us to is the contractual one, and where the two differ, the contractual list governs. Any difference between them is deliberate and recorded, and a build fails if a new one appears.

Read the contractual sub-processor list

Changes

This page describes the service as of 2026-09-16.

2026-09-16First publication. Apple recorded as sign-in only rather than as a meeting platform; meeting platforms separated from sub-processors; Google sign-in and Calendar, Google Workspace, Mailgun, browser push, Jira, Let's Encrypt and Hugging Face added.

Questions from your security review?

We answer sub-processor, residency and deletion questions directly, and we will sign the paperwork your legal team needs.

Start free See plans