Security you can verify. Sovereignty you can prove to your regulator. EU AI Act Article 50 obligations already met, not scheduled. Here is exactly how Kizwork keeps your conversations European — end to end.
Zoom, Microsoft Teams, Webex and Google Meet offer European data centers. It doesn't matter. As US companies, they can be compelled by US authorities to hand over data — wherever it is stored. "EU region" is a checkbox. Sovereignty is an architecture.
Your audio, video, transcripts and AI processing stay inside the EEA, end to end. A European company. European infrastructure (Scaleway — ISO 27001 and HDS-certified data centers; CISPE and GAIA-X member). European AI models, self-hosted. No data ever sent to US-controlled APIs. No customer data used to train global models.
Paris · Amsterdam · Warsaw. Processed in RAM-only enclaves and wiped after each session. No US parent company exists to be served an order.
| Criterion | Kizwork | US platforms |
|---|---|---|
| Data jurisdiction | 100% EU | Subject to US CLOUD Act |
| Legal residency | French company (S.A.S) | US parent entity |
| AI processing | In-region, self-hosted models | External / US-routed APIs |
| Metadata | Minimized, stored locally | Aggregated globally |
| Key management | Customer-managed keys available | Provider-controlled |
| Supply chain | European stack | US hyperscalers |
Since 2 August 2026, any organisation deploying AI that generates or manipulates audio must disclose it and mark the synthetic content in machine-readable form. This is not a 2027 roadmap item to be budgeted later: it applies to the meetings you are running this quarter.
Article 50 compels legitimate providers to mark synthetic audio. The fraudster cloning your CFO's voice to authorise a transfer will not mark anything. Compliance and security are therefore two distinct problems, and a policy that only addresses the first leaves you exposed to the second.
Kizwork answers both in the same platform: machine-readable marking and explicit speaker consent on every voice we synthesise, and real-time detection with 99.1% detection, alert in 2–3 s for the voices we did not. One is what you show your regulator. The other is what stops the wire transfer.
| What Article 50 requires | How Kizwork delivers it |
|---|---|
| Disclose that participants are interacting with AI-generated or AI-altered audio | Verified Voice state shown to every participant, in-session, not buried in terms |
| Mark synthetic or manipulated audio in a machine-readable format | Marking applied at generation on speech-to-speech and anonymisation (live in Voice Trust+) |
| Obtain informed consent before reproducing a person's voice | Explicit speaker consent captured before any voice imitation is enabled |
| Be able to evidence the above to a supervisory authority | Forensic reports per incident and immutable audit logs per session |
TLS 1.3 with perfect forward secrecy in transit. AES-256-GCM at rest. Customer-managed keys on enterprise plans.
MFA everywhere, least-privilege access, and immutable audit logs for every session.
Quarterly third-party penetration tests and a documented vulnerability-disclosure process.
GDPR-native, aligned with NIS2, DORA and the EU AI Act — including the Article 50 transparency duties detailed above. SEAL-2 sovereignty posture out of the box.
Self-hosted transcription and report models on EU infrastructure — GPU in our data centres, CPU and ARM on-premises. Processing in RAM-only enclaves, wiped after each session.
Hosted on Scaleway (Paris, Amsterdam, Warsaw). No US hyperscalers anywhere in the stack.
Download our Data Processing Agreement, security whitepaper and sovereignty assessment pack — or request access to the full data room.
Book a security-focused session with our team. Bring your DPO, your CISO, your hardest questions.
Book a security review