Trust Center

Jurisdiction is a feature

Security you can verify. Sovereignty you can prove to your regulator. EU AI Act Article 50 obligations already met, not scheduled. Here is exactly how Kizwork keeps your conversations European — end to end.

The problem

The US CLOUD Act problem

Zoom, Microsoft Teams, Webex and Google Meet offer European data centers. It doesn't matter. As US companies, they can be compelled by US authorities to hand over data — wherever it is stored. "EU region" is a checkbox. Sovereignty is an architecture.

The Kizwork Sovereign Loop

Your audio, video, transcripts and AI processing stay inside the EEA, end to end. A European company. European infrastructure (Scaleway — ISO 27001 and HDS-certified data centers; CISPE and GAIA-X member). European AI models, self-hosted. No data ever sent to US-controlled APIs. No customer data used to train global models.

Twelve-star European ring

Confidential by architecture, not by promise

Paris · Amsterdam · Warsaw. Processed in RAM-only enclaves and wiped after each session. No US parent company exists to be served an order.

Sovereignty checklist

Kizwork vs. US platforms, criterion by criterion

CriterionKizworkUS platforms
Data jurisdiction100% EUSubject to US CLOUD Act
Legal residencyFrench company (S.A.S)US parent entity
AI processingIn-region, self-hosted modelsExternal / US-routed APIs
MetadataMinimized, stored locallyAggregated globally
Key managementCustomer-managed keys availableProvider-controlled
Supply chainEuropean stackUS hyperscalers
EU AI Act — Article 50

The transparency obligation is already in force

Since 2 August 2026, any organisation deploying AI that generates or manipulates audio must disclose it and mark the synthetic content in machine-readable form. This is not a 2027 roadmap item to be budgeted later: it applies to the meetings you are running this quarter.

2 Aug 2026In force. The Digital Omnibus deferred the Annex III high-risk regime to December 2027 — it did not defer Article 50.
€15M or 3%Maximum fine, whichever is higher, calculated on worldwide annual turnover.
Every meetingThe obligation attaches to the deployer, not only the vendor. Your organisation carries it.

Labelling binds the honest. Detection protects you from everyone else.

Article 50 compels legitimate providers to mark synthetic audio. The fraudster cloning your CFO's voice to authorise a transfer will not mark anything. Compliance and security are therefore two distinct problems, and a policy that only addresses the first leaves you exposed to the second.

Kizwork answers both in the same platform: machine-readable marking and explicit speaker consent on every voice we synthesise, and real-time detection with 99.1% detection, alert in 2–3 s for the voices we did not. One is what you show your regulator. The other is what stops the wire transfer.

What Article 50 requiresHow Kizwork delivers it
Disclose that participants are interacting with AI-generated or AI-altered audioVerified Voice state shown to every participant, in-session, not buried in terms
Mark synthetic or manipulated audio in a machine-readable formatMarking applied at generation on speech-to-speech and anonymisation (live in Voice Trust+)
Obtain informed consent before reproducing a person's voiceExplicit speaker consent captured before any voice imitation is enabled
Be able to evidence the above to a supervisory authorityForensic reports per incident and immutable audit logs per session
Security architecture

Defense in depth, verifiable by design

🔒

Encryption

TLS 1.3 with perfect forward secrecy in transit. AES-256-GCM at rest. Customer-managed keys on enterprise plans.

🧱

Zero-trust access

MFA everywhere, least-privilege access, and immutable audit logs for every session.

🧪

Tested continuously

Quarterly third-party penetration tests and a documented vulnerability-disclosure process.

📜

Compliance-aligned

GDPR-native, aligned with NIS2, DORA and the EU AI Act — including the Article 50 transparency duties detailed above. SEAL-2 sovereignty posture out of the box.

🧠

Private AI

Self-hosted transcription and report models on EU infrastructure — GPU in our data centres, CPU and ARM on-premises. Processing in RAM-only enclaves, wiped after each session.

🇪🇺

European supply chain

Hosted on Scaleway (Paris, Amsterdam, Warsaw). No US hyperscalers anywhere in the stack.

Documents

Everything your security team will ask for

Download our Data Processing Agreement, security whitepaper and sovereignty assessment pack — or request access to the full data room.

Access the data room   Get the Sovereignty Risk Scorecard
Talk to us

Prove it to your regulator

Book a security-focused session with our team. Bring your DPO, your CISO, your hardest questions.

Book a security review