Cloud phone system with EU data residency: what to check

If your customers or your regulator expect call data to stay in the EU, "hosted in Europe" on a website is not enough. Voice is personal data, and an AI voice agent adds more places where it can travel. Use this checklist before you sign.

1. Where does the tenant data live?

Ask where account data, call records and recordings are stored, in which country, and whether you can choose. The answer should be a place, not an adjective. Alpire stores tenant data in the European Union.

2. Where does the AI process the audio?

A phone system with AI agents usually sends audio and text to three kinds of provider: speech-to-text, a language model and a text-to-speech voice. Each has its own location. Ask:

• Which providers can be used, and where does each one process data?
• Who chooses the provider and the region: you or the vendor?
• Does the system ever fall back to another provider or country if one fails? A silent fallback can move voice data outside the region you chose.

In Alpire the customer chooses the speech-to-text, language model and voice provider per call, and the engine never switches provider or country on its own. The catalogue is explicit about where each model is hosted: for example Mistral is European and Nebius keeps no data, while Claude, GPT and Groq are hosted in the United States, so pick accordingly if residency matters to you.

3. Is there a data processing agreement, and does it list the subprocessors?

A DPA is the contract that makes the vendor your processor under GDPR. Look for a named list of subprocessors with their purpose and location, and for the mechanism used for any transfer outside the EU (standard contractual clauses, for instance). Alpire offers a DPA with an annex listing every subprocessor, its purpose and its location, with SCC transfer mechanics. The data processing agreement, the privacy policy and the terms are public.

4. Can you exercise the rights of the people on the calls?

Check that erasure, access and portability are features, not a support ticket. Alpire implements GDPR erasure (art. 17), access and portability exports (art. 15 and 20) in code, plus tenant data portability under the Data Act.

5. What happens to payment card data?

If callers ever read out a card number, you want the system built so it never ends up in a recording or in an AI prompt. Alpire captures card details and PINs by keypad tones only, never by voice, keeps them out of logs and model prompts, masks anything that looks like a card number, and can pause the recording while they are entered.

6. How long are recordings kept, and who can see them?

Look for configurable retention, an audit log, two-factor authentication, a list of active sessions you can revoke, and granular permissions. Alpire provides a per-organisation audit log and security events, IP banning, two-factor authentication by app or email, session revocation and configurable recording retention.

7. Is the data region tied to the billing and the account?

Region is often decided when the account is created. In Alpire the billing currency follows the organisation's region and is fixed at creation: euros in the EU, dollars in the US. Ask every vendor the same question.

A short list to take to the meeting

1. Where are the data and recordings stored?
2. Which AI providers, hosted where, and who picks them?
3. Does anything fail over to another provider or country?
4. Is there a DPA with a subprocessor annex?
5. Are erasure and export built in?
6. How is card data kept out of recordings and prompts?
7. What are the retention, audit and access controls?

None of this replaces your own legal review, because what you need depends on your activity and on how you configure the system. It does make the vendor's answers easy to compare. If you want to look at Alpire's approach in detail, the documentation is public, and you can start a 14-day trial.