AI Voice Recorder GDPR SOC 2 Compliance: Which Are Compliant and How to Check Any Vendor

This page is general information, not legal advice. If you want to run a check right now, jump to the seven-step checklist. If you want Comu's own position, skip to Comu's compliance facts.

What do GDPR, SOC 2, HIPAA and CCPA mean for an AI voice recorder?

They are three different kinds of thing. GDPR and CCPA are laws, HIPAA is a set of US federal rules, and SOC 2 is an examination by an independent CPA that ends in a report. The kind of thing it is decides which evidence a vendor can hand you.

Can a vendor be GDPR certified, or only compliant?

GDPR is a regulation, so a vendor is compliant with it or it is not, and a certificate is a separate, voluntary step. The Regulation provides for voluntary certification: Article 42 says certification is voluntary (paragraph 3), does not reduce the responsibility of the controller or processor for compliance (paragraph 4), and is issued for a maximum of three years (paragraph 7). A vendor that holds such a certificate can show it. A vendor without one can still comply, and it proves that through its contract and practices.

Two roles matter. Article 4 defines the controller as the party that determines the purposes and means of processing, and the processor as the party that processes personal data on behalf of the controller. When your company decides to record meetings and the vendor processes the recordings on its behalf, your company is the controller and the vendor is the processor.

Article 28 sets the rules for that relationship:

• The controller uses only processors that provide sufficient guarantees (Article 28(1)).
• The processor engages another processor only with the controller's prior written authorization, and informs the controller of intended changes so the controller can object (Article 28(2)).
• Processing is governed by a binding contract, in writing, that covers the subject matter, duration, nature and purpose of the processing, the type of personal data and the obligations and rights of the controller (Article 28(3) and (9)). This contract is the data processing agreement, or DPA.

Is my AI recorder GDPR compliant? A 15-minute test

Open the vendor's trust page and look for three documents. Each one maps to an Article you can read yourself.

1. A DPA you can sign or download. Article 28(3) requires one for every processor relationship.
2. A sub-processor list with a way to get change notices. Article 28(2) gives the controller the right to be informed of additions and replacements.
3. A deletion route. Article 28(3)(g) requires the processor to delete or return all personal data at the end of the service, at the controller's choice. Article 17 gives individuals a right to erasure on specific grounds.

If all three exist, move to the seven-step checklist below. If one is missing, ask the vendor in writing before you record anything sensitive.

What is a SOC 2 report, and what does an AI note taker SOC 2 claim prove?

A SOC 2 report is the written result of an examination performed by a licensed, independent CPA under the AICPA Attestation Standards. The examination evaluates controls relevant to the security, availability, processing integrity, confidentiality or privacy of an organization's systems (AICPA, Oct 28, 2026). The reports give a vendor's customers independent assurance that its controls are suitably designed and operating effectively (Journal of Accountancy, Feb 2026).

Three points follow from that definition.

• It is a report. The examination produces a written report, so the report is the document to ask a vendor for.
• A licensed CPA firm signs it. The AICPA states it will act against auditors who are unlicensed or not enrolled in peer review, and it refers unlicensed firms and practitioners to state boards of accountancy. The firm name on the report is checkable.
• It is restricted-use. SOC 2 reports are restricted to specified parties with sufficient knowledge of the service organization's system.

What is the difference between SOC 2 Type I and Type II?

A Type I report covers controls as of a specific date. A Type II report also covers whether those controls operated effectively.

Read the date on a SOC 2 report before anything else.

The AICPA is also changing the criteria. Its Oct 28, 2026 exposure draft proposes 2027 Trust Services Criteria with new points of focus for AI, including training data management. Public comment is open through Jan 15, 2027, and the criteria would apply to engagements beginning on or after Dec 31, 2027 if approved.

What makes a HIPAA compliant AI voice recorder?

For a HIPAA compliant AI voice recorder, the deciding document is a business associate agreement. HHS defines a business associate as a person or organization that performs functions or activities on behalf of a covered entity that involve creating, receiving, maintaining or transmitting protected health information (PHI). HHS lists examples that fit AI recorders closely: a cloud service provider that stores or processes electronic PHI, and "the vendor of an app, that provides transcription services to a physician."

The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances that the business associate will appropriately safeguard the information. The assurances take the form of a contract or other written arrangement, which HHS calls a business associate agreement. The agreement must:

• describe the permitted and required uses and disclosures of PHI;
• provide that the business associate will not use or further disclose PHI other than as the agreement permits or the law requires.

A business associate must also sign a BAA with its own subcontractors before it discloses PHI to them (HHS, content last reviewed Oct 21, 2026). So a HIPAA claim from an AI voice recorder vendor is verified in two places: you hold a signed BAA, and the vendor's sub-processors are covered by their own.

What does CCPA require?

The California Consumer Privacy Act gives California residents rights over their personal information (California Attorney General, updated Aug 28, 2026). They can find out what personal information a business collects, delete it, opt out of its sale or sharing, correct it, and limit use of sensitive personal information. When you ask a business to delete your data, it must also tell its service providers to do the same, subject to exceptions such as legal retention duties.

The CCPA applies to for-profit businesses that do business in California and meet any one of three tests:

• more than $25 million in gross annual revenue;
• buying, selling or sharing the personal information of 100,000 or more California residents or households;
• earning 50% or more of annual revenue from selling California residents' personal information.

CCPA is a law, so the accurate word is "compliant."

How to check any AI voice recorder for GDPR and SOC 2

Run the seven steps below on any vendor's trust page, security page and privacy policy, and write down each answer with the date you checked.

Step 1: Find the report type and the date

Look for the words "SOC 2" and record four facts: Type I or Type II, the name of the CPA firm, the date or dates the report covers, and the trust services categories in scope. An AI note taker SOC 2 claim with no date is a claim you cannot weigh.

• Prefer a Type II report, which also covers operating effectiveness, and check that its date is recent.
• Check that the categories include security and confidentiality, because recordings and transcripts are confidential material.
• Check that the system in scope is the product you use: the app, the cloud that stores recordings and the AI processing.
• Look up the CPA firm and confirm it is a licensed firm.

Ask: "Which SOC 2 report do you hold, which CPA firm issued it, what dates does it cover, and which categories and systems are in scope?"

Step 2: Get the data processing agreement

Find the DPA link on the trust page or in the footer. Download it and check it against Article 28(3). The contract should state that the vendor:

Ask: "Can you send the DPA for signature, and which entity signs it?"

Step 3: Read the sub-processor list

An AI voice recorder usually relies on other companies for cloud storage, speech-to-text and language models. Article 28(2) lets the processor engage another processor only with your authorization, and requires it to tell you about intended additions and replacements. Article 28(4) requires the same data protection obligations to pass down to each sub-processor.

• Find the sub-processor list and note which companies handle audio, transcripts and AI processing.
• Find the way to receive change notices, such as an email subscription.
• For HIPAA, confirm each subcontractor that touches PHI is covered by its own BAA.

Ask: "Where is your current sub-processor list, and how will you notify me before you add one?"

Step 4: Confirm where the data is stored and processed

Find the region where recordings and transcripts are stored, and the regions where processing happens. Article 44 allows a transfer of personal data to a third country only if the conditions of Chapter V of GDPR are met by the controller and the processor. Article 28(3)(a) ties transfers to your documented instructions.

• Write down the storage region and the processing regions.
• Find the transfer mechanism named in the DPA if data leaves the European Economic Area.
• Check that backups follow the same region rules.

Ask: "In which regions are audio, transcripts and AI processing located, and what legal mechanism covers any transfer out of the EEA?"

Step 5: Check retention and deletion

Find how long recordings, transcripts and backups are kept, and how you delete them. Article 28(3)(g) covers deletion at the end of the service. Article 17 covers erasure requests. For California residents, the CCPA right to delete includes telling service providers to delete as well.

• Look for in-product deletion: can you delete one recording, and does the transcript go with it?
• Look for account deletion and what it removes.
• Ask how long backups hold deleted data.

Ask: "What is the retention period for audio, transcripts and backups, and how do I get written confirmation of deletion?"

Step 6: Read the training policy

Find the sentence that says whether the vendor uses your recordings or transcripts to train AI models, and whether it passes them to a model provider that trains on them. Article 28(3)(a) limits a processor to your documented instructions, so ask where the contract addresses training on your data. The CCPA right to opt out covers the sale or sharing of personal information.

• Find the policy in the privacy policy and in the DPA, because the two should agree.
• Check whether the setting is on or off by default and who can change it.
• Check what the vendor's model providers are allowed to do with your data.

Ask: "Do you or any sub-processor use my audio or transcripts to train or improve AI models, and where is that written in the contract?"

Step 7: Request the report and the paperwork

SOC 2 reports are restricted to specified parties, so request the report instead of looking for a download button.

1. Email the vendor's security or sales contact with the questions from steps 1 to 6.
2. Ask for the SOC 2 report, the DPA, the sub-processor list and, for health data, the BAA.
3. When the SOC 2 report arrives, read the auditor's opinion and the scope. Match its dates to the date you recorded in step 1.
4. File the documents with the date you received them and set a reminder to request the next report.

Ask: "Please send your latest SOC 2 report under confidentiality terms, plus the DPA, the sub-processor list and the BAA."

Seven-step scorecard

What are Comu's GDPR, HIPAA, SOC 2 and CCPA facts?

Comu has passed GDPR, HIPAA and SOC 2, and Comu is CCPA compliant (checked Nov 9, 2026).

Consent is a separate duty from data security. Tell the other person you are recording. Laws on recording calls differ by country and state, and you are responsible for following them. For the rules in each US state, read Recording Calls in the US: State-by-State Consent Laws and Privacy Guidelines.

Comu Action Pro costs $179.99 (checked Nov 9, 2026) at store.comu.com, and the free Starter plan comes with the device.

Frequently Asked Questions

Is GDPR compliance the same as GDPR certification?

No. GDPR compliance means a vendor follows the Regulation in how it processes personal data, and you verify it through the DPA, the sub-processor list and the deletion terms. Certification is a separate, voluntary route under Article 42, issued for a maximum of three years by a certification body or a supervisory authority. A vendor can be compliant with or without a certificate.

Does a SOC 2 report mean an AI note taker never trains on my recordings?

Read the vendor's training policy in the privacy policy and the DPA, because a SOC 2 report is an examination of controls relevant to security, availability, processing integrity, confidentiality or privacy. Comu does not use your data to train AI.

What is the difference between SOC 2 Type I and Type II?

A Type I report covers whether controls are suitably designed as of one date. A Type II report also covers whether they operated effectively. Read the date on the report first.

Do I need a business associate agreement to use an AI voice recorder for patient visits?

If you are a HIPAA covered entity and the vendor creates, receives, maintains or transmits PHI on your behalf, HIPAA requires satisfactory assurances in a contract or other written arrangement, which HHS calls a business associate agreement. HHS lists a cloud service provider and the vendor of an app that provides transcription services to a physician as examples of business associates.

Is CCPA a certification?

No. CCPA is a California law, so a business is compliant or it is not. The California Attorney General describes the rights it gives residents: to know, delete, opt out of sale or sharing, correct, and limit use of sensitive personal information. Comu is CCPA compliant.

Where do I find a vendor's sub-processor list?

Look in the trust page, the footer links, the privacy policy and the annexes of the DPA. Article 28(2) requires a processor to inform the controller of intended changes to sub-processors, so a vendor should also offer a way to receive notices. Ask support for the current list if you cannot find it.

Is Comu GDPR, HIPAA and SOC 2 compliant?

Yes. Comu has passed GDPR, HIPAA and SOC 2 (checked Nov 9, 2026). Comu is also CCPA compliant.

Can I delete my recordings from Comu?

Yes. In the Comu app you can delete a single audio file, and its linked text is deleted with it. You can also delete contacts or delete the whole account, which clears all of your data.

Does Comu use my recordings to train AI or sell my data?

No. Comu does not sell data to third parties, and it does not use your data to train AI. Files are encrypted throughout.

Related reading

• Is Call Recording Legal? Understanding Rules, Privacy Policies, and Compliance Requirements
• Recording Calls in the US: State-by-State Consent Laws and Privacy Guidelines
• Best Free Call Recorder App for Lawyers: Confidentiality First
• Comu AI Transcription, Summaries & Feature Guide
• Comu Action Pro Price and Subscription Plans

Sources

Checked on Nov 9, 2026.

1. European Union, Regulation (EU) 2016/679 (GDPR), Articles 4, 17, 28, 42 and 44, EUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
2. AICPA & CIMA, System and Organization Controls: SOC Suite of Services: https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
3. AICPA & CIMA, "AICPA Proposes Update of SOC 2 Trust Services Criteria" (Oct 28, 2026): https://www.aicpa-cima.com/news/article/aicpa-proposes-update-of-soc-2-r-trust-services-criteria-to-enhance-the-relevance-usability-and-value-of-cpas-reports
4. Journal of Accountancy, "Promises of 'fast and easy' threaten SOC credibility" (Feb 2026): https://www.journalofaccountancy.com/issues/2026/feb/promises-of-fast-and-easy-threaten-soc-credibility/
5. AICPA & CIMA, "Maintaining high standards for SOC engagements": https://www.aicpa-cima.com/professional-insights/video/maintaining-high-standards-for-soc-engagements
6. U.S. Department of Health and Human Services, Business Associates Frequently Asked Questions (content last reviewed Oct 21, 2026): https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
7. California Attorney General, California Consumer Privacy Act (updated Aug 28, 2026): https://oag.ca.gov/privacy/ccpa