On-premises AI and data protection: where should meeting recordings be processed?

Every company that wants to summarise meetings with AI eventually faces the same question: where do these recordings go? A sales call mentions a client by name, a management meeting covers pricing strategy, an HR conversation touches an employee's personal circumstances. That is why we offer our own product, Transify AI, both as a cloud service and as an on-premises install. This article explains the difference between the two models and what to look at when deciding.

#Why is a meeting recording sensitive?

Under Türkiye's Personal Data Protection Law No. 6698 (KVKK), as under the GDPR, any information that makes a person identified or identifiable is personal data. A meeting recording holds many kinds at once:

• Participants' voices, names and often their image
• What is said about people's opinions, performance or personal circumstances
• Third parties mentioned in the meeting: clients, candidates, suppliers
• Information that isn't personal data but still needs protecting: prices, contract terms, product plans

Once a recording is processed with AI, the transcript and the summary are added to that list; what needs protecting is not just the audio file but every output produced from it.

#Where does data travel in a cloud service?

When you use a cloud-based AI service, your data doesn't stay only on that service's server; it also goes to the model providers the service relies on, its sub-processors. We think this should be stated plainly. The sub-processors listed in the privacy policy of Transify's cloud version are:

The safeguards of the cloud version are written in the policy too: all communication is encrypted with HTTPS/TLS, passwords are stored as bcrypt hashes, access logs are kept and media files are deleted automatically after processing. Retention periods: media files 30 days by default (24 hours can be chosen on the Pro and Team plans), transcript text 30 days.

For many teams this is enough: general team meetings, training recordings, interviews and videos that will be published anyway. The cases where it isn't enough are just as clear.

#When is the cloud not enough?

• Cross-border transfer: If the sub-processors' servers are abroad, this is a transfer of personal data abroad under Article 9 of the KVKK and is subject to separate conditions.
• Sector rules: In areas such as finance, healthcare and the public sector there may be additional regulations and contract terms limiting data leaving the organisation.
• Client contracts: A confidentiality agreement with your client may prohibit sharing call recordings with third parties.
• Trade secrets: Even where it is legally permitted, you may not want the content of certain meetings to leave the company.

#What does an on-premises install change?

With an on-premises install the service runs on your own servers. Transify's enterprise installation has four steps:

1. Server preparation: A Linux or Windows virtual machine, installed with Docker or directly on the server. At least 8 CPU cores and 32 GB of RAM are recommended; if the models are to run in-house, an analysis server with a GPU is needed.
2. Database: PostgreSQL set-up, a backup routine and integration with your company's single sign-on (SSO).
3. AI pipeline: Speech recognition, translation and analysis run inside your company network; using external APIs is optional.
4. Admin panel: Usage and support are tracked from one panel; the admin dashboard is included.

The result: data stays in Türkiye or the region you choose, on your own infrastructure. You decide who can access which recording through role-based permissions and follow it in the audit log.

#The two models compared

#The price of running it yourself

An on-premises install is not automatically “more secure”; it moves the responsibility to your side. Before deciding, take these into account:

• Hardware: Running models on your own servers needs GPUs; the server has to be bought or rented and its capacity planned for your level of use.
• Operations: Updates, backups, monitoring and access management become your job, or that of the team you contract. An internal server with no backups and no patches is riskier than a well-run cloud service.
• Model currency: In the cloud, models are refreshed by the provider; on-premises, moving to a new version is a planned piece of work.

If you don't have a team to take on the server side, we can run it with you through our maintenance, hosting and server management service. For the general pros and cons of running your own server, see shared hosting vs VPS.

#A checklist, whichever model you choose

1. Inform participants: Say at the start that the meeting is being recorded and will be processed with AI, and cover this processing in your privacy notice.
2. Know the sub-processors: Ask in writing which companies and which countries the service sends data to.
3. Set retention periods: Separately for the audio file, the transcript and the summary. “Indefinitely” is not an answer.
4. Limit access: Not everyone should reach every recording; look for role-based permissions and access logs.
5. Plan for deletion requests: When a participant asks for their data to be erased (KVKK Article 11), you must be able to find and delete the recording, transcript and summary.
6. Ask about model training: Make it clear in the contract whether your data is used to train models.
7. Have an exit plan: Find out up front how you get your data back and how it is deleted when you leave the service.

#How to decide

Three questions usually settle it: Whose data is in these recordings, and how sensitive is it? Is there a rule or contract limiting data leaving the organisation or the country? Do we have the capacity to run a server securely? If the answer to either of the first two is a firm “yes”, on-premises is a serious option; if not, starting with the cloud service and moving when the need arises is more reasonable.

To install Transify in your company, or to build a similar system on your own servers that works with your documents, conversations and customer data, see our AI solutions. Another example with a lot of personal data: online booking systems for clinics. For the technical side of the product: the asynchronous job pipeline.