Trust Center

Sovereignty Risk Scorecard

Twelve questions, about ten minutes. Measure how exposed your meetings are today to foreign law, opaque AI processing and voice deepfakes. Your answers stay in your browser: nothing is sent unless you ask for your report by email.

Answer for the tool your organisation actually uses for sensitive meetings. If you don't know an answer, choose the riskiest one: what you cannot verify, you cannot defend in front of a regulator.

A. Jurisdiction

1. Where is your meeting provider's parent company incorporated?

A provider's legal home decides which governments can compel it, wherever the servers are.

2. Could a non-EU authority compel your provider to hand over meeting content (for example under the US CLOUD Act)?

An "EU data region" settles where data sits, not who can be ordered to produce it.

3. Where are recordings, transcripts and meeting minutes stored?

Minutes often hold more sensitive information than the meeting itself: decisions, amounts, names.

B. AI processing

4. Who runs the AI that transcribes, translates and summarises your meetings?

Open-weight models run in Europe settle location, not control: licence, hardware, roadmap and recourse remain foreign. What matters is who operates the model and where the content goes.

5. Can your meeting content be used to train AI models?

Once content has trained a model, it cannot be taken back.

6. Who controls the encryption keys for your stored meeting data?

Whoever holds the keys can be compelled to use them.

C. Voice and identity

7. Could a cloned voice join one of your meetings without anyone noticing?

A few seconds of public audio — an earnings call, a podcast, a conference talk — are enough to clone an executive's voice.

8. Do the people who can approve a payment, an order or a contract have a verified voice identity?

The attack targets the person who says yes, not your network.

9. When you translate speech, whose voice is used, and who holds a model of it?

Sending your executives' voices to an outside voice service creates a model of their voice that you do not control.

D. Compliance and control

10. Is AI-generated or AI-altered audio in your meetings disclosed to participants and marked in machine-readable form?

Article 50 of the EU AI Act has applied since 2 August 2026, with fines up to €15 million or 3% of worldwide turnover. It requires marking synthetic content; it does not require detecting deepfakes — that protection is a separate decision.

11. If required, could you run your meeting platform on your own servers, including air-gapped?

Some meetings — defence, investigations, M&A — should never touch a shared cloud.

12. Could you show an auditor or regulator, today, every subprocessor that handles your meeting data and where it processes it?

GDPR, NIS2 and DORA all expect you to know your supply chain, not just your main supplier.

This scorecard is a self-assessment aid, not legal advice.