Encryption end to end of the pipeline
256-bit AES at rest, TLS 1.2 and 1.3 in transit, keys managed in the cloud provider’s KMS. Recordings, transcripts, emails and metadata alike.
Security and sovereignty
Your enterprise context. Your infrastructure.
Noota captures what your organisation says out loud. That makes security the foundation of the product, not a feature of it. We are ISO 27001 certified, and you decide, at workspace level, whether Noota runs on our standard European infrastructure or on the sovereign one.
Chosen per workspace by your admin, can be changed later
Standard environment
Hosted in Europe, by default.
Everything stays in the European Union, with the full model range. The choice of most teams.
ISO/IEC 27001Certified · zero non-conformity
GDPRCompliant · DPA availableGoogle Cloud · EU regionsMongoDB Atlas · EUFrontier models via Vertex AIData stays in the EU
0
non-conformities at our ISO 27001 certification audit, July 2026
100%
MFA coverage on internal access, through single sign-on
2
independent penetration tests last cycle, no finding left open
2
environments to choose from: standard or sovereign
Your choice of infrastructure
Two environments. Your call, not ours.
The choice is made when the workspace is created and can be changed later. Same product, same features. What changes is where it runs and which models it is allowed to reach.
Standard
Hosted in Europe, by default.
The default for most teams.
Everything stays in the EU, with the full model range available. Frontier models are reached only through the Vertex AI gateway, and outbound calls display your own number.
Google Cloud, EU regionsMongoDB AtlasVertex AIClaudeGeminiMistral
Nothing held back from the feature set.
Sovereign
Only French providers.
For public bodies, banks and insurers, health and legal.
Hosting on Scaleway in Paris, transcription by Gladia, Mistral models, and a capture bot built and run by Noota, with no third party in that part of the chain. Noota is the exclusive partner selected by Bleu to bring AI and enterprise context to its trusted cloud, by the end of 2026.
ScalewayGladiaMistral AIBleu · end of 2026
Outbound calls mask your number: the honest trade-off.
The compliance register
Everything we hold, and what is under way.
What we hold, what is in progress, and what belongs to our providers rather than to us. Every line has its evidence in the trust center.
ISO/IEC 27001Certified · Jul 2026
Information security management. Scope: our SaaS meeting intelligence platform, across six departments. Zero non-conformity at both audit stages.
GDPRCompliant · Ongoing
DPA, records of processing and a full sub-processor list. Consent management built into the product. DPO reachable at dpo@noota.io.
DORAIn progress · 2026
Digital Operational Resilience Act. Alignment work under way for financial-sector customers and their ICT third-party register.
EU AI ActIn progress · 2026
Work under way to meet the obligations of a high-risk use, even where our own use would not require it.
EU hostingBoth environments
Data and AI processing stay inside the European Union in both environments.
Sovereign deploymentYour choice
Hosting in France, with its own security assurance plan and its own disaster recovery plan.
HDS / HIPAAProvider-level
Our cloud providers hold these certifications. Noota itself does not.
Three decisions
Three things we never do.
Most of this page describes controls. This part describes decisions, the ones that do not change with a plan, a price or a customer.
Never train
Your conversations are not used to train our models, or anyone else’s, on any plan including Free.
Never sell
No data brokerage, no advertising, no enrichment resold to a third party. Our revenue comes from subscriptions.
Never hide
Sub-processors are limited to what running the service requires, and every one of them is listed in the trust center before you sign.
The controls behind it
Operated every day, not when someone asks.
Audited under ISO 27001.
Environments that never touch
Development, test and production are fully separated, all in European datacenters. No customer data reaches a non-production environment.
Your directory, your rules
SSO with Azure AD and SAML, automatic provisioning and de-provisioning, and role-based access on your side.
Least privilege, reviewed
100% MFA through single sign-on, twelve-character passwords with special characters, and access rights reviewed on a schedule.
Broken into on purpose
Two independent penetration tests over the last audit cycle, remediation verified at re-test, no finding left open.
Restores we have actually run
Disaster recovery plans in standard and sovereign versions. Point-in-time restore of the production database tested in July 2026.
AI under the same discipline
AI sits inside the same management system as the rest of the platform: no training on your content, model routing constrained per environment.
Leaving is in the contract
Retention is yours to set, exports are yours to take, and deleted data is permanently removed within 24 hours.
Hosted where the grid is cleaner
Scaleway’s French datacenters for the sovereign environment, Google Cloud’s European regions for the standard one. Both publish their energy figures.
Trust center
Everything documented, before you ask.
ISO 27001 certificate, system description, penetration test reports, security assurance plan and the list of sub-processors. Request access in one click.
Data protection officer
dpo@noota.ioGDPR requestsReport a vulnerability
security@noota.ioResponsible disclosureSecurity questionnaire
Answered from the trust centerOn request
dpo@noota.ioGDPR requestsReport a vulnerability
security@noota.ioResponsible disclosureSecurity questionnaire
Answered from the trust centerOn request
FAQ
Questions from security teams.
Hosting, certifications, models and data handling.
Still have a question? Talk to our team →Where is our data hosted?+
In the European Union, in both environments. The standard environment runs on Google Cloud’s European regions; the sovereign environment runs on Scaleway in France. Data and AI processing stay inside the European Union in both.
What exactly changes in the sovereign environment?+
Every provider in the chain is French: hosting on Scaleway in Paris, transcription by Gladia, AI models by Mistral and open-weight models hosted on Scaleway. The product and the features stay the same. One trade-off: outbound phone calls mask your number instead of displaying it.
Which AI models can reach our data?+
In the standard environment, frontier models such as Claude, Gemini and Mistral, reached only through the Google Vertex AI gateway. In the sovereign environment, Mistral and open-weight models hosted in France. Every model is named in the trust center.
Do you train AI models on our conversations?+
No. Your recordings, transcripts and reports are never used to train our models or anyone else’s, on any plan including Free.
How long do you keep our data, and how is it deleted?+
Retention is a setting you control. When you delete a recording or close the account, the data is permanently removed within 24 hours. You can also keep only the text, with no audio or video stored.
Who can see a recording inside our organisation?+
Workspaces are private by default: only the person who recorded and the people they share with can open a meeting. Access is role-based, and SSO with Azure AD or SAML handles provisioning and de-provisioning.
Which certifications does Noota hold?+
ISO/IEC 27001, certified in July 2026 with zero non-conformity. Noota is GDPR compliant. DORA alignment and EU AI Act work are in progress. HDS and HIPAA are held by our cloud providers, not by Noota itself.
Where do we get the DPA, the security plan and the pen test reports?+
In the trust center at trust.noota.io. Request access and our team grants it. For a custom DPA, Enterprise contracts include one.
How do we report a vulnerability?+
Write to security@noota.io. Data protection requests go to our DPO at dpo@noota.io.
