GDPR check

Is Klang.ai GDPR compliant? What universities should check

Klang.ai is a Swedish service that transcribes and summarises meetings, interviews and phone calls, and it markets itself to researchers working on ethics-approved studies. This page sets out what Klang publicly documents about hosting, subprocessors, AI training, contracts and security, and what that means for a university handling research participant data.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Klang AI AB is a Swedish company based in Helsingborg. It hosts data with European cloud providers (Scaleway in France, and Elastx in Sweden for private cloud customers), publishes a subprocessor list in its trust centre, holds ISO 27001:2022 certification and says it never trains AI models on customer data. Its AI providers include European companies such as Mistral AI and Berget AI, and the EU regions of Microsoft Azure and Amazon Bedrock, all described as zero data retention. Private cloud and on-premise deployments are available. Whether a university can use it for interviews depends on the contract, the plan and which AI features are switched on.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers interview transcription with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Klang documents publicly

Everything in this table comes from Klang's own pages, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page.

Topic	What the vendor states	Source
Company and establishment	Documented Klang AI AB (org. no. 559378-4571), Sundstorget 3, Helsingborg, Sweden. Terms governed by Swedish law, last updated 20 August 2026. Privacy notice last updated 23 June 2026.	[1] [2] [3]
Where data is stored	Documented Servers in France operated by Scaleway, "the main datacenter for our European customers". Elastx AB in Sweden is the main data centre for private cloud customers. On-premise deployment is offered.	[4] [5] [6]
Subprocessors	Documented Public list of 11: Scaleway (France), Elastx (Sweden), Mistral AI (France), Berget AI (Sweden), 46elks (Sweden, phone recording), pyannote (France, speaker diarisation), Microsoft Azure (Azure AI Foundry, EU Data Boundary), AWS Europe (Amazon Bedrock, EU Geo), ElevenLabs (speech, listed as EU), Hyperdoc Inc. (recall.ai, meeting recording, EU) and Opper AI (AI gateway, EU). The AI providers are described as working under zero data retention.	[5]
AI training on customer content	Documented "We do not use uploaded content, including recordings, transcripts, and summaries, to train AI models or to develop our algorithms." The security page says: "We never train our AI models on customer data".	[3] [4]
Data processing agreement	Not found publicly A DPA template on Klang's website (checked 7 October 2026). The pricing page lists an "Enterprise data processing agreement" on the Team plan. The City of Gothenburg's audit office has published a personuppgiftsbiträdesavtal (data processing agreement) with Klang AI AB as processor in its board papers.	[2] [6] [7]
International transfers	Klang describes its hosting and AI processing as taking place in the EU. Its privacy notice lists "ElevenLabs, Inc., USA" among speech AI providers, while the trust centre lists ElevenLabs with an EU location. Optional integrations (for example Slack, Google Drive, HubSpot) share data only if the customer turns them on.	[3] [5]
Retention and deletion	Customer deletions are carried through to Klang's systems and backups. The privacy notice says personal information is not kept longer than three months after the user's account ends. Custom data retention is listed on the Team plan.	[3] [4] [6]
Security certifications	Documented ISO 27001:2022 listed in the trust centre with a certificate available. TLS 1.2 or newer in transit, encryption at rest, and an optional "Klang Vault" with AES-256 customer-specific keys (bring your own key).	[4] [5]
Institution controls	Plan-dependent Freemium (one user) and Pro plans; the Team plan adds SSO, private cloud, on-premise hosting, audit logs and custom retention. SSO supports SAML 2.0 and OpenID Connect, and BankID login is available.	[4] [6]

Klang deserves credit for several things a DPO looks for: Swedish establishment, EU hosting with named European providers, a public subprocessor list with purposes and locations, a clear no-training commitment, deletion that reaches backups, ISO 27001 certification, customer-managed encryption keys and an on-premise option for the most sensitive projects. It has also developed its own Swedish speech-to-text model, Pianissimo [8].

What this means for research and teaching

Validemic's analysis

Interview recordings are rarely ordinary data. Research interviews often include information about health, politics, religion or sexuality, which are special categories of data under Article 9(1) GDPR [9]. Speaker identification, which Klang uses pyannote and ElevenLabs for [3] [5], works on voice characteristics; if used to identify individuals it can raise biometric data questions under Article 4(14) GDPR [9]. Discuss with your DPO whether speaker identification is needed for your study.

EU hosting is a real strength. Klang's European hosting and Swedish establishment make transfer questions much simpler than for US transcription services. Its research page says data stays within EU borders and is suitable for ethics-approved studies [10]. Several of its AI subprocessors, though, are EU regions or EU entities of groups headquartered in the United States, such as Microsoft and Amazon. Some universities treat that as acceptable under the GDPR, while others prefer EU-owned providers for sensitive research. Ask Klang which providers your account uses for which features, and whether some can be switched off.

Contract first. Klang's standard terms and privacy notice are written for users in general and do not themselves set out a processor arrangement [2] [3]. For research data, a university needs a DPA under Article 28 GDPR [9] that makes Klang its processor, lists the subprocessors and fixes retention. The published Gothenburg agreement shows Klang signs such agreements with public bodies [7].

Plan tier decides the controls. SSO, private cloud, on-premise hosting, audit logs and custom retention are Team plan features [6]. A researcher on the free plan gets the same no-training commitment, but not institutional control or a signed DPA.

DPIA likelihood. Processing special category data about participants with an AI transcription tool will often meet the criteria for a DPIA under Article 35 GDPR [9]. Our DPIA screening tool gives a first view, and Klang's public subprocessor list makes the data flow section of a DPIA easier to complete.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Klang before approving it

Can we see your data processing agreement template, and will Klang act as our processor for all content?
Which subprocessors are used for transcription, summaries and speaker identification on our plan, and can we restrict processing to EU-owned providers?
Is ElevenLabs processing done in the EU, and which ElevenLabs entity signs the subprocessor agreement?
Can we disable speaker identification and voice profiles for all users?
What retention periods can we set for recordings, transcripts and summaries, and how quickly are deletions applied to backups?
Would a private cloud on Elastx or an on-premise installation suit studies with sensitive data, and what does it cost?
Can we see the ISO 27001 certificate, including its scope and the certification body?
How will we be notified of new subprocessors, and what right to object do we have?

An EU-built option

Looking for a European tool for interview transcription?

Kahubi is an AI research workspace built by Avidemic AB, a company registered in Sweden. Researchers use it to transcribe interviews with speaker labels, code them thematically and write up the findings.

Runs on servers in the European Union, under EU law end to end
Your papers, data and recordings are never used to train AI models
For institutional customers, every subprocessor is a European company processing data in the EU
Interview recordings are transcribed by European providers (Gladia in France, Lemonfox in Germany)

Explore Kahubi See Kahubi's subprocessors

Disclosure: Kahubi and Validemic are both built by Avidemic AB. Assess any tool, ours included, against your own institution's requirements.

The EU AI Act angle

The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [11]. Transcribing and summarising research interviews is not one of the education uses listed as high-risk in Annex III (such as admission decisions, evaluating learning outcomes or monitoring students during tests), and the Annex III obligations now apply from 2 December 2027 under Regulation (EU) 2026/1744 [12]. The obligation that applies today is AI literacy: Article 4, as amended, requires deployers to take measures to support the AI literacy of staff and others using AI systems on their behalf [13]. Researchers should check AI summaries against the transcript before relying on them in analysis.

Sources

Klang legal page, retrieved 7 October 2026
Klang Terms and Conditions, last updated 20 August 2026, retrieved 7 October 2026
Klang Privacy Notice, last updated 23 June 2026, retrieved 7 October 2026
Klang Security, retrieved 7 October 2026
Klang AI AB Trust Center, overview and subprocessors, retrieved 7 October 2026
Klang Pricing, retrieved 7 October 2026
Personuppgiftsbiträdesavtal between Stadsrevisionen, Göteborgs Stad, and Klang AI AB, City of Gothenburg board papers, retrieved 7 October 2026
Klang home page, retrieved 7 October 2026
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 4(14), 9, 28 and 35, retrieved 7 October 2026
Klang for research, retrieved 7 October 2026
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Annex III, retrieved 7 October 2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026
AI Act Article 4: AI literacy, AI Act Service Desk, retrieved 7 October 2026

About this page

We read Klang's website, security, pricing, research and legal pages, its privacy notice and terms, and its trust centre on 7 October 2026, together with a data processing agreement published by the City of Gothenburg. Klang is an EU company that hosts data in the EU, so the EU-U.S. Data Privacy Framework is not central to its own hosting and we did not check it. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it. Confirm the current position with Klang before relying on this page.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Klang and see an error, please contact us and we will correct it.

Frequently asked questions

Can I use Klang.ai for research interviews under GDPR?

It depends on your institution's contract, plan and configuration, not on the tool alone. Klang AI AB is a Swedish company that hosts data in the EU, publishes its subprocessors and says it never trains AI models on customer data. A university should still sign a data processing agreement and check which AI features and subprocessors its account uses.

Where does Klang.ai store data?

Klang says its main data centre for European customers is run by Scaleway in France, and private cloud customers are hosted by Elastx in Sweden. An on-premise installation is also offered.

Does Klang.ai use recordings to train AI?

Klang's privacy notice says it does not use uploaded content, including recordings, transcripts and summaries, to train AI models or develop its algorithms, and that its AI providers work under zero data retention agreements.

Does Klang.ai sign a DPA?

A public DPA template was not found on Klang's website (checked 7 October 2026), although its pricing page lists an enterprise data processing agreement as part of the Team plan. Klang has signed data processing agreements with public bodies: one between Klang AI AB and the City of Gothenburg's audit office is published in the city's board papers. Ask Klang for its template.

Is Klang.ai ISO 27001 certified?

Klang's trust centre lists ISO 27001:2022 and offers the certificate as a document, and its pricing page describes the service as ISO 27001 certified.