GDPR check

Is Rev GDPR compliant? What universities should check

Rev.com offers AI transcription, human transcription and an AI notetaker, and researchers often ask whether they may send interview recordings to it. This page sets out what Rev publicly documents and what it means for universities handling research participant data.

Published 7 October 2026 · Sources checked 7 October 2026

Short answer

Rev.com, Inc. is a US company that hosts data with US cloud providers and publishes a data processing addendum with the EU Standard Contractual Clauses built in. Its terms say customer content may be used to train Rev's own speech recognition models, but not any generative AI model. Human transcription is done by vetted freelancers under NDA, with eClerx in India listed as a subprocessor. For research recordings, a university will want to settle model training, storage location and the use of human transcribers in writing before approving it.

Prefer a tool built in the EU? Kahubi, from Avidemic AB in Sweden, covers interview transcription with EU hosting and, for institutions, only European subprocessors. See how Kahubi handles research data

What Rev documents publicly

Everything in this table comes from Rev's own pages and the official Data Privacy Framework list, read on 7 October 2026. Numbers in brackets refer to the sources at the end of the page. Rev also sells a developer API (Rev AI) and a legal product (SmartDepo.law); this page is about the Rev.com transcription and notetaker service unless stated.

Topic	What the vendor states	Source
Company and establishment	Rev.com, Inc., Austin, Texas, USA. The privacy policy says Rev is located in the United States and that related companies and authorised third parties are located throughout the world. An EU representative under Article 27 GDPR was not found in public documentation (checked 7 October 2026).	[1] [2]
Where recordings and transcripts are stored	AWS, Microsoft Azure and Google Cloud (all USA) are listed for all products; files are protected with S3 server-side encryption. The DPA says that for certain services the customer may select a region from those available, and Rev will then not move the data without consent. Rev AI (the API) offers an EU data centre in Frankfurt. Not found publicly An EU region for the Rev.com app.	[3] [4] [5]
Data processing agreement	Documented Public Data Processing Addendum, part of the Terms of Service and the Master Services Agreement; Rev acts as processor. Audit requests can be met with a recent third-party audit report; otherwise audits are limited to once per 12 months. Last updated 4 August 2026.	[3]
Subprocessors	Listed in Schedule 3 of the DPA with purpose, location and affected products. For Rev.com: Recall.ai (meeting video and voice recording, USA), CoreWeave (GPU training and inference, USA), Braintrust (AI logging and evaluation, USA) and eClerx Services Limited (freelancer services for human transcription, India). Rev gives at least 30 days' notice of new subprocessors and customers may object.	[3]
International transfers	The DPA incorporates the EU SCCs (Module 2 or 3) and UK clauses. A search of the official DPF list for "Rev" returned no Rev.com, Inc. entry, and the privacy policy does not mention the DPF.	[2] [3] [6]
AI training on customer content	The terms say content sent to speech-to-text services is analysed by Rev's ASR and other AI models "and may be used for continuous training of those models", which are proprietary, kept locally and not shared with third parties. "Customer Content will not be used for any generative AI model training." Rev's pages also say content is never used to train external AI models. An opt-out was not found in public documentation (checked 7 October 2026).	[1] [4] [7] [8]
Retention and deletion	The privacy policy keeps data for the period necessary for its purposes. The Master Services Agreement commits Rev to delete customer information within 30 days of a written request. A default retention period for the Rev.com app was not found publicly.	[2] [7]
Security certifications	SOC 2 Type II compliance and a SOC 3 report available for review, according to the security page; HIPAA and CJIS on higher tiers. ISO 27001 was not found in public documentation (checked 7 October 2026).	[4] [9]
Institution controls	Plan-dependent SSO, MFA and domain claiming are described on the security page; the pricing page lists SSO on the custom-priced Unlimited plan. The education page mentions role-based access and audit trails. A dedicated education plan was not found publicly.	[4] [8] [9]

Two features matter for research use. Rev's AI Notetaker can "automatically join and record" Zoom, Google Meet, Microsoft Teams and Webex calls [10]. For human transcription, Rev says its transcriptionists "undergo rigorous vetting, including ID verification and NDAs" [4].

Rev deserves credit for publishing its DPA openly with the SCCs already incorporated, so no separate signature is needed, for a subprocessor list that names the products each provider supports, for a 30-day notice and objection right, and for a clear contractual line excluding generative AI training on customer content.

What this means for research and teaching

Validemic's analysis

Interview recordings often contain special category data. Participants talk about health, politics, religion, sexuality or trade union membership, all special categories under Article 9(1) GDPR [11]. Voice recordings are personal data in every case.

ASR training is the main point to resolve. Rev's terms allow content to be used for continuous training of its own speech recognition models. Rev frames this as different from generative AI training, and keeps those models in-house. Even so, most participant information sheets say recordings are used only for the study. A university should either negotiate an exclusion for research content or make sure the participant information, consent form and ethics application describe this use accurately.

Human transcription means people outside the research team hear the recording. That is common practice in research and can be lawful under a proper processor agreement, but ethics committees often want to know. Participants should be told if a professional transcription service will hear their voice, and the DPA's listing of freelancer services in India means a transfer outside the EEA that the SCCs need to cover.

Transfers. Because we did not find Rev on the DPF list, transfers of EU personal data rely on the SCCs in the DPA. Your DPO will usually want a transfer impact assessment for that. The Rev AI API's Frankfurt data centre shows that EU hosting exists in Rev's portfolio; ask whether it is available for the service you plan to use.

DPIA likelihood. Recording and transcribing interviews with special category content using a US-hosted AI service, possibly with human transcribers, will often meet the threshold for a data protection impact assessment under Article 35 GDPR [11]. Our DPIA screening tool gives a first view.

The notetaker. A bot that joins calls automatically can record people who have not agreed to it. For interviews, configure it to join only when invited and tell participants before recording starts. We did not find public documentation on how the notetaker notifies other participants.

Reviewing a vendor right now? Validemic checks the vendor's documents against GDPR and the EU AI Act and cites every finding. Try the demo workspace

Questions to ask Rev before approving it

Can content from our institution be excluded from ASR model training, and can that be written into our order form?
Which region will host our data for the Rev.com service, and is the Frankfurt data centre available to us?
Can we choose AI-only transcription so that no human transcriber hears our recordings?
For human transcription, in which countries do transcribers work, and what role does eClerx play?
How are CoreWeave and Braintrust used, and do they receive audio or transcripts?
What default retention applies to files and transcripts, and can we set automatic deletion?
How does the AI Notetaker announce itself to other meeting participants, and can admins stop it joining automatically?
Can we see the SOC 2 Type II report under NDA?
What transfer impact assessment support do you provide for the SCCs?

An EU-built option

Looking for a European tool for interview transcription?

Kahubi is an AI research workspace built by Avidemic AB, a company registered in Sweden. Researchers use it to transcribe interviews with speaker labels, code them thematically and write up the findings.

Runs on servers in the European Union, under EU law end to end
Your papers, data and recordings are never used to train AI models
For institutional customers, every subprocessor is a European company processing data in the EU
Interview recordings are transcribed by European providers (Gladia in France, Lemonfox in Germany)

Explore Kahubi See Kahubi's subprocessors

Disclosure: Kahubi and Validemic are both built by Avidemic AB. Assess any tool, ours included, against your own institution's requirements.

The EU AI Act angle

The EU AI Act, Regulation (EU) 2024/1689, applies alongside the GDPR [12]. For a university using a transcription service, three points matter.

AI literacy (Article 4). This has applied since 2 February 2025 [12]. The Digital Omnibus on AI, Regulation (EU) 2026/1744, which entered into force in July 2026, reworded it: providers and deployers must take measures to support the AI literacy of staff using AI systems, without having to guarantee a specific level [13].
Not high-risk in ordinary research use. Transcription and meeting summaries are not among the education uses in Annex III (admission, evaluating learning outcomes, assessing the level of education, or monitoring students during tests) [12]. The Annex III obligations now apply from 2 December 2027 [13].
Sentiment analysis. Rev AI, the developer API, offers a Sentiment Analysis API that analyses sentiments in a transcript [14]. That is analysis of text. Emotion recognition under the Act means inferring emotions from biometric data (Article 3(39)), and Article 5(1)(f) prohibits it in workplaces and education institutions except for medical or safety reasons [12]. We found no emotion recognition feature in the Rev.com app, but any university building on the API should keep that line in mind.

Sources

Terms of Service | Rev, updated 15 May 2026, retrieved 7 October 2026
Privacy Policy | Rev, updated 3 February 2026, retrieved 7 October 2026
Data Processing Addendum | Rev, updated 4 August 2026, retrieved 7 October 2026
Security & Privacy Compliance for Enterprise Services | Rev, retrieved 7 October 2026
Global Deployments, Rev AI documentation, retrieved 7 October 2026
Data Privacy Framework List, search for "Rev", retrieved 7 October 2026
Master Services Agreement | Rev, retrieved 7 October 2026
Academic Transcription & Analysis Services | Rev, retrieved 7 October 2026
Rev pricing, retrieved 7 October 2026
AI Notetaker for Meetings & Calls | Rev, retrieved 7 October 2026
Regulation (EU) 2016/679 (General Data Protection Regulation), Articles 9 and 35, retrieved 7 October 2026
Regulation (EU) 2024/1689 (Artificial Intelligence Act), Articles 3(39), 4, 5(1)(f), 113 and Annex III, retrieved 7 October 2026
Regulation (EU) 2026/1744 (Digital Omnibus on AI), retrieved 7 October 2026
Sentiment Analysis API, Rev AI documentation, retrieved 7 October 2026

About this page

We read Rev's terms, privacy policy, DPA, Master Services Agreement, security, pricing, education and notetaker pages and the Rev AI documentation on 7 October 2026, and searched the official Data Privacy Framework list on the same day. Rev's help centre did not load for us, so help articles are not used here. EUR-Lex was partly unavailable on that date, so the legal texts were read from the Official Journal copies published by the EU Publications Office. "Not found" means we could not find the information in public documentation; it does not mean the vendor lacks it.

This page describes public documentation and gives our own analysis. It is not legal advice and it is not a statement that the tool is or is not GDPR compliant, which depends on your contract, configuration and use. If you work for Rev and see an error, please contact us and we will correct it.

Frequently asked questions

Can I use Rev for research interviews under GDPR?

Rev publishes a data processing addendum with the EU Standard Contractual Clauses built in, and lists its subprocessors. Recordings are hosted with US cloud providers, Rev's terms allow customer content to be used to train its own speech recognition models, and human transcription involves freelancers. Whether that fits a study depends on your contract, ethics approval and DPO's assessment.

Where does Rev store recordings?

Rev's subprocessor list names AWS, Microsoft Azure and Google Cloud, all in the USA, for all products. The DPA lets customers choose a region where one is available for a service. Rev's developer API, Rev AI, offers an EU data centre in Frankfurt. An EU region for the Rev.com app was not found in public documentation (checked 7 October 2026).

Does Rev use my recordings to train AI?

Rev's Terms of Service say content sent to its speech-to-text services is analysed by its ASR and other models and may be used for continuous training of those proprietary models, which are not shared with third parties. The terms also say customer content will not be used for any generative AI model training.

Does Rev sign a DPA?

Rev publishes a Data Processing Addendum that forms part of its Terms of Service and Master Services Agreement. By entering into it, the parties are deemed to sign the EU Standard Contractual Clauses, with UK clauses for UK transfers.

Who listens to recordings sent for human transcription at Rev?

Rev says its human transcriptionists are freelancers who undergo ID verification and sign NDAs. Its subprocessor list names eClerx Services Limited in India for freelancer services on Rev.com human transcription.