Sovereignty and law

CLOUD Act: what it changes for your meeting minutes

A 2018 US law lets authorities require a provider to hand over the data it controls, wherever that data is stored. The mechanism reaches the recording and transcription of your meetings; the position of Recapro (recapro.ai) is set out offer by offer.

Read what the law says Recapro Cloud, layer by layer

In short

  • The CLOUD Act (18 U.S.C. § 2713) requires a provider subject to US jurisdiction to disclose, under lawful process from US authorities, the data in its possession, custody or control, including when that data is stored outside the United States.
  • Hosting data in France settles where it sits; which law applies depends on each company that operates a link in the chain, be it processing, storage or transit.
  • At Recapro, the On-Premise offer in air-gap mode is the configuration with no outside link at all; in the Cloud offer, inference runs on our servers in France and data is stored with Scaleway in Paris, but Cloudflare, a US company, terminates the encryption of connections.

Facts checked on 21 October 2026.

What the law says

Three texts are enough to understand the mechanism. Each one links to its source.

An obligation attached to the provider

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) was enacted on 23 March 2018 (Public Law 115-141, division V). Its section 103 created 18 U.S.C. § 2713, under which a provider of electronic communication service or remote computing service must preserve, back up or disclose the contents and records in its possession, custody or control, wherever that data is located, inside or outside the United States.

18 U.S.C. § 2713, official text (Office of the Law Revision Counsel), accessed 21 October 2026

A challenge possible in narrow cases

The same law lets the provider move to modify or quash legal process that seeks contents. It must then reasonably believe that the customer is not a US person, does not reside in the United States, and that disclosure would put it at material risk of violating the laws of a country bound to the United States by an executive agreement in force (18 U.S.C. § 2703(h)).

18 U.S.C. § 2703(h), official text (Office of the Law Revision Counsel), accessed 21 October 2026

How European authorities read it

In their joint response to the European Parliament’s LIBE committee, dated 10 July 2019, the EDPB and the EDPS consider that a CLOUD Act request does not, on its own, constitute a legal basis for a transfer under the GDPR (Article 48). Without an international agreement, such as a mutual legal assistance treaty, the disclosure could only be lawful on an Article 6 basis combined with one of the narrow derogations of Article 49. A provider bound by both laws can therefore face two conflicting obligations.

EDPB-EDPS, joint response to the LIBE committee on the CLOUD Act, 10 July 2019

Residence or jurisdiction: the distinction that matters

Data residence

Where are the servers?

Hosting in France or in Europe answers this question. It is often a contractual or sector requirement, and you can check it in the list of sub-processors.

Jurisdiction

Which law binds the company that operates each link?

A company subject to US law remains bound by the CLOUD Act for the data it controls, including in a data centre located in Paris or Frankfurt.

Hosting in Europe meets a data residence requirement. On its own, it does not remove exposure to US law when a link in the chain is operated by a company subject to it. The reasoning applies to every meeting-minutes tool, ours included, which is why the rest of this page covers the Recapro On-Premise offer and Cloud offer separately.

The three layers of a meeting-minutes tool

For each one, ask two questions: who operates it, and which law governs that company?

01

Inference

This is when a model transcribes the audio and drafts the minutes. The content is read in clear text at that point, because a model cannot work on encrypted data. Our breakdown of sovereignty at inference covers this in detail.

02

Storage

The database, audio files, transcripts and their backups. Encryption at rest protects against a stolen disk. A lawful request targets the company that runs the storage and holds its keys.

03

Transit

The path between your device and the servers. When an intermediary terminates TLS encryption to filter or speed up traffic, the content passes through its infrastructure decrypted during that transit.

Recapro On-Premise and air-gap

With the Fortress offer, the processing chain is installed on your premises.

The whole chain on your server

The database, files, transcription (whisper), drafting (vLLM) and speaker separation (pyannote) run on a dedicated server installed inside your walls. No port is open to the internet and meeting content stays on that server. Details are on the Recapro On-Premise page.

In standard mode, what goes out

The machine sends heartbeats to api.recapro.ai and machine metrics (CPU, memory, disk, uptime). It also keeps a supervision tunnel operated by Cloudflare. No meeting content goes through these channels, but technical supervision access does exist.

In air-gap mode, nothing goes out

There is no outbound connection at all, so no telemetry, heartbeat or tunnel. Installation and updates arrive on physical media. This is the configuration that meets an “out of reach of the CLOUD Act” requirement, since no provider in the Recapro chain, not even Recapro, has technical access to your data. See air-gapped deployment.

Recapro Cloud, layer by layer

What the Cloud offer does at each link, and what that means with regard to the CLOUD Act.

Recapro Cloud, layer by layer
Layer Who operates it, and where What it means
Inference Recapro, on our servers in France. Transcription (whisper), drafting (vLLM) and speaker separation (pyannote) with open-weight models. No third-party LLM reads your meetings at inference.
Storage Scaleway, a French hosting provider, in the Paris region (fr-par). The database runs on a Scaleway virtual machine; files and encrypted backups sit on Scaleway Object Storage. Your data is stored in France, with a French company.
Former database, being retired Supabase, a US company, on AWS infrastructure in Frankfurt. It holds the copy of the database and files from before our migration on 8 October 2026, kept for a rollback. Older versions of the mobile app can still write to it until they are updated. Its deletion is scheduled for 7 November 2026 at the earliest.
Transit Cloudflare, a US company, terminates the TLS encryption of connections, inference traffic included. Content passes through its infrastructure decrypted during transit.
Notifications Expo, Apple and Google, US companies, deliver push notifications. When the option is on, the “minutes ready” notification contains the meeting title. The meeting title passes through these services. Turn the option off to receive a generic label.

For these reasons (transit through Cloudflare, push notifications and the former database being retired), we do not write that Recapro Cloud is out of reach of the CLOUD Act. If your meetings require a chain with no outside link at all, the On-Premise offer in air-gap mode meets that requirement. The list of our providers and their role is on the Security page.

Infrastructure configuration read on 21 October 2026. This section is updated when the former database is deleted.

Questions to ask a vendor

They apply to every meeting-minutes tool, ours included. Ask for a written, dated answer.

  1. 01 On which servers, and with which provider, are transcription and summarisation computed?
  2. 02 Does an external AI model receive all or part of the content? Which one, and under what contract?
  3. 03 Where are the database, audio files and backups stored, and which company runs that hosting?
  4. 04 Who terminates the TLS encryption of your connections?
  5. 05 Among the companies in this chain, which ones fall under US law, directly or through their parent company?
  6. 06 Are there older or backup copies, and where are they?
  7. 07 Can the tool be installed in your own infrastructure, with or without outbound connections?
  8. 08 Where is the list of sub-processors published, and when was it last updated?

CLOUD Act: your questions

01

Does the CLOUD Act apply to data hosted in France?
It can. 18 U.S.C. § 2713 covers the data that a provider subject to US jurisdiction has in its possession, custody or control, whatever the country where it sits. What counts is the company that operates the service and the law that binds it.
02

Is Recapro Cloud out of reach of the CLOUD Act?
We do not claim so. In the Cloud offer, inference runs on our servers in France with no third-party LLM and data is stored with Scaleway in Paris. Cloudflare, a US company, terminates the TLS encryption of connections, and a copy from before 8 October 2026 remains with Supabase (AWS infrastructure, Frankfurt), where older versions of the mobile app can still write, until it is deleted. For a chain with no outside link at all, choose On-Premise in air-gap mode.
03

What is an air-gapped deployment for a transcription tool?
A server that runs with no connection to the outside, so with no telemetry, heartbeat or supervision tunnel. With Recapro On-Premise in air-gap mode, recording, transcription and minutes stay on that server, and updates arrive on physical media.
04

Which AI meeting-minutes tool does not send meetings to a third-party LLM?
Recapro runs transcription and drafting with open-weight models, on its servers in France in the Cloud offer or on your server in the On-Premise offer. No meeting excerpt is sent to an external AI provider. For any other tool, ask about the inference layer.
05

Is encryption enough against the CLOUD Act?
Not on its own. Encryption protects against interception or a stolen disk. A lawful request targets the company that controls the data; if it holds the keys or sees the content in clear text at some point in processing, it can be required to disclose it.
06

Do a contract or standard contractual clauses protect against these requests?
A contract defines what a provider may do with your data. It does not lift a legal obligation that binds the provider. In their joint response dated 10 July 2019, the EDPB and the EDPS note that a provider bound by both laws can face two conflicting obligations.
07

Does the Data Privacy Framework protect against these requests?
That is not its purpose. The European Commission adequacy decision of 10 July 2023 allows data to be transferred to US companies certified under this framework. It describes the safeguards on access by US authorities to that data, including for criminal investigations, but it does not exempt any company from US law. A provider that relies on it transfers your data under a recognised framework; it is still required to answer a lawful request.
08

Is Recapro SecNumCloud or HDS certified?
No. Recapro holds neither a SecNumCloud qualification nor an HDS certification, and does not hold ISO 27001 or SOC 2 certification. Our architecture is HDS-ready, meaning compatible and not certified. These frameworks and their scope are explained on our Sovereignty and certifications page.

Method and sources

Legal facts come from the official texts and documents below. Facts about Recapro come from our infrastructure configuration, read on 21 October 2026.

This page explains a legal mechanism. It is not legal advice on your situation.

Spotted an error or outdated information? Write to us and we will correct it and date the correction: [email protected].

Choose the offer that fits your requirement

Cloud to get started quickly, with inference in France and storage in Paris. On-Premise, with or without air-gap, when no outside link is acceptable.

See pricing Discover On-Premise

Going further

The CLOUD Act raises the question of applicable law. These pages set out the answers by deployment mode.