Keeping audio in the EU: why we run our own GPUs in the Netherlands

EU data residency means your audio is processed on servers located in the EU. Data sovereignty goes further: it means the company that owns those servers, and the law that company answers to, are European too. Reson8 runs every request on NVIDIA Blackwell GPUs we own, in a colocation data center in the Netherlands, with no cloud provider in the processing chain and zero audio retention.

Buying our own infrastructure instead of renting it was a deliberate choice, and not the easy one. Here's why we made it, what it takes to run, and what it means for teams that send us sensitive audio.

Residency, sovereignty and ownership are three different questions

Where your audio sits, who owns the machine it sits on, and whose law applies to that owner are separate questions. An EU region only answers the first one.

A recording can carry a lot of sensitive personal information, like a name, a diagnosis, a case number, a voice that identifies the speaker. When a privacy officer reviews a speech-to-text vendor, they're really asking four things:

1. Location. In which country is the audio decrypted and processed?
2. Ownership. Who owns and operates the hardware doing the processing?
3. Jurisdiction. Which governments can legally compel that owner to hand over data?
4. Retention. What is stored afterwards, where, and for how long?

Most vendors answer the first question well, but reviews often stall on the other three.

Why an EU region is not the end of the story

An EU region on a US-owned cloud keeps your audio in Europe, but leaves the hardware under a company that US law can reach.

Under the US CLOUD Act (2018), US authorities can require US-based providers to disclose data in their possession, custody or control, even when it's stored outside the US. For many workloads that risk is acceptable. For a youth care session, a privileged legal call or a patient consultation, it is often the exact thing a data protection officer has to sign off on.

There are quieter gaps too. On many platforms the EU region covers audio and transcripts, while account data, usage data or support access still sit elsewhere. Read the fine print on three things: where metadata lives, who can access data during debugging, and which subprocessors sit in the audio path.

Why we bought our own GPUs instead of renting them

We own our hardware because it is the only way to give a short, complete answer to all four questions.

When we started Reson8, renting cloud GPUs would have been faster. But it would have made us one more layer on top of someone else's infrastructure, inheriting their jurisdiction, their subprocessors and their access policies. Our customers in healthcare, legal and government would then inherit all of it from us.

Owning the stack changes the answer:

• Location: the Netherlands. Every request, every time. There is no fallback region.
• Ownership: Reson8. We own the GPUs and operate them ourselves in a colocation data center.
• Jurisdiction: Resonate Labs B.V. is a Dutch company with no parent outside the EU.
• Retention: none. Audio and transcripts are not stored.

It also helps the product. Because we control the hardware end to end, we run our own inference engine, tuned for speech rather than for general-purpose workloads. Running our models on hardware we know inside out means predictable latency in production. That matters for voice agents, because if the transcript arrives a few hundred milliseconds late, the agent talks over the caller or leaves an awkward silence.

What full EU data sovereignty requires operationally

Sovereign infrastructure only works if every step from audio to transcript stays within EU control.

In practice, that means:

• Hardware we own. No hypervisor or GPU instance from a third party underneath our models.
• A Dutch facility. Power, cooling, physical security and connectivity come from the colocation provider. The machines, and access to them, are ours.
• No audio subprocessors. No other company processes customer audio on our behalf. Our full list is public on our trust center.
• Audited controls. We are ISO 27001:2022 certified, so customers can rely on an independent audit instead of running their own.
• Capacity we plan ourselves. We can't spin up another region when traffic spikes, so we size for peak load and keep headroom.

How zero retention is engineered

Zero retention means audio and transcripts exist only for as long as it takes to process them, and are never written to storage.

Audio streams in over an encrypted connection, is processed in memory on the GPU, and the transcript streams back. Once a request completes, nothing of the content remains on our side. This holds for Realtime streams, Turns and Prerecorded files alike.

What we do keep is operational metadata: things like request time, audio duration and the API key used, so we can bill usage and keep the service healthy. We don't train on customer data, and never will.

Questions to ask any speech-to-text vendor

Use these in your next vendor review, whoever you're evaluating:

1. In which country is our audio decrypted and processed, and is there any fallback region?
2. Who owns the hardware that runs inference?
3. Is your company, or any parent company, subject to laws outside the EU that can compel access?
4. Which subprocessors touch audio or transcripts?
5. Is audio or transcript content ever written to disk? For how long?
6. What metadata do you keep, where, and for how long?
7. Can staff outside the EU access our data, for support or debugging?
8. Do you train on customer data, and is that opt-out or never?

FAQ

Sending sensitive audio and tired of explaining where it goes? Run your own recordings through Reson8 and compare them with your current engine. Start for free, visit our trust center, or get in touch.