Compliance & Sovereignty FAQ

Summary

This FAQ provides exact answers to questions a professional buyer and their DPO ask before purchasing an AI note-taking tool. It distinguishes three legal strength levels: what the law requires (GDPR, AI Act), what clients demand beyond the law (ISO 27001, European hosting), and sector-specific mandates (health, public). Each answer includes proof. No compliance claim is made without supporting facts. Technical terms (DPA, closed circuit, diarization) are defined in the AI note-taking tool glossary.

Neither ISO 27001 certification nor hosting in France are universal legal obligations. Clients require them, and two sectors mandate them: health and public.

Key takeaway: AWS Paris hosting, Scaleway option beyond a license threshold, LLM (OpenAI) run via Azure France in closed circuit, no training on client data, encryption in transit and at rest, ISO 27001 held, ISO 42001 in progress, NIS2 finalizing, aligned with EU AI Act, HDS via partners, DPA and subcontractor list and ISO certificate on request, about 10,000 European companies use it, Franco-Belgian entity.

1. Data Location and Hosting

Where are my data hosted and stored with Leexi?

In France. Your recordings, transcripts, and summaries are hosted in the Paris region on AWS infrastructure. Beyond a license volume threshold, hosting on Scaleway (a French provider) is optionally offered [exact threshold TO VERIFY]. Language model processing occurs via Azure France in a closed circuit.

Do my data leave the European Union?

No, for storage and processing, which remain in France. The nuance concerns the infrastructure provider: the storage region is European, but AWS is a US company (see Cloud Act question). For strict sovereignty needs (entity not subject to extraterritorial laws), the Scaleway option meets the requirement.

What exactly is "sovereign" hosting?

A demanding buyer checks three things: datacenters physically in France, a French or European legal entity not subject to extraterritorial laws, and European capital control. AWS Paris hosting meets physical location but not immunity to extra-European laws. Scaleway option meets all three.

Is hosting in France a legal obligation?

No, not generally. GDPR does not require data to stay in France or Europe for most processing. Sovereign hosting is mandatory only for certain sectors: health data (via HDS-certified host) and public sector for sensitive data (SecNumCloud path, SREN law). Otherwise, it is a rising buyer demand; law does not impose it.

2. AI Training

Does Leexi train its AI on my meetings?

No. Your conversations are not used to train models. This applies by default to all accounts. It is also the first technical check and a reason buyers shortlist Leexi after excluding US tools.

Is Leexi "based on ChatGPT"? Do my data go to OpenAI?

The language model is provided by OpenAI but runs via Azure France in a closed circuit. Your data are not used to train the model nor exposed to third-party use. Closed circuit means processing stays within a controlled perimeter in France.

How to prove this to my DPO?

Leexi documents this in its compliance file, with the DPA and subcontractor list. Non-training is explicitly stated.

3. Certifications and Standards

Is Leexi ISO 27001 certified?

Yes. ISO 27001 is held. Certificate provided on request [exact number and scope TO VERIFY before publishing]. Note: ISO 27001 is voluntary, not a legal obligation. It has become a de facto prerequisite in B2B, enterprise, and public tenders. A client cannot sanction you for lacking it but can refuse to buy without it.

What other certifications does Leexi hold or pursue?

ISO 42001 (AI management system) is in progress. NIS2 compliance is finalizing. Leexi aligns with the EU AI Act. Regular audits occur, including client-led.

Does NIS2 or ISO 27001 impose legal security obligations?

NIS2 does, for "essential" and "important" entities; ISO 27001 is a means to comply, not the obligation itself.

Is Leexi HDS certified for health data?

Leexi handles health data via partners [exact scope and terms TO VERIFY], not with own HDS certification yet. For health entities processing personal health data, hosting by an HDS-certified provider is a regulatory obligation; this must be assessed case-by-case before engagement.

Is Leexi SecNumCloud qualified?

Not yet. SecNumCloud (ANSSI) attests higher security and immunity to extraterritorial laws, mainly for public sector sensitive data (SREN law). Not a prerequisite for standard B2B use.

4. DPA, Subcontractors, and Purchase Proofs

Does Leexi sign a Data Processing Agreement (DPA)?

Yes. The DPA is provided. It is a standard document buyers request to demonstrate their processing oversight.

Can I get the subcontractor list?

Yes, provided [named list TO VERIFY before publishing]. It is a standard DPO requirement: without it, buyers cannot map the processing chain.

What documents does Leexi provide for purchase or tender files?

DPA, subcontractor list, ISO 27001 certificate, and hosting location. These are exactly the proofs buyers require in 2026: DPA, audit rights or third-party compliance reports, location, subcontractor list. Without these, suppliers are excluded.

Do I have audit rights on Leexi?

Leexi undergoes regular client audits [contractual audit rights TO VERIFY]. The EU AI Act encourages buyers to require audit rights or third-party compliance reports.

5. Retention and Deletion

How long are my recordings and summaries retained?

Durations are configurable [default Leexi durations TO VERIFY]. CNIL recommends about 6 months max for commercial call recordings and about 12 months for meeting summaries. Controlled retention is a strict GDPR obligation for an AI note-taking tool.

Can I delete a recording or summary?

Yes [exact deletion and erasure terms TO VERIFY]. The right to erasure is part of GDPR rights, and summaries are never sent before your review and approval.

Who can see which summary in my organization?

Access control is a daily use and purchase topic: who sees what, approval before sharing, controlled sharing [roles and permissions details TO VERIFY per product].

6. Consent and Participant Information

Must participants be informed a meeting is recorded?

Yes. GDPR and EU AI Act require informing participants that a meeting is recorded and an AI assistant takes notes. A simple "this meeting is recorded" is insufficient: AI use must be mentioned in the invite, orally reminded at meeting start, and visibly indicated during the meeting.

How does Leexi manage consent concretely?

Leexi enforces consent behaviors by default that US tools do not, and the assistant is visible in the meeting, as required by EU AI Act. Modalities vary by country and context: CSE info in France, external participant consent for third-party calls [exact mechanics, timestamping TO VERIFY].

What is the legal basis for recording a meeting?

Depends on context. Internally, employer may rely on legitimate interest with a balancing test and prior info: employee consent is rarely "free" due to subordination. For client or external calls, explicit consent is generally required. Recording and transcribing without legal basis, prior info, and controlled retention is illegal.

7. EU Transfers and Cloud Act

Can the US Cloud Act apply to my data with Leexi?

Good question. Your data are stored in France, but AWS is a US company, theoretically subject to Cloud Act. For strict sovereignty aiming at immunity to extraterritorial laws, Scaleway (French provider) is the suitable option. Leexi does not claim AWS Paris hosting is immune to US law but offers an alternative for those who require it.

How is this different from US tools like Otter or Fireflies?

A tool hosting and processing entirely in the US falls under post-Schrems II transfer rules and must rely on the Data Privacy Framework. The consent model of several US tools, where one participant triggers recording for all, is fragile under GDPR articles 6 and 7. Leexi stores and processes in France and enforces default consent. Comparison is only versus US tools, e.g. AI note-taking tool alternatives for Teams.

8. Technical Security

Are my data encrypted?

Yes, in transit and at rest.

Who has access to my data on Leexi's side?

Access is governed by security policy covered by ISO 27001 [internal access and logging details TO VERIFY]. This is regularly checked during client audits.

9. EU AI Act

What does the EU AI Act change for choosing an AI note-taking tool in 2026?

Choosing an AI tool is primarily a legal decision. Companies must map their AI tools, conduct impact analyses for sensitive uses, and verify supplier compliance. Suppliers must prove compliance and grant audit rights or third-party compliance reports. It is a double lock with GDPR.

Is Leexi compliant with the EU AI Act?

Leexi aligns with EU AI Act, notably transparency (visible assistant in meeting, participant info) and prepares ISO 42001 structuring AI management. US tools lack these constraints, a real differentiator.

10. Sovereignty: Demand and Discourse

Why has data sovereignty become a purchase criterion?

Because initial dependence is massive and decision-makers realize it. About 70% of European cloud market is with AWS, Azure, and Google; nearly 80% of European cloud spend goes to US providers; about 70% of French data is hosted outside EU. This dependence fuels demand for a European alternative, and public markets increasingly favor certified European solutions.

Is Leexi a credible sovereign alternative to US tools?

Leexi is a Franco-Belgian entity, stores and processes in France, enforces default consent, holds ISO 27001, and offers sovereign hosting with Scaleway. For buyers excluding US tools over data transfer, it is often the entry point.

11. By Sector

I work in health. Can I use Leexi?

Personal health data require HDS-certified hosting, a regulatory obligation, not a convenience. Leexi addresses this via partners [exact scope TO VERIFY]. This must be precisely framed before engagement; this sector has the strictest requirements.

I work in or with the public sector. What should I verify?

Public sector follows SecNumCloud path for sensitive data, governed by SREN law, with storage territoriality and reinforced contract clauses. Leexi is not SecNumCloud qualified yet: for sensitive public data use, this is critical. For routine admin use excluding sensitive data, France hosting and ISO 27001 meet most requirements.

I am a lawyer, consultant, HR, or accountant. Am I concerned?

Yes, due to data confidentiality you handle: client files, candidate data, financial info. GDPR obligations (legal basis, info, retention) fully apply, and your clients may require location and no-training guarantees. Hosting in France, no training, and Leexi's DPA directly address your needs.

12. Documents to Provide Your DPO

What exactly do I give my DPO to validate Leexi?

Six documents Leexi provides: hosting location (France, AWS Paris, Scaleway option), non-training attestation, ISO 27001 certificate, DPA, subcontractor list, and retention policy. This is the file you send your DPO. While internal validation proceeds, you can test Leexi on a real meeting.

Reservations and Blocking Inputs

These points are based on our data but depend on Leexi confirmation before public release. Do not publish false or approximate compliance info to preserve legal credibility.

• Exact ISO 27001 certificate number and scope.
• Named subcontractor list.
• Default retention durations and exact deletion and erasure terms.
• License threshold triggering Scaleway option.
• Scope and terms of HDS via partners.
• Exact consent mechanics (timestamping, multi-country management).
• Contractual audit rights and internal access management terms.

The legal section of this FAQ summarizes sources and facts communicated by Leexi, not a legal opinion. For a public page engaging Leexi, have it validated by a lawyer.