GDPR and security compliance

Reference sheet - Version 3.0, September 2026

This sheet answers the questions security, legal and procurement teams ask before deploying EverReady. It summarises our position; the binding commitments are set out in our data processing agreement and our privacy policy, both listed in section 9.

1. The essentials at a glance

2. Allocation of roles

For all data processed through the platform — emails, calendars, call logs, CRM data, meeting recordings and transcripts, generated content — the customer is the controller and EverReady is the processor. The customer determines the purposes, activates each module, configures access rights and sets retention periods. We act only on its documented instructions.

EverReady acts as an independent controller only for its own account, billing and technical usage data, and for its commercial activity and website.

Accordingly, a data subject whose data is processed through the platform exercises their rights with the customer. Requests that reach us directly are forwarded to it.

3. Sub-processors

This list is exhaustive. Any addition or replacement is notified to the customer in advance, which then has thirty days to raise a reasoned objection.

4. International transfers

Hosting and processing take place within the European Union. We rely neither on the Privacy Shield, invalidated in July 2020, nor on the EU-US Data Privacy Framework.

One point is worth flagging. Recall.ai (Hyperdoc Inc.) is a company incorporated under the laws of the United States, but hosting and processing take place exclusively on its Frankfurt infrastructure, and content is deleted from its servers as soon as the recording ends. Should remote access from the United States occur for support purposes, it would be covered by the module three standard contractual clauses we have entered into with that company, governed by Irish law and supplemented by: encryption in transit and at rest, segregation of environments, restriction and logging of access, an undertaking to make no voluntary disclosure to any authority, redirection of any such request to the controller, and a joint review of whether transfers should be suspended.

Our transfer impact assessment is available on request.

Where the customer chooses to route processing to its own large language model environment or to storage outside the European Union, the resulting transfers fall within its responsibility.

5. Artificial intelligence

Three configurations are available, at the customer's choice: the artificial intelligence native to its Salesforce environment, our AI services executed via Amazon Bedrock in a European Union region, or its own large language model environment connected via API.

In the configuration hosted by us, the customer selects the model from the catalogue. Models are executed inside Bedrock: model providers have no access to the data, and nothing is retained once inference is complete.

Customer data is not used to train any model, whether ours or a third party's. This commitment is set out in Article 4 of our data processing agreement.

The content produced consists of proposals submitted for human validation. No decision producing legal effects, or significantly affecting a person within the meaning of Article 22 of the GDPR, is taken solely on the basis of automated processing. Agent actions in the CRM are logged and attributable.

The agents' access scope is configured by the customer, object by object and field by field, in read and write mode.

6. Meeting recording

Activating the module, choosing the meetings concerned and informing participants are matters for the customer, which must inform internal and external participants alike, obtain their consent where the applicable law requires it, and allow them to object.

Meetings involving sensitive data within the meaning of Article 9 of the GDPR, data covered by a professional privilege, or meetings of employee representative bodies are contractually excluded from the module.

Recordings, transcripts, timestamps and participant identities are retained for six months by default, and up to twenty-four months where the customer subscribes to the corresponding option. Storage takes place in our European Union storage or in the customer's own, at its choice.

Given the systematic nature of this processing, we consider that deploying this module may require a data protection impact assessment within the meaning of Article 35 of the GDPR, and we provide the customer with the technical information needed to carry one out.

7. Security

• Information security management system certified to ISO/IEC 27001; certificate and scope available on request, under a confidentiality agreement where needed.
• Encryption of data in transit (TLS 1.2 minimum) and at rest (AES-256).
• Multi-factor authentication for access to production environments, permissions on a least-privilege basis, periodic access reviews.
• Strict logical segregation of data by customer.
• Logging of access, user actions and AI agent actions, retained for twelve months.
• Periodic penetration testing by an independent third party; summary available on request.
• Encrypted backups, multi-zone redundancy, documented continuity plan.
• Notification of any data breach to the customer within forty-eight hours of our becoming aware of it.
• Customer audits available once a year, on documents or on site, under the conditions set out in Article 19 of the data processing agreement.

8. Retention periods

Data synchronised into the customer's CRM or stored in its own storage remains subject to the periods it defines.

9. Documents available

• Data processing agreement (Article 28 GDPR), covering the European Union, the United Kingdom and the United States, with its schedules: description of the processing, list of sub-processors, technical and organisational measures, UK addendum.
• Privacy policy, addressed to data subjects, including participants external to recorded meetings.
• General terms and conditions of service and terms of use.
• ISO/IEC 27001 certificate and scope of certification.
• Penetration test summary.
• Transfer impact assessment concerning Recall.ai.
• Extract from our record of categories of processing activities.

These documents are provided on request at gdpr@everready.ai. The contractual documents are also available at everready.ai.

We respond to security questionnaires and customer requests, and we are happy to arrange a direct discussion between your CISO and our security lead.

EverReady SAS — 21 rue Saint Vincent, 92700 Colombes, France — RCS Nanterre 879 848 919 — gdpr@everready.ai