Security your DPO can read in one scroll.
Your calls are stored and processed in the EU and never used to train a model. Everything else is below, in plain language.
We don’t train our models on your data. Ever.
Your conversations, your proposals, your deals: yours. They never feed a model, never train a model and never leave the tenant they belong to.
Drummer has in-house cybersecurity expertise to keep every system at an enterprise standard.
At a glance
- Data residency
- Your calls, transcripts and CRM data stay in the EU (AWS Frankfurt, EU transcription and models). Sign-in email (Postmark, US) and bot protection (Cloudflare) run under standard contractual clauses.
- Encryption
- TLS in transit, encryption at rest, and secrets such as CRM tokens encrypted on top.
- Access
- Single sign-on with Google and Microsoft Entra ID (SAML). Roles Owner, Manager and Member; members see only their own calls.
- Audit
- Every CRM write and every admin action is logged, with who did it and when.
- Retention
- Retention periods you configure, deletion on request, and meeting media deleted at the recording provider as soon as we have copied it.
- Recording consent
- The notetaker announces itself when it joins a meeting; the phone app asks before it records.
- AI
- Models run in the EU and are never trained on customer data. Everything the AI writes is marked as AI and reviewed by a person before it reaches a customer or the CRM.
Subprocessors
The companies that process customer data on our behalf. The list in your data processing agreement is the binding one.
| Subprocessor | Purpose | Region |
|---|---|---|
| Amazon Web Services | Hosting, storage and database | EU (Frankfurt) |
| Amazon Bedrock | AI models (Claude) | EU |
| Google Cloud Vertex AI | Fallback AI models | EU |
| Soniox | Transcription | EU |
| Recall.ai | Meeting notetaker | EU |
| Postmark | Transactional email: sign-in codes and notifications | United States, under standard contractual clauses |
| Cloudflare | Bot protection on sign-in | Global network, under standard contractual clauses |
| PostHog | Cookieless analytics on this website only | EU |
GDPR and the EU AI Act
GDPR
For the calls, transcripts and CRM data you bring, your organisation is the controller and Drummer is the processor. We sign a data processing agreement with you before any business data is connected.
Requests from data subjects, such as access or deletion, come to you as the controller. We carry them out on your instruction.
EU AI Act
We build to the AI Act’s principles today and track its obligations as they apply in 2026 and 2027.
- Transparency
- Everything Drummer’s AI writes is labelled as AI in the product.
- Human oversight
- Reps approve every email, CRM update and task before it goes out. Scores support coaching and are never meant to be the sole basis for decisions about people.
- Logging
- Automated CRM changes and admin actions are kept in an audit trail.
A note from our CTO
Trust starts before the first conversation is recorded. Your team should understand what Drummer can access, where information goes and which actions stay under human review.
Security is a shared conversation across your CRM, integrations and AI providers. Bring your requirements to us so we can review access, processing terms, retention and offboarding together.
Siebe CooremanCTO & co-founder, DrummerQuestions security teams ask
Where is our data stored?
In the EU. Recordings, transcripts, scores and the database are stored on AWS in Frankfurt (eu-central-1), and transcription and AI models run in the EU as well. Meeting media is deleted at the recording provider once we have copied it. The full list of subprocessors and their regions is on this page and in the DPA.
Do you train AI models on our calls?
No, never. Your calls, transcripts and CRM data are not used to train any model, ours or a provider’s. The models we use run in the EU under agreements that exclude training on customer data, and your data stays inside your own tenant. Everything the AI produces is labelled as AI in the product.
Can we sign a DPA?
Yes. We sign a data processing agreement with every customer before any business data is connected. It names Drummer as processor, lists the subprocessors and covers retention, deletion and security measures. Ask for it at hello@drummerhq.com and we send it over, or bring your own template and we review it with you.
How does recording consent work?
The notetaker joins a meeting under its own name and announces that it records, so every participant knows. The phone app asks for confirmation before it starts recording an in-person conversation. Your organisation decides the lawful basis and the notice it gives; we help you set up the wording that fits your markets.
Can we delete a recording?
Yes. An admin can delete a recording, and its transcript and scores go with it. You can also set retention periods so calls are removed automatically after the time you choose. On request we delete all of your organisation’s data, for example when you leave Drummer.
Discuss security in a demo.
Meet our team and ask about architecture, data handling and privacy.