AI knowledge bases and confidentiality: 7 questions every service provider should ask before recording client conversations

Why this article

An AI knowledge base that records, transcribes, and makes client conversations searchable is a major productivity gain for service providers. We previously wrote about how AI knowledge bases per project finally become smart from your company—but as soon as you start capturing voice, video, or chat, the conversation shifts from "useful tool" to "legal assessment".

This article is a checklist of seven questions you need to be able to answer before deploying a tool like Symphoria (a partner of Wux Webtools, and the platform we use ourselves) or an alternative. The questions are based on the GDPR, the EU AI Act, EDPB guidelines, and the day-to-day practice of Dutch service providers who want to remain compliant without compliance bringing work to a halt.

The context: you are a service provider—consultancy, developer, marketing agency, accountant—helping clients with projects that last months and generate dozens of conversations. You want an AI to summarize those conversations, extract action items, and answer questions such as "what did the client say last week about the budget?". That is possible. But not without these seven answers.

1. Who gives consent for the recording—and how do you record that?

The GDPR requires a lawful basis for every processing of personal data (Art. 6). For recordings of conversations, you usually need consent (Art. 6(1)(a)) or legitimate interest (Art. 6(1)(f)). Consent must be prior, specific, informed, and freely given (Art. 7). That means: no pre-checked boxes, no hidden clauses in terms and conditions, and certainly no "we record unless you object".

What you want to see: A clear opt-in moment before the first conversation is recorded. That can be a checkbox in your project onboarding ("I agree to the recording of meetings for the purposes of project documentation and AI support"), verbal confirmation at the start of a call ("This call is being recorded for our internal knowledge base—do you agree?"), or a separate consent email. The consent must be logged: who, when, for what purpose, and with which wording.

How Symphoria solves this: Symphoria offers a consent layer per project. Before a recording starts, the system explicitly asks all participants for consent. That consent is stored with a timestamp and IP address, and can be withdrawn per project. This makes it easier to comply with Art. 7(3) GDPR ("it shall be as easy to withdraw as to give consent").

2. Where is the data physically stored, and which law applies?

In principle, the GDPR prohibits transfers of personal data to countries outside the EEA without appropriate safeguards (Arts. 44-50). After the Schrems II judgment (2020), Standard Contractual Clauses (SCCs) are no longer sufficient if the receiving party is subject to surveillance legislation such as FISA 702 in the US. The EU AI Act (2024) adds another layer: high-risk AI systems must meet transparency and audit requirements that are difficult to enforce if the data is stored outside the EU.

What you want to see: A clear statement about where the data is physically stored (which data center, which country), which subprocessors have access, and whether those parties are subject to non-European surveillance legislation. Ideally: storage within the EU, with a provider that does not have a US parent company or that explicitly offers an "EU-only" mode.

How Symphoria solves this: Symphoria runs entirely on European infrastructure (AWS eu-west-1, Frankfurt) and does not use US subprocessors for storing or processing transcripts. This makes it easier to comply with Schrems II without complex impact assessments.

3. Which model processes the transcripts, and are they used for training?

Most AI knowledge bases use an external LLM (OpenAI, Anthropic, Google) to process transcripts. That raises two questions: (1) are the transcripts used to train the model? and (2) who has access to the prompts and responses? OpenAI's API terms have stated since March 2023 that data sent via the API is not used for training—unless you explicitly opt in through a separate program. But that guarantee does not apply to all providers, and certainly not to free or "research" access.

What you want to see: An explicit statement that transcripts are not used for model training, and that after processing they are no longer accessible to the LLM provider. This must be included in the data processing agreement, not only in an FAQ. Bonus: the platform uses a model you can host yourself (e.g. Llama, Mistral) or a European provider with a strict no-training clause.

How Symphoria solves this: Symphoria uses OpenAI's API with a Business Associate Agreement (BAA) and a no-training clause. Transcripts are processed via the API, but are not stored by OpenAI and are not included in future model versions. This is explicitly stated in the subprocessor list.

4. How long do you retain recordings and embeddings, and who can delete them?

The GDPR requires that personal data not be kept longer than necessary for the purpose for which it was collected (Art. 5(1)(e): storage limitation). For an AI knowledge base, that means you must be able to explain why a recording from six months ago is still relevant, and you must have a process for deleting old data. This also applies to derived data: embeddings (vector representations of text) are personal data if they can be traced back to an individual.

What you want to see: A configurable retention period per project (e.g. "automatically delete recordings after 12 months"), a button that allows a project manager to manually delete a recording, and a guarantee that deletion also affects the embeddings and indexes—not only the audio file. Ideally: an audit log that shows when something was deleted and by whom.

How Symphoria solves this: Symphoria offers a "retention policy" per project. You can configure recordings to be deleted automatically after X months, including transcripts and embeddings. Manual deletion is possible via the project interface, and every deletion is logged in the audit trail.

5. What audit logs are available—can a client later see what happened to "their" conversation?

Transparency is a core principle of the GDPR (Art. 5(1)(a)). That means you must be able to explain what you have done with someone's data—even after the fact. For an AI knowledge base, that means you must be able to show which recordings were made, who viewed them, which queries were run, and whether data was exported or deleted. Without audit logs, you cannot answer those questions, and you risk fines in the event of a data breach or complaint.

What you want to see: An audit log per project that tracks at least: (1) who started a recording, (2) who viewed a transcript, (3) which queries were run against the knowledge base, (4) whether data was exported, and (5) whether data was deleted. That log must be searchable and retained for at least 12 months (longer if you work in a regulated sector).

How Symphoria solves this: Symphoria logs all actions at project level: recordings, views, queries, exports, and deletes. These logs are accessible to the project owner and can be exported as CSV. This makes it easier to comply with a request for access (Art. 15 GDPR) or to investigate an incident.

6. What is the exit strategy? (Can you export your knowledge base in an open format?)

Vendor lock-in is a risk with every SaaS tool, but with an AI knowledge base it is particularly painful: you have collected months of conversations, transcripts, and metadata, and if you cannot export them, you lose that knowledge. The GDPR gives you the right to data portability (Art. 20), but that applies only to data you have provided yourself—not to derived data such as embeddings or summaries. Still, it is wise to require that you can export everything, in a format you can import into another provider.

What you want to see: An export button that gives you at least: (1) all audio or video files, (2) all transcripts in plain text or JSON, (3) all metadata (timestamps, participants, tags), and (4) ideally also the embeddings in an open format such as Parquet or JSONL. Bonus: the export is automated and can be scheduled (e.g. weekly backup to your own S3 bucket).

7. Who is the processor, who is the controller, and is that documented in a data processing agreement?

The GDPR distinguishes between the controller (the party that determines why and how personal data is processed) and the processor (the party that processes data on behalf of the controller). As a service provider, you are usually the controller, and the AI knowledge base is the processor. That means you need a data processing agreement (Art. 28 GDPR) that precisely sets out what the processor may do, for how long, with which subprocessors, and what happens in the event of a data breach.

What you want to see: A Data Processing Agreement (DPA) that complies with Art. 28(3) GDPR. It must include at least: (1) the subject matter and duration of the processing, (2) the nature and purpose of the processing, (3) the type of personal data and the categories of data subjects, (4) the rights and obligations of the controller, (5) a list of subprocessors, and (6) a procedure for data breaches. That agreement must be signed before you start recording.

How Symphoria solves this: Symphoria offers a standard DPA that complies with Art. 28 GDPR. You can sign it via the platform interface, and it is automatically updated when a new subprocessor is added. This makes it easier to remain compliant without involving a legal team every time.

TL;DR checklist

• Consent: Record prior, specific consent—with a timestamp and opt-out option.
• Storage: Check whether data is stored within the EU and is not subject to non-European surveillance legislation.
• Training: Require an explicit guarantee that transcripts are not used for model training.
• Retention: Set a retention period and ensure deletion also affects embeddings.
• Audit: Require logs of who viewed, queried, and deleted what.
• Export: Check whether you can export all data in an open format.
• DPA: Sign a data processing agreement before you start recording.

What this means for your organization

If you can answer these seven questions, you are well on your way. But note: compliance is not a one-time checklist. The GDPR requires you to regularly verify that you still meet the requirements (Art. 24: "appropriate technical and organisational measures"), and the EU AI Act adds another layer for high-risk systems. That means: periodic audits, DPIAs for new use cases, and a process for responding to access requests and data breaches.

Want to see how this works in practice? Read a week with an AI knowledge base: how it changes the work of a project manager at a service provider—a narrative case in which we show exactly how these questions arise in day-to-day practice.

The key lesson: an AI knowledge base only becomes a productivity gain if you retain your clients' trust. And you earn that trust by asking—and being able to answer—these questions before you press "record".