GDPR and local data residency compliance

Enterprise legal departments and European organizations face stringent regulations regarding data sovereignty, GDPR compliance, and cross-border data transfers. Traditional AI meeting notetakers route audio to US cloud servers, triggering complex compliance overhead. Oyma‘s local-first architecture bypasses these risks.

Architectural comparison for data governance

Compliance Dimension	Traditional Cloud AI Notetakers	Oyma On-Device Architecture
Data Residency	Foreign cloud data centers (US/EU)	100% On your local Mac drive
Sub-Processors	Multiple cloud transcription and LLM vendors	Zero external sub-processors
International Data Transfers	Requires Standard Contractual Clauses (SCCs)	No international data transmission
Right to Erasure (Article 17)	Dependent on vendor database retention cycles	Instant local file deletion via macOS Trash
Data Breach Surface	Centralized vendor database exposure risk	Distributed local client encryption

GDPR compliance analysis

Article 28 (Processor Mandates)

When using Oyma with on-device Whisper and local Ollama, Oyma does not transmit, store, or process personal data on its servers. You remain both the Data Controller and Data Processor.

Article 32 (Security of Processing)

Your data security inherits native macOS hardware defenses:

• FileVault whole-disk AES-256 encryption.
• Apple T2 / Secure Enclave hardware access controls.
• Local Keychain protection for private credentials.

Two-party recording consent

Compliance with recording regulations (such as California wiretap laws and European consent mandates) requires notifying participants before recording. We recommend announcing recording at the start of meetings and confirming mutual consent.

Related guides

• Verify network guard in Network guard verification and test suite.
• Deletion mechanics in Data retention and permanent deletion.
• Inspect egress calls in Egress log.