Deepgram

GDPR overview

The GDPR is addressed explicitly rather than in passing. The privacy notice places Deepgram in the role of processor under both the EU and UK GDPR, with customers acting as controllers, states that data processing agreements are signed with customers, and confirms that the European Commission's Standard Contractual Clauses are frequently used to legitimise transfers of customer data to the United States. Requests from individuals exercising their rights are routed back to the customer controller. The pricing page goes further, claiming full GDPR compliance and advertising a dedicated EU endpoint so that processing can stay inside the Union. Two gaps are worth noting: no Article 27 EU representative and no data protection officer is named on any page reviewed, and the privacy notice is dated 26 October 2021 while the terms of service were refreshed on 6 August 2026.

Who owns the data?

Deepgram's terms are explicit on the point: the company does not claim ownership of customer content. Inputs submitted to the service and the outputs it returns are together defined as Your Content, and the customer keeps whatever right, title and interest they already held. Two limits qualify that. Outputs are not guaranteed to be unique, because other customers may generate similar results from similar inputs. And nothing in an output conveys any right over the underlying models, algorithms, neural networks, weights or parameters, which remain Deepgram's property. Under the GDPR the company positions itself as a processor acting on the customer's instructions, the customer being the controller.

Reuse rights

Customers may reuse outputs without asking permission: they keep their rights and no further authorisation is required. In exchange they carry the responsibility, both for evaluating whether an output is accurate and appropriate for their use case, and for holding the rights needed over whatever they submit. The reverse direction is where the terms bite. Section 3.2 grants Deepgram an irrevocable, perpetual, transferable, sublicensable, worldwide and royalty-free licence over customer content, covering operation of the service, its improvement, the development of other products, and the training and testing of Deepgram's models. That licence survives expiry or termination of the agreement. An opt-out exists and is documented: on the APIs it is set per request through a parameter, so it applies to that request alone rather than to the account; Saga users find the choice in their settings. One consequence deserves attention before any budget is signed off, because the published rates assume enrolment in the Model Improvement Program.

Data retention & training

Hosting summary

The privacy notice is direct on jurisdiction: data is stored on servers in the United States. That places customer content under US law by default, which is why the notice also states that Standard Contractual Clauses are frequently used to legitimise transfers out of the European Economic Area, the United Kingdom and Switzerland. For organisations that cannot accept a transfer, Deepgram advertises a dedicated EU endpoint so processing stays inside the Union, although the enterprise page still describes the EU-hosted transcription endpoint as early access, available on request through a form. Beyond the shared cloud, three alternatives exist: a single-tenant Dedicated runtime with region-specific deployment, deployment inside a customer VPC, and full self-hosting on AWS, GCP or a customer's own data centre, which puts the jurisdiction question back in the customer's hands. Amazon Web Services is the principal infrastructure subprocessor, with Cloudflare listed for audio, signup information and interactive text.