European alternatives to Otter.ai and Fireflies: EU-hosted, bot-free options compared

If legal or procurement has ruled out Otter.ai or Fireflies, the replacement has to pass two separate tests, and most comparison pages only run one of them. The first is where the data physically sits. The second is which government can compel the company holding it to produce that data, which is a different question with a different answer.

The table below runs both tests on nine options. Every competitor fact in it was read off the vendor's own page on 22 September 2026, and the URL is in the table. Where a vendor does not state something, the cell says so rather than guessing: "not stated" means the fact is absent from the page, not that the answer is no.

The columns that decide this, and why they are hard to find

Vendor roundups compare price, language count and summary quality. A data protection officer signing off a tool asks a different set of questions, and the answers are usually spread across an imprint, a privacy policy, a security page and a trust centre:

• Legal seat and parent. Which company is the controller or processor, and under which country's law does it exist.
• Storage region. Where the transcripts and any audio rest.
• Processing region. Where the speech recognition and the language model actually run. This is frequently a different region from storage, and it is the column vendors are least likely to fill in.
• A public subprocessor list. Art. 28(2) and (4) GDPR make sub-processing a contractual matter. A vendor that publishes the list has already answered half the question.
• Whether anything joins the meeting. A tool that dials into the call is a second processor in the room and a visible participant that someone has to admit.
• Whether you need host or admin rights. This decides whether you can use the tool at all on a call you did not organise.

Who holds the data, and where

Facts read from the linked page on 22 September 2026.

Two cells in that table are worth reading twice. Otter's published subprocessor list, effective 31 March 2026, names Amazon Web Services, Google Cloud Platform, Crusoe, Anthropic and OpenAI, and gives the United States as the country for all of them. That is not a criticism of Otter, which publishes the list precisely so buyers can see it. It is simply the fact a transfer assessment turns on. And Kalima's own row has a gap: the categories of processor are published, the named list is not, which is less than Otter, Fireflies, Jamie and Sally offer today.

How each tool gets into the meeting

EU hosting is not the same as EU jurisdiction

This is the distinction that most "EU alternative" pages skip, and it is the one that decides whether a tool survives a transfer assessment.

Under 18 U.S.C. § 2713, added by the CLOUD Act in March 2018, a provider of electronic communication or remote computing service subject to US jurisdiction must comply with an order to preserve or disclose communications and records in its "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States". The statute is explicit that the physical location of the data is not the deciding factor. What matters is whether the company holding it falls under US jurisdiction.

The practical consequence for a shortlist: "our data is stored in Frankfurt" tells you about latency and about Art. 44 GDPR transfer mechanics. It does not by itself tell you whether a foreign authority can compel production. For that you need the first column of the table, the legal seat and the parent company, and you need to check whether an EU-branded product is a subsidiary of a US group.

The transfer route in the other direction is a live legal question rather than a settled one. The Commission's adequacy decision for the EU-US Data Privacy Framework was upheld by the General Court in Latombe v Commission, T-553/23, on 3 September 2025, and that judgment was appealed to the Court of Justice in October 2025. The adequacy decision is valid law while the appeal is pending, so a transfer to a DPF-certified US vendor has a legal basis today. Whether you want to build a three-year procurement decision on a mechanism under appeal is a judgement for your own data protection officer, not for a vendor blog. Check any vendor's current entry yourself on the official Data Privacy Framework list rather than trusting a table, including this one.

A tool that never joins the call still needs consent

Removing the bot removes a visible participant. It does not remove the legal question. Recording and transcribing a conversation is processing personal data about everyone who speaks, and in most European jurisdictions it needs a lawful basis and, in practice, the participants' agreement.

In Germany, § 201 StGB makes it a criminal offence to record the non-public spoken word of another person unbefugt, that is, without authorisation. The operative word is "unbefugt": consent removes the offence. Other countries draw the line differently, and your meeting platform's terms of service may add their own rule on top.

The practical version, which costs you one sentence: say at the start that you are transcribing, say what happens to the transcript, and stop if someone objects. A tool that does not appear in the participant list is not a way to skip that conversation, and a vendor who sells it to you as one is selling you a problem. There is more detail in is it legal to record a meeting, and your own DPO is the person who signs it off.

If you want nothing to leave the device at all

Three categories are getting mixed together in this market, and they are not interchangeable:

1. A bot joins the meeting. Otter, Sally, and Fireflies in its default mode. Easiest to deploy across a team, visible to everyone in the call, and dependent on the platform continuing to admit third-party participants.
2. Bot-free, processed in the cloud. Jamie, Bliro, Kalima, and Fireflies via its extension. Nothing joins the call, but the audio or the transcript still goes to a provider, so the provider's jurisdiction and subprocessors still matter. This is the category most of this article is about.
3. Fully local. Meetily is the clearest example: open source under the MIT licence, installers for macOS and Windows, Linux from source, and the statement that processing happens on the device. Nothing reaches a vendor at all.

If the requirement your legal team wrote down is literally "no audio and no transcript may leave the device", category two does not satisfy it, and no amount of EU hosting changes that. Go to category three and accept the trade: you run the software, you manage the updates, you get no shared workspace, no live translation for the person in the room who does not speak the language, and the transcription quality is whatever model fits on your laptop.

Where Kalima fits, and what it does not have

Kalima is category two: bot-free, processed in the EU, not local. It is operated by ByteHawk GmbH, a German company registered in Düsseldorf. Audio travels over encrypted connections, is stored in the EU, and is never used to train models. You can export your data and delete your account yourself from the account panel, and sharing is off until you turn it on. Capture happens on the device you are already using, the microphone, the system audio, or both mixed, so nothing appears in the participant list and you do not need host or admin rights on the call. It transcribes 60+ languages with automatic detection, and it can translate live while the conversation is running, one way into a single language or two way between two languages side by side. Prices start at EUR 14.99 a month and there is a free tier; the current figures are on /pricing.

What it does not have, which matters if you are replacing Fireflies in particular:

• No CRM or workflow integrations. No Salesforce, no HubSpot, no Zapier app, no automatic push into Notion or Slack. There is a REST API and an MCP server for reading your own transcripts, and that is the extent of it. If the reason your team bought Fireflies was the CRM sync, Kalima is a downgrade on that axis and you should weigh it honestly.
• No calendar integration that auto-joins. The desktop app can detect a call on your machine and offer to record it, but nothing reads your calendar and nothing turns up in a meeting on your behalf.
• No native mobile app. There is an installable web app on phones, which is not the same thing as a native iOS or Android client.
• No named subprocessor list, as the table above records. Categories of processor are published; the list of names is not.

If you want the head-to-head rather than the shortlist, Kalima vs Otter.ai and Kalima vs Fireflies.ai go feature by feature.

Frequently asked questions

Is Otter.ai GDPR compliant?

That is not a question a competitor should answer for you, and it does not have a yes or no answer in the abstract. What is verifiable: Otter.ai, Inc. is a Delaware company based in Mountain View, its published subprocessor list dated 31 March 2026 gives the United States for effectively every entry, and its privacy policy states self-certification under the EU-U.S. Data Privacy Framework. Whether a transfer on that basis is acceptable for your processing is a decision for your controller and your DPO, documented in a transfer assessment.

Does storing data in the EU solve the CLOUD Act problem?

Not on its own. 18 U.S.C. § 2713 applies to data in a provider's possession, custody or control "regardless of whether" it sits inside or outside the United States. The location of the servers is one input. The jurisdiction over the company, including a European subsidiary of a US parent, is the other.

Which of these tools works on a call I did not organise?

Anything in the bot-free column: Jamie, Bliro, Kalima and Meetily record from your own device, so there is no participant for the host to admit. Fireflies' Chrome extension does the same. A bot-based tool needs somebody with host rights to let it in, which on a client's call or a supplier's call is not your decision to make.

Is a bot-free tool automatically more private?

No. It removes one visible participant and one integration, which is a real reduction in exposure. It does not change where the audio is processed, who the subprocessors are, or which country's courts can reach the company. Those are the columns in the first table, and a bot-free US tool sits in exactly the same jurisdiction as a bot-based one.

What should we ask a vendor before signing?

Six things, in writing: the legal entity and its parent, the storage region, the processing region for both speech recognition and any language model, the named subprocessor list, whether customer data is used for model training, and the deletion period after you cancel. If a vendor will not put all six in writing, that is itself an answer.

Do these prices and facts stay current?

No. Six of the vendors in the table changed pricing or shipped a bot-free mode within the last year. Every fact here carries the date it was checked, 22 September 2026, and the source URL. Re-check the ones that matter to your decision before you rely on them.

Related

• Kalima vs Otter.ai
• Kalima vs Fireflies.ai
• Why no bot joins your meeting
• Best meeting transcription software for teams
• How Kalima handles your data