Voice AI Agents for European Languages and GDPR: 13 Platforms Compared (2026)

If call data has to stay in the EU, there are two routes in 2026: self-host an open-source platform such as Dograh on servers you control, or buy from a vendor whose EU option keeps both storage and processing in the EU, such as Synthflow's EU cluster, PolyAI's EU region, Parloa Zones or Cognigy's Europe cluster with its EU-hosted speech option. The big US developer platforms keep EU hosting for their top plans, and one of them says it does not operate in the EU at all.

Loop Voice publishes this guide. It is a hosted voice agent for online stores that mostly call US shoppers, so it isn't ranked; the last section covers where it fits. Vendor facts come from each vendor's own pages and the rules from EU sources, all checked on Nov 6, 2026. It is practical information for your data protection officer, not legal advice.

"Not stated" means we couldn't find it on the vendor's public pages, not that the vendor lacks it. Ask for anything that matters to you in writing.

A language count is a ceiling, not a promise; the section on testing languages below shows how to check the ones you need.

These are the practical rules most teams work through before an AI agent takes calls in the EU. They are a starting point for your data protection officer, not legal advice.

• Calls are personal data. The EDPB's guidelines on voice assistants list voice, transcriptions, metadata and system logs as personal data that voice systems process.
• Usually you are the controller and the vendor is your processor. That needs a written contract under Article 28 of the GDPR, usually called the data processing agreement, and the vendor may only add subprocessors with your prior written authorization. In practice, ask for the subprocessor list with regions.
• Transfers out of the EU need a legal basis. US companies certified under the EU-US Data Privacy Framework can receive data under the Commission's adequacy decision of July 2023, which the EU General Court upheld in September 2025; an appeal to the Court of Justice was filed in October 2025. Others rely on standard contractual clauses.
• Keep recordings only as long as you need them. Set a retention period for each purpose and delete on schedule.
• Voice becomes special-category data when it is used to identify people. The EDPB calls voice data "inherently biometric personal data", and recognizing a caller by voiceprint is processing under Article 9, which needs an exception such as explicit consent. Check whether any voice biometrics feature is switched on.
• Tell callers they are talking to an AI. Article 50 of the EU AI Act requires that people be informed they are interacting with an AI system, at the latest at the first interaction, unless it is obvious. It has applied since Aug 2, 2026, and the Digital Omnibus on AI, in force since July 27, 2026, left that date unchanged.

Calls to US numbers follow different rules on consent and AI voices; our guide to calling rules for AI voices covers them.

Self-hosting is the only setup where no voice agent vendor processes your call data at all. The trade is that you run the servers, and you still choose where the speech and language models run.

Dograh is an open-source voice agent platform under the BSD 2-Clause license, with a visual workflow builder, browser call testing, telephony connections and recordings, deployed with Docker Compose on your own servers. Its homepage says that with the models served inside your perimeter, no calls, recordings or transcripts leave it, and Dograh's argument for compliance is simple: because it never sees your data, you don't need a vendor review or certifications from Dograh itself.

The models decide the rest. Dograh's own docs say speech-to-text providers receive call audio and tell you to review each provider's regional hosting. For an all-EU setup, run Dograh in an EU data center and then either self-host the models (Dograh says local speech-to-text and text-to-speech are production-ready and local language models are in beta) or use providers it supports that offer EU processing. Azure OpenAI's EU Data Zone processes prompts and responses within Microsoft's EU Data Boundary, and Deepgram and Speechmatics run EU endpoints for speech; Deepgram says requests to its EU endpoint are never routed outside the EU. Check that each integration can be pointed at the EU endpoint before you rely on it.

Languages follow the providers: Dograh lists 70+ through them, with switching mid-call for 11. It connects to Twilio, Vonage, Telnyx, Plivo and other carriers, or to your own Asterisk PBX, so you can keep the European numbers you already have.

Three settings matter for GDPR. A fresh install uses Dograh's own managed models, billed through a Dograh Cloud account, so switch to local models or EU-processing providers before real calls. The quickstart sends anonymous usage data until you set ENABLE_TELEMETRY=false. And Dograh's hosted cloud doesn't state a hosting region or publish a DPA, while its managed SIP edges are listed for Global, India and the UAE, so for EU residency use the self-hosted version or ask about the Enterprise plan, which covers on-premise and private-cloud deployment. Setup details are in our guide to self-hosted voice AI agents.

These vendors sell to contact centers and large service teams on custom contracts. Most offer an EU region in some form; the differences are in how much of the processing it covers and how much they publish.

Parloa, based in Berlin, sells AI agents for enterprise customer service and names Allianz, Booking.com, Zalando and IKEA among its customers. With Parloa Zones, a customer chooses the region where transcripts, personal data, logs and analytics, and the services that process them, run. Parloa runs on Microsoft Azure; before Zones it ran one environment in Germany and one in the US.

Its security page lists ISO 27001, SOC 2 Type 1 and 2, PCI DSS, HIPAA and DORA, its trust center adds ISO 42001 and a DPA, and Parloa says its agents speak 140+ languages and variants. Pricing is consumption-based, per minute for voice, on custom plans with no public price list. Pick Parloa for a large contact center that needs regional data residency it can document; it is not built for a small team that wants to start this week.

Cognigy, headquartered in Düsseldorf and now part of NiCE, runs a Europe SaaS cluster alongside US, UK and Australian ones. Since an August 2025 release, voice customers can switch to ElevenLabs' and Deepgram's EU-hosted speech services so that, in Cognigy's words, "all audio data is processed within the EU". Its trust center lists ISO 27001, ISO 27701, ISO 42001, SOC 2 Type II, Germany's BSI C5 and the automotive industry's TISAX.

Its voice gateway works with any SIP trunk and connects to contact center platforms such as NiCE, Genesys and Avaya. Cognigy advertises voices in 100+ languages, with exact coverage set by the speech vendor you choose. Two caveats: its docs say on-premises installations are no longer offered to new customers, and pricing isn't public.

PolyAI, with offices in London and New York, builds voice agents for complex, high-volume customer service. Its homepage lists data residency in the US, UK, EU and APAC with "no cross-region transfer", plus SOC 2 Type 2, ISO 27001 and PCI DSS. PolyAI says it supports 75 languages. Per its docs, its own Raven 3.5 model covers 24 of them, others such as Danish need a third-party language model, and not every model option is configured in every region, so confirm your languages are available in the EU region.

Platform pricing is per minute and custom. You can buy numbers from PolyAI, bring Twilio numbers, or connect your own carrier over SIP at no charge. Pick it for a large, multilingual service line where answer quality matters more than published prices.

Synthflow, run by Berlin-based AgentFlow AI GmbH, has the clearest EU option among the hosted platforms: pick the EU cluster when you create a workspace, and all data and processing stay in the EU. The choice is permanent, and the older Global cluster, which stores data in the EU but can process live calls in the US, is being retired during Q4 2026. Its trust center lists every subprocessor with its region, and agent-level settings can delete recordings, transcripts and caller IDs automatically after 30 days.

Certifications include SOC 2 Type 2, ISO 27001 and PCI DSS v4.0.1, and its docs name more than 30 languages, including German, French, Spanish, Italian, Dutch, Polish, Swedish, Danish, Finnish, Czech, Greek and both European and Brazilian Portuguese. The trade-off is commercial: Synthflow now sells only annual enterprise agreements, with no free plan, trial or per-minute rate. Numbers bought through it cover only the US, Canada and Australia, so European numbers come from your own Twilio account or carrier over SIP. With your own Twilio account in an EU workspace, only some Twilio requests run in Twilio's Ireland region. Our Loop Voice vs Synthflow comparison has more.

telli is a Berlin company whose agents handle sales, support and operations calls for B2C brands; its homepage links customer stories from Enpal, Sky, McMakler and Zenjob. It has a SOC 2 Type II report, offers DPAs and lists its subprocessors in its trust center. On hosting, its security page asks you to discuss hosting, model-provider and data-residency requirements with the team, and deployment in your own infrastructure is available on request; no default region is published.

The homepage gives two language counts, 20+ and 30+. Pricing isn't public, though there is a free trial, and data retention settings come with Enterprise plans. telli fits German B2C companies with high call volumes that are happy to settle hosting in the contract.

Four vendors publish prices and keep data in the EU for small teams, without an enterprise sales process.

fonio.ai, from Vienna, is the most open of the small-business options about where data goes. Its published DPA names every subprocessor and location: hosting at Hetzner and OVH in Germany, Finland and France, telephony through Twilio's Ireland region and Voxbone, a language model from OpenAI's Irish entity with processing in Europe, and speech providers with EU processing. Fallback providers, including US companies that state EU processing, are on by default except for customers bound by professional secrecy, so check that list against your own rules.

The no-code phone assistant speaks 60+ languages. The Solo plan costs EUR 99 a month billed yearly, or EUR 119 monthly, for 1,000 minutes, and larger plans start at 3,600 minutes, with a 30-day money-back guarantee. It is built for practices, law firms, tradespeople, retailers and restaurants in German-speaking countries, and it states no ISO 27001 or SOC 2 certification.

sipgate, the Düsseldorf phone company, sells AI phone agents called sona. It runs the language models on its own infrastructure in German data centers and says call data doesn't leave that infrastructure, a tighter statement than most hosted options here make. It signs a DPA with customers.

A free tier includes 500 call minutes a month, one number and one concurrent call, then EUR 0.12 a minute before VAT. The agents work with sipgate's cloud phone system or take calls forwarded from your existing one, and connect to tools such as HubSpot, Pipedrive, Shopify and Zendesk. Its pages don't state language coverage or certifications, and the product is aimed at German small and mid-size businesses.

Famulor, from Kempten in Germany, is a low-cost, no-code platform for small businesses and agencies, including white-label resale. Its database, files and sign-in stay in Frankfurt whichever AI region you pick for a workspace (Global, EU or US), while the voice agents run close to callers in the EU, the US and India, so pick the EU region if processing location matters.

Pay as you go costs EUR 0.15 a minute, and plans start at EUR 27 a month billed yearly with 100 minutes included and EUR 0.13 a minute after. Numbers are available in 23 countries, and it lists 120 speech-to-text languages with switching mid-call. It states no ISO 27001 or SOC 2 certification.

Aircall, founded in Paris, added an AI voice agent to its cloud phone system. The storage region is set by your phone number's country at signup and can't be changed later; EU accounts are stored in AWS Frankfurt. For the voice agent, regional storage applies to accounts created on or after Oct 6, 2026, with older accounts due to move by the end of 2026, and Aircall notes that not every data type is regionalized and that stored data may be processed elsewhere.

Pricing is public and all-in: on its German page, EUR 210 a month for 1,000 minutes, EUR 700 for 3,500 and EUR 1,600 for 10,000, on an annual term, with the language model and voice infrastructure included and 100 free trial minutes. Voices come in 38 languages, numbers in 100+ countries, and Aircall holds SOC 2 Type 2. It only works inside Aircall's phone system, so it suits teams already on Aircall or ready to move; our Loop Voice vs Aircall comparison covers the store side.

Developer platforms give you every model choice and per-minute pricing, but by default they process data in the US. EU hosting, where it exists, sits at the top tier.

ElevenLabs Agents, also branded ElevenAgents, pairs ElevenLabs' own voices with speech recognition, a choice of language models and telephony through Twilio or SIP. Its agents page lists 90+ languages with switching mid-conversation; the low-latency Flash v2.5 model supports 32, including most major European languages.

Read the residency docs closely. Customer data is stored in the US by default; isolated EU, India and Singapore environments are an Enterprise feature; and even then processing may happen outside the selected location unless you use Zero Retention Mode and the API. ElevenLabs relies on the EU-US Data Privacy Framework and lists SOC 2 Type II, ISO 27001 and PCI DSS Level 1. Plans run from a free tier with 15 minutes to $990 a month, with extra minutes at $0.08 and language model usage billed on top. Our Loop Voice vs ElevenLabs comparison goes deeper.

Vapi is an API-first platform for developers who pick every model themselves. It runs a separate, isolated EU region with its own dashboard, API and SIP host, but only with the Premier Success Package. Without it, personal data is transferred mainly to the US under standard contractual clauses, and Vapi doesn't support on-premise deployments.

The base price is $0.05 a minute for hosting, with models passed through at cost and paid support packages from $29 a month up to Pro, which has a $999 monthly minimum. Language support depends on the transcriber and voice you choose. See Loop Voice vs Vapi for the store-specific trade-offs.

Retell AI is direct about it: "we do not currently operate services within the European Union", and personal data is stored and processed mainly in the US. It offers a self-sign DPA with EU standard contractual clauses, zero data retention agreements with its model providers, per-agent retention from one day to two years, and an Enterprise option to deploy in your own infrastructure.

Pay-as-you-go pricing runs from $0.07 to $0.31 a minute with $10 in free credits, numbers bought through Retell cover only the US and Canada, and its docs list 56 languages, each needing both a speech recognition and a voice provider. It suits teams whose data protection officer accepts US processing under SCCs; our Loop Voice vs Retell AI comparison covers the rest.

Most platforms list dozens of languages, and the count says little about how a call sounds. What decides it is how well speech-to-text catches your callers' accents, how the voice reads names, numbers and addresses, and whether the agent speaks in the right register.

Before you shortlist, run the same five test calls in every language you need, with a native speaker on the other end:

1. Numbers and codes. An order number, a postcode, an IBAN or a phone number, read back digit by digit.
2. Names and places. The caller's surname, a street name and a small town.
3. Register. Formal or informal address (Sie or du, vous or tu, u or je) should be a setting you choose, not a coin toss.
4. Mixed language. A caller who drops English product names into German or Dutch sentences.
5. Accent and variety. Swiss German, Belgian French, Flemish, or European rather than Brazilian Portuguese, if that is who calls you.

Score each call on three things: did the agent understand, did it sound natural, and how long did it pause before answering. Pauses can grow in languages where the speech models are weaker, and a second of silence is where callers start saying "hello?".

Ask every vendor on your shortlist the same questions, in writing, and keep the answers with your records of processing:

1. Where are call audio, transcripts and recordings processed and stored on our plan, by default?
2. Which subprocessors touch call data (carrier, speech-to-text, language model, voice), and in which regions? Send the list.
3. Will you sign a data processing agreement, and what covers any transfer outside the EU?
4. How long are recordings and transcripts kept by default, and can we turn recording off or set retention to zero?
5. Can we delete one caller's data on request, including the copies your subprocessors hold?
6. Is our call data used to train any model?
7. Can the agent say it is an AI at the start of every call, and can we edit that line?
8. Can we get local numbers in our countries, or bring our own carrier over SIP?
9. Which certifications cover the voice product itself, and can we see the reports under NDA?
10. Will you help with our data protection impact assessment?

A vendor that answers all ten quickly and in writing is usually one your data protection officer can work with.

• Call data must never reach a voice agent vendor: self-host Dograh in an EU data center, with local or EU-processing models.
• Large contact center that wants an EU vendor and a long certification list: Parloa or NiCE Cognigy; PolyAI for complex, multilingual service lines.
• Mid-market team that wants an EU-only cluster in writing: Synthflow, if an annual contract fits.
• B2C company in Germany with high call volume: telli, with hosting agreed in the contract.
• Small business in Germany or Austria on a fixed budget: fonio for the most detailed public DPA, sipgate sona for a free tier and models on German infrastructure, Famulor for pay as you go and white-label, Aircall if your team already uses its phone system.
• Developers who accept US processing under SCCs or the DPF: Retell or Vapi; ElevenLabs if voice quality leads and an Enterprise plan for EU residency is in the budget.

Loop Voice is a hosted AI voice agent for online stores: it calls shoppers who abandon checkout and answers the store's support line, with events from Shopify, WooCommerce and other platforms. It speaks English, Spanish and 30 more languages, has numbers in 90+ countries, offers a DPA on request and lists its subprocessors with their regions on its security page. Recordings and transcripts are kept for 7 days by default, and recording can be switched off per number.

It is not an EU-only stack: several of those subprocessors process data in the US, and Loop Voice's own pricing page says it works best for stores with US-based customers. If your data protection officer requires every step in the EU, choose from the options above. For stores selling mainly to US shoppers, see Loop Voice features and the hosted options in our 2026 roundup of AI voice agents for Shopify.