For a compliant speech-to-text API in a GDPR-sensitive startup app, the deciding question is whether the provider makes an explicit, reviewable promise about EU data residency and what happens to customer audio afterward.
Short answer: for GDPR-sensitive audio in a US/EU startup app, choose an external speech-to-text provider only after its DPA, EU processing guarantee, retention controls, and default training policy survive review; keep self-hosted Whisper as the alternative when audio cannot leave infrastructure you control.
This is an architecture decision record for asynchronous audio transcription. It does not treat a SOC 2 report as proof of GDPR compliance, and it does not treat a real-time voice session as a substitute for general transcription. Compliance and availability outrank the convenience of putting every AI operation behind the same account.
Decision and failure boundaries
Own a narrow application contract such as transcribe(audio_reference, region, operation_id). Product code should receive an application transcript record, not a provider SDK object. The adapter may change; the contract should not. That boundary keeps a later vendor swap out of business logic and gives deletion, audit, and retry behavior one stable home.
