Where your recordings actually live

The short answer

Your recordings are stored in the European Union. So are the transcripts, the photographs you add, the family tree and the letters. They are encrypted in transit and at rest, and they are not copied to a data centre outside Europe for storage or backup.

Processing is a different sentence, and this page keeps the two apart. Four of the companies that work on your data for a moment — the one that turns speech into text, the one that writes the digital self's replies, the one that builds the voice model, and the one that restores a photograph when you ask — are American. They are named below with what each one sees. Nothing is stored with them beyond what the job needs, and none of them may train on it. That is a narrower claim than "never leaves Europe", and it is the true one.

Data residency is not the same as GDPR compliance

Data residency means the physical location of the servers holding your data. The GDPR does not require European data to stay in Europe. Articles 44 to 49 permit transfers to countries outside the EEA under an adequacy decision, standard contractual clauses, or a handful of narrow derogations. A service can be entirely GDPR-compliant and still keep your mother's voice on a disk in Oregon.

So "GDPR compliant" and "your data never leaves Europe" are two different sentences, and only one of them tells you where the disk is. That is the distinction to hold on to when reading any service in this category, including this one.

What MemoriesBox holds, and where

The controller is MemoriesBox, Lychener Str. 1, 10437 Berlin, Germany, founded 1 May 2026. Backups follow the originals: Supabase keeps its backups in the project's own region and the Stockholm bucket is not replicated to any other region. Encryption is TLS in transit and AES-256 at rest at each storage provider. Support and engineering are done from Germany by the founding team; a recording is opened only when a member asks us to look at their own account, and the storage providers log every access.

Every processor, in one list, with what it sees:

The four American processors that touch content — OpenAI, Anthropic, ElevenLabs and Google — work under Article 28 contracts with Standard Contractual Clauses for the transfer, and under terms that exclude what they receive from training their general models. That is the sentence a residency claim has to survive, and it is the reason this list is on the page rather than in an appendix to the privacy policy.

What the other services disclose

Verified from each company's own public pages on 17 August 2026. Where a company says nothing, that is what the row says.

Two of them deserve credit. Meminto hosts in Germany and publishes the fact that some of its sub-processors are American, which is more honest than most of this table. Willow Stories states its servers are in the EU. If EU residency is the only thing you care about, both are real answers.

The sanctioned version of our own claim is narrower than the marketing version, and it is the one we use:

Of the eleven life-story services we compared in August 2026, none clones the storyteller's real voice and none lets the family ask a new question later. Two AI-legacy products do: Avataari, a Melbourne company that does not disclose its hosting region, and Afterlife AI, operated from New South Wales. MemoriesBox is the only one hosted in the European Union.

The full comparison table shows the eleven, so you can check the sentence rather than take it.

Why the location matters more than it sounds

When StoryFile filed for Chapter 11 on 5 May 2024, its customer archive sat inside a United States bankruptcy estate: roughly $1.5M in assets against $10.5M in liabilities, including $150,000 owed in customer refunds (US Bankruptcy Court, White Plains, New York, case 7:24-bk-22398). The business was sold out of bankruptcy in February 2025. If a recording of your father is a line item in someone else's insolvency, the country whose courts administer that estate is not a technical detail.

European hosting with a European controller means a European supervisory authority has jurisdiction, Article 5(1)(b) restricts what a buyer could do with the data, and Articles 44 to 49 restrict moving it out. That does not make anyone immortal. It makes the failure case governed. The longer version is on /trust/what-happens-if-we-shut-down.

What we can't promise

• We hold no SOC 2 and no ISO 27001 certification. Memory Murals publishes SOC 2 and ISO 27001 through Google Cloud, and Avataari publishes AES-256 on AWS, multi-region, country not disclosed. If a certificate is what you need, they have one and we do not.
• We cannot promise a data centre never fails. We can promise the backups are subject to the same residency rule as the originals.
• We cannot promise no third party is ever involved. Four processors outside the EU touch content for the length of a request, and one of them holds the voice model. They are named above. Anyone who tells you a voice clone is made entirely inside Europe by a company our size is either running their own models or not telling you who does.
• We cannot promise the voice vendor's residency. ElevenLabs offers EU data residency on its enterprise tier; we are not on it. Until we are, the honest row in the table says United States.
• We cannot promise perfect security. Nobody honest does. We are at version 0.4.1, which is pre-1.0.
• We cannot promise EU hosting protects you from every jurisdiction on earth. It protects you in the ordinary case, which is the one that keeps happening.

What the law says

• GDPR Article 3 sets the territorial scope. Processing by a controller established in the Union is covered regardless of where processing happens.
• GDPR Article 28 governs processors and sub-processors, including the written contract and prior authorisation for onward sub-processing.
• GDPR Article 32 requires security appropriate to the risk, naming encryption explicitly.
• GDPR Articles 44 to 49 govern transfers outside the EEA. Article 45 covers adequacy decisions, Article 46 standard contractual clauses.
• GDPR Articles 33 and 34 set the 72-hour breach notification duty to the supervisory authority, and the duty to tell you when the risk to you is high.

Primary text: Regulation (EU) 2016/679 on eur-lex.europa.eu.

Questions people ask

Is MemoriesBox hosted in the EU?

Yes. Recordings, transcripts, photographs and the tree are stored in Stockholm and in Supabase's EU region, and the application runs in Frankfurt. The one thing held outside the EU is the voice model, at ElevenLabs in the United States, and the processors that touch content for a moment are named above with their countries.

Does GDPR mean my data has to stay in Europe?

No. That is the most common misunderstanding on this subject. The GDPR permits transfers outside the EEA under Articles 44 to 49, so a compliant service can still store your recordings in the United States. EU residency is a separate, additional commitment.

Who can access my recordings?

The people you give a key to, once the archive is released; the founding team, only when you ask us to look at your own account, and every such access is logged by the storage provider; and the processors named above, each for the length of the job it does.

Is MemoriesBox ISO 27001 or SOC 2 certified?

No. We hold neither, and we do not imply otherwise. Two products in the adjacent market do publish certifications: Memory Murals and Avataari.

What happens to the data if the company is sold or fails?

It stays subject to the GDPR, including purpose limitation under Article 5(1)(b) and the transfer restrictions in Articles 44 to 49. What that does and does not protect is set out in full on /trust/what-happens-if-we-shut-down.

---

Related: Take everything with you · How the voice clone is built · Every other way to keep a voice · Is voice cloning legal in Europe

If this is the page that decided it for you, start here. $139 a year, first 14 days free, cancel anytime.