Who processes your data
Every outside company involved in Musta, what it receives, and where it runs.
Last updated 2026-09-09 · Questions: meet@musta.ai
The short version
11 companies are in the meeting-data path — 4 in the EU, 5 in the United States, and 2 inside your own tenant, where we hold no copy. A further 4 are listed at the end and cannot be reached from the meeting product; they are named so this page can be checked against our whole codebase rather than only the flattering part.
How this page stays true
It is generated from our source code, not written by hand. An earlier version was maintained by a person and drifted: it named tools we had stopped using, gave the wrong region for our database, and missed a company that had been in the audio path for nine days.
So the mechanism is a test rather than a habit. Our build fails if our software contacts a company this page does not name. A new sub-processor cannot reach production without appearing here first.
Notice before we change it. We will tell you before a new company joins this list where your agreement with us requires it. If you would like to be told regardless, write to meet@musta.ai and we will add you.
Core — the product does not run without these
Each one receives meeting content in the ordinary course of the product working.
| Company | Where it runs | What it receives |
|---|---|---|
| Supabase | EU | Datastore, auth and object storage. The system of record. |
| Vercel | EU | Hosting and serverless execution. Nothing retained beyond logs. |
| Anthropic | United States | Model inference: briefs, synthesis, answers, document extraction. |
| ElevenLabs | United States | Speech-to-text for the in-room microphone, and narration. |
| Voyage AI | United States | Embeddings and search reranking over uploaded documents. |
| Postmark | United States | Transactional email: briefs, recaps, sign-in links. |
Notetaker — only when a meeting is recorded
Reached only when someone turns the notetaker on. No bot joins a meeting by default, and an organisation-level switch overrules every host.
| Company | Where it runs | What it receives |
|---|---|---|
| Recall.ai | EU | Sends the notetaker, records the meeting, and transcribes it. |
| Svix | EU | Delivers Recall's status webhooks. Carries no meeting content. |
Your own tenant — we hold no copy
Connected with your own credentials, under your own agreement with that provider. We read meeting times, titles and who is invited.
| Company | Where it runs | What it receives |
|---|---|---|
| Google Workspace | Your own tenant | Calendar read, and event creation when explicitly enabled. |
| Microsoft 365 / Entra ID | Your own tenant | Calendar read and event creation via Graph. Sign-in via Entra ID. |
Operational — receives meeting data only incidentally
Reached when somebody reports a problem, not in the course of a meeting.
| Company | Where it runs | What it receives |
|---|---|---|
| Linear | United States | Issue tracking. Receives a bug reporter's own words and screenshot. |
Out of scope — our own commercial research
Listed for completeness and declared out of scope: these read public web sources for our own sales work. No meeting content, no participant and no uploaded document ever reaches them.
| Company | Where it runs | What it receives |
|---|---|---|
| Firecrawl | United States | Website scraping for sales research. No meeting content. |
| ScreenshotOne | United States | Renders prospect pages for sales briefs. No meeting content. |
| xAI | United States | Prospect and executive research. No meeting content. |
| Buzzabout.ai | United States | Public-discourse research. No meeting content. |
One company choosing another
The hardest kind of sub-processor to find is one we hold no account with and no credential for — a setting inside another company's product that selects a third. We never contact such a party directly, so neither a credential audit nor a network audit finds it. This is where we declare them.
Inside Recall.ai — which engine transcribes the meeting recording
Transcription is performed by Recall's own engine in its EU region (recallai_streaming) by default, so no further party receives the audio. Two facts must accompany that: bots created before 2026-09-08 used AssemblyAI, a US engine, and AssemblyAI remains selectable per deployment — so a deployment's actual provider is the thing to state, never the default alone.