Is AI Translation Secure? Data Privacy in Translated Calls
AI translation is secure when the provider encrypts audio in transit, processes it without keeping recordings, never trains models on your words, and signs a data processing agreement that names its sub-processors. Free consumer tools that store what you type or say are where most confidentiality failures happen.
That answer sounds simple, but most teams never check any of those four points. They open a free translator in a browser tab, paste a contract clause or switch on live captions, and assume the words vanish afterwards. Sometimes they do. Sometimes they sit on a server in another jurisdiction for years. This guide follows your words through a translated call, step by step, and shows you what to ask before a confidential conversation runs through AI translation.
Table of Contents
- Where Your Words Go During a Translated Call
- Why End-to-End Encryption and Live AI Translation Rarely Coexist
- Five Ways Translated Conversations Leak
- AI Translation Privacy Compared: Five Options
- What GDPR, HIPAA and the EU AI Act Expect
- 10 Questions to Ask Before You Translate a Confidential Call
- How Meeyra Handles Translated Audio
- When a Human Interpreter Is Still the Safer Choice
- Frequently Asked Questions
Where Your Words Go During a Translated Call
Live AI translation is not one step. It is a chain of four or five systems, and each one sees your conversation in a different form. Security depends on the weakest link, so you need to know every stage.
Here is the typical data flow in a cloud-based translated meeting:
- Capture. Your microphone records audio on your own device.
- Transport. The audio travels over an encrypted connection to the platform's media servers.
- Speech recognition. A speech-to-text model turns short audio segments into written sentences.
- Machine translation. A translation model converts each sentence into the listener's language.
- Output. The listener receives captions, a synthetic voice, or both.
- Storage. Some platforms keep transcripts, translations, summaries or logs after the call.
| Stage | What is processed | Who usually handles it | Main risk | Question to ask |
|---|---|---|---|---|
| Capture | Raw audio | Your device and browser | Malware, open microphone | Is the app running in a supported, updated browser? |
| Transport | Encrypted audio packets | Platform media servers | Interception on weak connections | Is media encrypted in transit (DTLS-SRTP or TLS)? |
| Speech recognition | Audio segments | Platform or an AI sub-processor | Audio retained for "quality" | Is audio deleted right after processing? |
| Machine translation | Plain text | Platform or an AI sub-processor | Text logged or used for training | Is customer content excluded from training? |
| Output | Captions, synthetic voice | Platform, sometimes a voice sub-processor | Captions reaching the wrong participant | Who can see which captions? |
| Storage | Transcripts, summaries | Platform database | Long retention, broad internal access | How long are transcripts kept, and who can delete them? |
The table shows something most product pages skip. Speech recognition and translation need readable audio and text. At stages three to five, some system must see your words in plain form. Encryption protects the trip between systems, not the moment of translation itself.
Why End-to-End Encryption and Live AI Translation Rarely Coexist
End-to-end encryption means only the participants hold the keys. The server forwards encrypted media it cannot read. That is excellent for privacy, and it is also why server-side AI translation cannot run on a truly end-to-end encrypted stream. A server that cannot hear the audio cannot transcribe or translate it. Our explainer on end-to-end encryption in video calls covers the mechanics in detail.
In practice, you have three architectures to choose from:
- Cloud translation over encrypted transport. Audio is encrypted on the way to the platform, decrypted for processing, then discarded or stored according to policy. This is how most live meeting translation works, including Meeyra.
- On-device translation. The model runs on your phone or laptop, so audio never leaves the device. It works with end-to-end encryption, but language coverage, accuracy and battery life usually suffer.
- End-to-end encryption without translation. Maximum confidentiality, but nobody gets captions or translated audio.
Five Ways Translated Conversations Leak
Encryption failures are rare. Most real incidents come from policy and habit: what the provider keeps, what it reuses, and what your own staff paste into free tools.
1. Retention You Did Not Expect
In 2017, Norwegian broadcaster NRK found that internal documents from the energy company Statoil were publicly searchable online. Employees had used the free website Translate.com, which kept uploaded texts, and some of them were indexed by search engines. Nextgov reported that the material included contracts and dismissal letters, and that the Oslo Stock Exchange blocked staff access to online translators afterwards. Statoil said no sensitive material leaked, but the lesson stuck: "free" often means "stored".
2. Your Words Become Training Data
Some services improve their models with customer input. Germany's data protection authorities address this directly in their 2024 guidance on AI and data protection. They advise checking whether inputs and outputs feed training, and they state that applications which do not use them for training are preferable from a data protection perspective. In the US, the American Bar Association's Formal Opinion 512 (July 2024) says lawyers need a client's informed consent before entering client information into a self-learning AI tool that could disclose it later.
3. Sub-Processors and Cross-Border Transfers
Many translation features run on third-party AI infrastructure. Each provider in the chain is a sub-processor, and each may sit in a different country. The German guidance warns that open, cloud-hosted AI systems often involve transfers to third countries, which must meet the rules in Chapter V of the GDPR. For EU-to-US transfers, the EU-US Data Privacy Framework survived its first court challenge in September 2025 (General Court, case T-553/23). An appeal is pending before the Court of Justice (C-703/25 P), so keep an eye on it.
4. Shadow AI: Staff Using Unapproved Tools
The biggest risk is often inside your own company. In 2023, Samsung restricted generative AI tools on company devices after engineers uploaded internal source code to a chatbot, as Bangkok Post reported from Bloomberg. Cisco's 2025 Data Privacy Benchmark Study of 2,600 privacy and security professionals found that 64% worry about sharing sensitive information by accident. Yet nearly half admitted to entering personal employee data or non-public company data into generative AI tools.
The cost of weak AI governance is also visible in breach data. IBM's 2026 breach research found that more than 20% of organizations reported a breach targeting AI models or applications. Only 37% of breached organizations encrypt sensitive data both at rest and in transit.
5. Voice Carries More Than Words
A translated call sends your voice, not just your sentences. The European Data Protection Board's guidelines on virtual voice assistants note that voice data carries personal information in its content and in its meta-information, such as a speaker's sex or age. The Board calls voice data "inherently biometric personal data". When voice is used to identify someone, or when the conversation reveals health or other special-category data, Article 9 of the GDPR applies.
AI Translation Privacy Compared: Five Options
Not every translation option carries the same risk. The table below compares the five setups teams use most, based on how each one typically works. Always confirm the exact terms for the product and plan you use, because consumer and business tiers from the same company often follow different rules.
| Option | Where your words are processed | Kept after use? | Used for training? | Contract you get | Best fit |
|---|---|---|---|---|---|
| Free consumer translator (website or app) | Provider cloud, location often unstated | Often logged; check the terms | Sometimes, unless you opt out | Consumer terms only | Menus, signs, public text |
| Business translation API or enterprise plan | Provider cloud, region often selectable | Usually short or configurable | Usually excluded by contract | Data processing agreement | Documents, internal workflows |
| Meeting platform with built-in AI translation | Platform servers plus AI sub-processors | Audio usually discarded; transcripts may be kept | Depends on the platform's terms | Platform DPA covering sub-processors | Live multilingual meetings |
| On-device translation | Your own device | Stays on the device | No, if fully offline | None needed | Travel, very sensitive one-to-one talks |
| Professional human interpreter | The interpreter, plus the call platform | Interpreter notes; policy varies | No | Engagement contract with confidentiality clause | Legal, medical, high-stakes negotiations |
Two patterns stand out. First, the contract matters more than the technology. A business plan with a data processing agreement and a no-training clause is safer than the same model used through a consumer app. Second, a meeting platform with built-in translation keeps the whole chain under one agreement. That is easier to audit than a meeting tool plus a separate translator plus a separate note-taker.
What GDPR, HIPAA and the EU AI Act Expect
AI translation privacy is not only good practice. In many settings it is a legal requirement. Here are the rules you will meet most often.
GDPR in the EU and UK
- Processor contract. Article 28 requires a written agreement with any provider that processes personal data for you. The provider also needs your authorization before it engages sub-processors.
- Special categories. Article 9 restricts processing of health, biometric and similar data. A doctor's consultation through AI translation falls squarely here.
- Impact assessment. Article 35 requires a data protection impact assessment for high-risk processing, such as routine translation of patient or employee conversations.
- Transfers. Data leaving the EU needs an adequacy decision or safeguards. The European Commission keeps the current adequacy list.
HIPAA in US Healthcare
If a translation vendor creates, receives, keeps or transmits protected health information for a covered entity, it acts as a business associate. HIPAA then requires a business associate agreement under 45 CFR 164.502(e) and 164.504(e). A free consumer translator will not sign one, so it has no place in a patient conversation.
The EU AI Act
Article 50 of the EU AI Act has applied since 2 August 2026. People must be told when they interact directly with an AI system, unless that is obvious. Providers of systems that generate synthetic audio must also mark the output as artificially generated. That can cover a synthetic voice that reads out a translation. Under the Digital Omnibus, systems already on the market before August 2026 have until 2 December 2026 for the marking duty.
10 Questions to Ask Before You Translate a Confidential Call
Use this checklist when you evaluate any AI translation tool for meetings. Send the questions to the vendor in writing and keep the answers with your records of processing.
| # | Question | Good answer | Red flag |
|---|---|---|---|
| 1 | Is audio encrypted in transit? | Yes, DTLS-SRTP or TLS on every connection | "We use secure servers" with no detail |
| 2 | Is audio stored after translation? | No, deleted right after processing | Kept "to improve quality" |
| 3 | Are transcripts stored, and where? | Yes or no, with location and retention | No clear answer |
| 4 | Is our content used to train models? | No, by contract | Opt-out buried in settings |
| 5 | Which sub-processors handle audio and text? | Listed in the DPA or privacy policy | "Trusted partners" without names |
| 6 | Where are they located? | Named countries plus transfer safeguards | Unknown |
| 7 | Can a host turn translation off for a participant? | Yes, from inside the meeting | Translation is all or nothing |
| 8 | Can we delete transcripts and meeting history? | Yes, on request or in settings | Only by closing the account, or not at all |
| 9 | Will you sign a DPA, or a BAA for health data? | Yes, a DPA for every customer, a BAA where offered | Consumer terms only |
| 10 | Is the AI disclosed to participants? | Clear in-meeting indication | Participants are not told |
For the wider meeting setup, pair this list with our video conferencing security checklist. Translation is one control among fifteen, not a replacement for passwords, host controls or access rules.
How Meeyra Handles Translated Audio
Here is how translation works in Meeyra, described plainly so you can map it to the questions above.
- Encrypted in transit. Meeting audio and video travel over encrypted WebRTC connections (DTLS-SRTP) between your browser and Meeyra's servers. Meeyra does not claim strict end-to-end encryption for translated meetings, because the server must process audio to translate it.
- Translation inside the meeting. Meeyra's translation process runs within the meeting itself. It is not a separate bot you invite from another app.
- Short segments, no stored audio. Speech is cut into short segments and sent to AI sub-processors for speech recognition and translation. Temporary audio files are deleted as soon as each segment is processed, and Meeyra does not store recordings of your voice.
- Captions only where needed. Translated captions go to listeners who chose a different language. A synthetic voice is optional for each listener.
- Transcripts you control. When translation is on, Meeyra saves a text transcript of the original sentences and their translations to the meeting record. On plans that include transcripts, you can review it and an AI summary in your dashboard afterwards. You can request deletion of your account and meeting history at any time.
- Host controls. The host can turn translation, microphone, camera, chat and screen sharing on or off for each participant.
When a Human Interpreter Is Still the Safer Choice
AI translation handles most business meetings well, but some conversations deserve a person. Choose a professional interpreter when a single mistranslated sentence could change a legal outcome, a diagnosis or a large contract. Choose one too when the law or your professional rules require a named, accountable human, for example in court hearings or certain medical settings.
Many teams now run a hybrid model. AI translation covers weekly syncs, sales calls and support conversations. A human interpreter joins the few meetings where privilege or patient safety is at stake. If you are still choosing a tool for the everyday part, our guide to the AI translator for meetings compares the options. Our article on AI meeting transcription covers the storage side in more depth.
Frequently Asked Questions
Is AI translation safe for confidential business meetings?
Yes, if the tool encrypts audio in transit, deletes audio after processing, excludes your content from model training and signs a data processing agreement. Free consumer translators rarely meet all four conditions, so keep them away from confidential material.
Do AI translators store what I say?
It depends on the provider. Some discard audio right after processing, some keep text transcripts for review, and some consumer services log inputs. Check the privacy policy for retention periods and for whether transcripts are stored.
Can AI translation be end-to-end encrypted?
Only if translation runs on your own device. Server-side AI translation needs to process readable audio, so the platform decrypts it for processing. The honest standard for cloud translation is encryption in transit plus no stored audio.
Is voice data biometric under GDPR?
The European Data Protection Board describes voice data as inherently biometric. When voice is processed to identify a person, or when the conversation reveals health or other special-category data, Article 9 GDPR applies and needs a specific legal basis.
Do I need a BAA for AI translation in healthcare?
Yes, in the United States. Any vendor that handles protected health information for a covered entity is a business associate, and HIPAA requires a signed business associate agreement before the vendor touches patient data.
What is the safest way to translate a sensitive call?
Use a meeting platform with built-in translation under one data processing agreement, turn translation on only for participants who need it, and delete transcripts you no longer need. For legal privilege or medical diagnosis, add a professional interpreter.
Does Meeyra use my calls to train AI models?
No. Meeyra's privacy policy states that voice data is used only to provide real-time translation, and AI sub-processors may not use it for any other purpose. Meeyra does not store audio recordings of your voice.
AI translation is now good enough for most international meetings. Whether it is secure enough depends far less on the model than on the contract, the data flow and the habits of the people using it. Ask the ten questions, write the answers down, and match the tool to the sensitivity of each conversation.
If you want to see how a translated call behaves before you roll it out, create a free Meeyra account. New accounts include 60 minutes of AI translation to test with a real colleague, and the pricing page shows which plans include transcripts and summaries.