If your AI notetaker, sales-call recorder or interview tool sends a bot into Teams, Zoom or Meet through Skribby, the company holding those transcripts now belongs to a Utah carrier-software platform. Nothing in Skribby's published contract required anyone to ask you. Its terms let it assign the agreement to anyone, its data processing agreement gives you a right to object to new sub-processors but names no remedy, its transcripts are kept for the life of the account, and whether your audio leaves Europe depends largely on a single model parameter. You have until the Q1 2027 integration to fix all four.
Alianza announced on September 10 that it acquired Skribby, a Belgian meeting-infrastructure API. Terms were not disclosed. The same release says "Skribby customers will continue to be served without interruption," which is true. It is also not the question a CISO or a data protection officer should be asking.
What Alianza Actually Bought
Alianza bought the software participant that sits inside other companies' meetings. A meeting-bot API is a service that sends a bot into a video call on another app's behalf, records the audio and returns a transcript. The app you signed with owns the user interface. The API underneath owns the capture.
Per the acquisition release, Skribby serves more than 200 "experience providers," 120 of them launched in the past three months, and its monthly revenue is up 327% since the start of 2026. It works across Microsoft Teams, Google Meet and Zoom, and offers 30+ transcription models from providers including OpenAI, xAI, Mistral and ElevenLabs in 130+ languages. Founder Pieter Jan Pollie joins Alianza to lead technology development. Channel Dive reports that Skribby was founded in May 2025, and that this is Alianza's second acquisition of 2026, after BroadSource in March.
The buyer is a different kind of company. Alianza was founded in 2009 in Pleasant Grove, Utah, and sells cloud communications to more than 1,000 service providers in over 80 countries. A day before the deal it launched Alianza Crux, a control plane that coordinates network, AI, applications, identity, consent and policy around a communications session. Crux is in controlled availability now, with broader commercial availability planned for H1 2027. Alianza expects Skribby's functionality to move into Crux in Q1 2027. HyperFRAME Research's Ron Westfall calls Crux "the missing orchestration layer" for carriers adding AI to calls.
CEO Brian Beutler put the thesis plainly, per Channel Dive: "Conversations are becoming the most valuable data layer in the AI economy." Take the strongest version of the other side seriously. Skribby is a processor, its DPA says it acts on the customer's documented instructions, and nothing Alianza has published says it intends to use customer transcripts for anything else. But when the acquirer tells you the asset is the data layer, you write the contract as if it believes that.
Why You Never Signed Anything With Skribby
Most enterprises exposed to this deal are a fourth party: you contracted with a notetaker, and the notetaker contracted with Skribby. Your only protection is whatever your vendor's DPA passes down, and that is where the GDPR mechanism does the work.
GDPR Article 28(2) says that under general written authorisation, a processor "shall inform the controller of any intended changes concerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to such changes." Skribby's DPA repeats that almost word for word: "We will inform you of any intended changes to sub-processors, giving you the opportunity to object." It sets no notice period. It does not say what happens if you object: no termination right, no refund, no deletion certificate. The sub-processor page itself does not say how changes are announced.
There is a subtler gap. The contracting entity on every Skribby document is PJP HOLDING BV in Harelbeke, Belgium. The release does not say whether Alianza bought the shares or the assets. If it bought the shares, the processor's name never changes and no sub-processor notice is ever triggered. The moment that matters is Q1 2027, when processing moves toward Crux and Alianza infrastructure may start appearing on that list. An objection right with no remedy is a right to send an email.
We saw the same pattern when Stripe bought OpenRouter: a product setting that looks like a data policy is not a contract term.
The Contract Moves Without Your Consent
Skribby can hand its agreement to someone else without asking you. Its terms of service, last updated July 21, 2026, say: "We may assign any or all of our rights and obligations to others at any time." Customers, by contrast, may not transfer an account. Changes to the terms take effect "upon posting or notifying you" by email. Liability is capped at what you paid in the six months before a claim, under Belgian law, with disputes going to the European Court of Arbitration in Brussels.
Put numbers on that cap. Skribby's pricing starts at $0.35 an hour for the bot, and bundled transcription runs $0.39 to $1.36 an hour. At a hypothetical 10,000 meeting-hours a month on OpenAI GPT-4o Transcribe at $0.71 an hour, you spend $7,100 a month, so your six-month cap is $42,600. That cap covers every sales call, board prep and candidate interview captured in the period.
The privacy policy adds that Skribby "may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition." None of this is unusual for a 16-month-old, usage-priced API. It becomes a problem when the API ends up inside a platform whose owner calls conversations a data layer.
Where the Audio Goes Depends on One Parameter
Your residency posture is set largely by the transcription_model string in the API call, not by Skribby being Belgian. The sub-processor list, updated August 12, 2026, names 13 transcription providers. Five are listed as United States only: Groq, ElevenLabs, Soniox, OpenAI and xAI. AssemblyAI is Ireland plus the US for realtime. Speechmatics is "Global (Azure)." The rest are European: Deepgram, Rev AI in Germany, Gladia and Mistral Voxtral in France, Google Cloud Speech-to-Text in the EU multi-region, and AWS Transcribe in Frankfurt.
Now look at the default a developer copies. The example on Skribby's documentation home page sets transcription_model: 'groq/whisper-large-v3-turbo', and on the pricing page that is the cheapest option at $0.39 an hour. Groq is one of the five US-located sub-processors. A team that shipped the quickstart sent its meeting audio to the United States without making a decision.
The platform layer doesn't settle it either. Skribby's regions guide makes Europe the default region, with an isolated Japan region, and says bots, transcripts and recordings stay in the region where they were created. But the sub-processor list puts AWS hosting and storage in Ireland while listing AWS bot instances in the "United States & Japan (bot instances, by meeting region)," and transcription still goes to whichever provider the model string names. For cross-border transfers, the DPA promises only "appropriate safeguards (e.g., Standard Contractual Clauses)." If you have already worked through a sovereignty scorecard for Mistral, apply the same test here: residency is a pinned configuration plus a clause, not a flag of origin.
Fixing it costs little. Deepgram Nova-2, EU-located, is $0.61 an hour against $0.39 for Groq. At 10,000 hours a month that is $2,200 more, cheap next to a transfer impact assessment you would otherwise need to write.
The Audio Expires. The Transcript Doesn't.
Skribby's short retention window covers the recording, not the text. Per the privacy policy, audio is kept for one week by default, with a one-year option. Transcripts are kept "as long as you have an account with us, unless you request deletion." Debugging data is held for 30 days "regardless of other deletion requests." The DPA says transcripts are kept for the duration of the service agreement and deleted or returned at termination.
So the durable asset from a year of meetings is the transcript. That is exactly the "data layer" the acquirer's CEO described. The API reference says DELETE /bot/{id} deletes "all data related to the bot, including transcription and recording," but the 30-day debugging copy is kept regardless of deletion requests. Get what that copy contains answered in writing. The last time a small AI vendor changed hands quietly, customers learned five months late, and by then the deletion window was the only lever left.
Consent Liability Stays With You
Whoever owns the bot, the legal exposure of recording people stays with the app and its enterprise customer. Skribby's terms put compliance on the customer and bar using the service "to record or transcribe content for illegal surveillance."
The notetaker market has already been sued over this. In re Otter.AI Privacy Litigation began as Brewer v. Otter.ai, filed August 15, 2025, in the Northern District of California and consolidated on October 22, 2025. It alleges that Otter's bot recorded participants who were not Otter users without their consent, captured voiceprints and used the data to train speech models, under the federal Electronic Communications Privacy Act, the California Invasion of Privacy Act and Illinois' biometric privacy law. On August 13, 2026, Judge Eumi K. Lee let those three claims proceed, ruling the plaintiffs had plausibly alleged that Otter "independently collects, retains, and uses communications for its own commercial purposes," which makes it a third-party eavesdropper rather than the host's recording tool. For a processor, that is the line a new owner's plans for the transcripts would have to stay behind. Crux advertises trust and consent controls, but Skribby's integration into it is a Q1 2027 plan, not a control you have today. The NHS scribe review showed the other half of the risk: even with consent handled, what the transcript says is still yours to check.
Exit options exist. Recall.ai's quickstart documents regions including eu-central-1, and its product page claims SOC 2, ISO 27001, HIPAA, GDPR and CCPA. Skribby's own February comparison prices Recall.ai at $0.50 an hour against its own $0.35. It also lists Vexa, an Apache 2.0 self-hosted option it described as Google Meet only; Vexa's repository now lists Meet, Teams and Zoom. Skribby's homepage describes the service as "GDPR-compliant" and names no SOC 2 or ISO 27001 attestation.
What to Do Before the Q1 2027 Integration
The deal is done. What you can still control is configuration, retention and paper, and all three are cheaper to fix now than after Crux ships.
This Week:
- Find the fourth party. Send every notetaker, call-intelligence and interview-recording vendor one written question: does any meeting capture or transcription run through Skribby or PJP HOLDING BV? Check their sub-processor lists for both names.
- If you build on Skribby, grep your code for
platform.skribby.ioandtranscription_model. List every model in use and flag Groq, ElevenLabs, Soniox, OpenAI and xAI. - Ask the deletion question in writing: does the 30-day debugging copy, kept regardless of deletion requests, contain transcript text?
This Month:
- Pin an EU-located model (Deepgram, Gladia, Mistral Voxtral, AWS Transcribe Frankfurt or Google Cloud's EU multi-region) wherever residency matters, and add a CI check that fails on any of the five US-only strings.
- Cap transcript retention. Set a deletion schedule in days, run it through the API, and require your notetaker vendor to do the same.
- Paper the objection right. Add a DPA addendum with a 30-day notice for any sub-processor change, including any Alianza affiliate, plus termination without penalty, an export, and a deletion certificate if you object. Our AI vendor security review has the sub-processor questions to reuse.
Before Renewal or Q1 2027, Whichever Comes First:
- Get a written statement on which Alianza entities will process customer data after the Crux integration, and whether customer transcripts will feed Crux features or model training.
- Price the exit. Run a two-week parallel capture on an alternative with a documented EU region, so leaving is a configuration change rather than a project. The Bending Spoons–Miro timeline is a reminder that ownership changes move faster than procurement.
The Bottom Line
For decades, recording a business phone call meant a carrier, a statute and a consent script. The AI notetaker went around all three by putting a bot inside the meeting app. This deal brings a carrier-software company back in, this time as the owner of the bot rather than the operator of the line, while the contract you actually signed is two layers removed from both.
None of this means Alianza will misuse anything, and Skribby's customers have been told service continues. But a change of owner is when default terms stop being hypothetical: the assignment clause now sits with a new owner, the privacy policy's transfer paragraph covers exactly this kind of deal, and the cheapest transcription model is still a US endpoint.
The bot still joins the call under the same name. Its owner doesn't. Rewrite the paperwork as if that matters, because the new owner already says it does.
Continue Reading
- Stripe Bought OpenRouter. A Toggle Is Not a Contract.
- AI Vendor Security Review: 6 Questions That Change the Answer
- Samsung Led Mistral's Round. Score the Clauses, Not the Flag.
- Your AI Vendor Joined OpenAI in March. You Heard in August.
- 7 OpenAI Alternatives. Only 3 Clear a Sovereignty Rule.
- Bending Spoons Closed Airtable in 31 Days. Miro Says Q4.