EU-Sovereign Voice-Agent Infrastructure
The phone gets answered.
Legal signs off.
Recitna runs AI phone agents for regulated Europe: they answer every call, book appointments, and escalate emergencies, in the caller's language. And every call issues a signed credential stating where each layer processed it, which sub-processors touched it, and what was retained — the artifact that turns your DPO's "prove it" into a one-minute check against our published key.
Deployed and proven end to end · verify a real call credential belowsovereign-stack call 2026-07-23 · verifies against the published key
The Proof
A real call on the deployed sovereign stack. Every layer in the EU. Check it yourself.
On 23 July 2026 our deployed sovereign stack carried a Croatian call over live production media and completed a booking end to end. Speech recognition and the language model ran inside hardware-attested trusted execution environments in the EU. The voice was synthesized by our own trained model on our own EU worker. No external speech or language provider outside an attested EU TEE touched call content. Stated plainly: the caller on this call was our scripted test driver speaking synthesized Croatian — a full-dress rehearsal on the real production infrastructure, not a customer conversation. The credential below is what that call issued; the infrastructure it attests is exactly what a customer call flow runs on.
curl -O https://recitna.com/auditor-pack/credential_zero_us_subprocessors.json
curl -O https://recitna.com/verify_recitna.py
curl -O https://recitna.com/approved_posture.example.json
pip install cryptography
python verify_recitna.py credential_zero_us_subprocessors.json --expect approved_posture.example.json
VALID: signature verifies against the published key (recitna-key-1)
POSTURE: conforms to the approved posture (approved_posture.example.json)
residency: {"llm": "attested-tee-eu", "media": "eu-livekit", "storage": "eu",
"stt": "attested-tee-eu", "tts": "eu-self-hosted"}
sub-processors (2):
- edgeless-privatemode role=llm region=eu posture=attested-tee
- livekit role=media region=eu posture=scc
non-EU sub-processors: NONE
The verifier is ~100 lines you can read. It checks the Ed25519 signature over the canonical credential bytes against our published key registry; change any byte and it fails. Be precise about what that proves: not that the claims inside are true, but that this record is exactly what we issued and that we can never deny issuing it. Every claim we sign is permanent and attributable, so a false claim would become durable evidence against us. The attestation layer carries its own hardware trust root, bounded honestly below. The real job is the last command: pin the posture your DPIA approved, and every future call either conforms or fails the check. A sub-processor swap, a region move, a layer quietly losing its attested posture: the drift that annual paperwork never catches becomes a per-call alarm your own tooling runs.
Per-Layer Honesty
The credential states what is proven, and names what is not.
An "EU region" checkbox tells your DPO almost nothing. This table is what we hand them instead: every hop enumerated with its true posture. Where a layer is attested, the credential binds the call to a debug-off TEE measurement. Where a vendor is a US company operating in an EU region under Standard Contractual Clauses, the credential says exactly that instead of hiding it. Auditors trust documents that show their own limits.
| Layer | Posture on the proven call | Detail |
|---|---|---|
| Speech-to-text | attested TEE, EU | Whisper inside an AMD SEV-SNP confidential-computing environment (Germany). Fail-closed: if attestation does not verify, audio never leaves. |
| Language model | attested TEE, EU | Open-weights model in the same attested environment. The credential records the TEE measurement, debug-off, and the manifest digest. |
| Text-to-speech | self-hosted, EU | Our own trained voice model, synthesized on our EU worker. No external TTS provider sees call content. |
| Media transport | EU region, US vendor, SCC | EU-region media plane operated by a US company under SCC. Named plainly as a sub-processor; swappable to EU-owned infrastructure as a hardening step. |
| Storage | EU-resident | 90-day purge and GDPR right-to-erasure, built in and tested (erasure reaches every phone-number format variant). |
Attestation scope, stated honestly: the credential proves our attested open-source proxy recorded this TEE measurement with debug disabled. It is not an independent re-verification of the hardware report; that is the self-hosted roadmap step. The caller also hears an audible "you are speaking with an AI" disclosure at call start (EU AI Act, Article 50).
The Engagement
The Sovereign Voice Pilot
This is not self-serve SaaS, by design. It is a white-glove, fixed-scope engagement: you bring one call flow that matters (reception, booking, intake, triage), we deliver it running on sovereign infrastructure, on a real number, with the auditor pack your DPO can independently verify. You walk out of the pilot with a working agent and a compliance file, not a vendor promise.
Included
- One call flow, one language, scoped together in a working session. Proven end to end in Croatian — a small, low-resource language most voice stacks handle worst. If it holds there, your language is a scoping question, not a research question; we scope it honestly in the pilot.
- Sovereign deployment: attested TEE speech recognition and language model, EU media, EU storage, AI-Act disclosure spoken on every call.
- Per-call signed credentials plus the rendered compliance report: the pack you hand to your DPO, auditor, or procurement.
- Posture pinning: we pin the topology your DPIA approved; from then on every call's credential either conforms or your own tooling raises a per-call drift alarm. No silent sub-processor changes, ever.
- Deterministic action rails for the moves that must never go wrong (bookings fire only on confirmed offered slots; danger cues force-escalate to a human).
- Runs in parallel with whatever answers your phones today. Nothing is ripped out.
Not included, on purpose
- A dashboard-first SaaS. The pilot is operated for you; the product hardens around paying use, not ahead of it.
- On-premise deployment in your data center. That exists as an enterprise engagement on your GPUs, scoped after a pilot, priced separately.
- Every language and every integration on day one. One flow, done properly, verified. Then we extend.
Bring the call flow that matters and whatever is blocking it — a stalled DPIA, a procurement questionnaire, a skeptical DPO. Forward them the verification above; their objections are the most useful thing you can bring to a first conversation.
The guarantees
Audit-ready, or we keep working, free: if your DPO or auditor finds the pack short of audit-ready, we keep working at no additional charge until they sign off. You can leave at any time and take your data with you under right-to-erasure. And the receipts are cryptographic: if any credential we issue for your calls fails to verify against our published key, the pilot is free. You are not trusting our word at any point in this engagement; that is the entire idea.
Who This Is For
Built for the buyer whose project is stuck.
Your DPIA blocked the voice-AI vendor
Legal flagged US sub-processors in the audio path and the project stalled. A per-call credential with attested EU processing is the unblock document.
You sell into regulated buyers
Healthcare, insurance, finance, legal, public sector. Your customers ask where the audio goes. Hand them an artifact their own auditor can check, and that question stops costing you deals.
AI Act obligations landed on your desk
Article 50 disclosure is spoken on every call, in the caller's language, by default. GDPR Art. 28 and 32 posture is enumerated per call, not asserted annually.
You need evidence your reviewers can run
A cryptographic receipt per call, a tamper test you can run in your own browser, a posture pin your tooling checks on every call, and a report your DPO can file with the DPIA. Evidence reviewers can execute, not claims they must weigh.