Built for Norwegian regulation and EEA residency
We sell to Norwegian public bodies and to regulated finance. telkit signs an Article 28 processing agreement with every customer, pins media to Frankfurt, and names every sub-processor on this page. Where a limit exists, you will find it here too.
Your content stays inside the EEA
Audio, recordings, transcripts and message bodies sit on Hetzner hardware in Finland (Helsinki) and Germany (Falkenstein, Nuremberg). The media plane is contractually pinned to eu-central (Frankfurt), and speech-to-text runs against EU endpoints. Should data ever have to leave the EEA, EU Standard Contractual Clauses cover it.
Content inside the EEA
Audio, recordings, transcripts and message bodies live in EU S3 and are processed on EU infrastructure. Media URLs are never written to the database. We keep the storage key and sign a URL at the moment somebody reads the file.
Speech-to-text on EU endpoints
Transcription runs against our sub-processors' European endpoints, and the recording and the transcript both stay in the EEA. The sub-processor list further down this page says who handles what.
The media plane is pinned to Frankfurt
Voice calls run over a media plane that is contractually pinned to eu-central. Transport, signalling and session metadata stay in the region, and recordings go straight into our EEA storage.
Data physically in Norway takes an Enterprise deployment
Hetzner runs no region in Norway, so our default residency is Finland and Germany. If your organisation needs the data to stay inside Norwegian borders, we solve that on a dedicated Enterprise deployment in a Norwegian datacenter. On the standard tier the promise is the EEA, and that is the whole promise.
telkit is the processor, you are the controller
The data and the purpose are yours. We handle it on your behalf. That split decides who can order an erasure, and who has to answer when a data subject asks for access.
A DPA per customer
Every customer signs a data processing agreement under GDPR Article 28 before production use. Ask for the draft during the conversation and we will send it to your legal team.
Processing on documented instructions
We process personal data on your documented instructions and on the API calls your code actually makes. Your content is never resold and never used to train models.
Consent for call recording
The Norwegian DPA treats both the content of a call and the voice itself as personal data, and businesses generally have to ask before recording customer calls. telkit gives you announcements, a beep and per-number consent config. The duty to obtain that consent stays with you.
Breach notification
If a breach happens we notify you along an agreed path, and you get the logs and the trail your own 72-hour deadline to Datatilsynet requires.
The whole chain, public and current
We do not process everything ourselves. Carriers, SMS aggregators and media infrastructure are sub-processors, and you have a right to know who they are. The list is an annex to the processing agreement.
- DIDWWVoice / PSTN carrier
- TelnyxVoice / SMS (secondary)
- SveveSMS (Norway)
- LiveKit CloudMedia plane, pinned to eu-central (Frankfurt)
- DeepgramSpeech-to-text (EU endpoint)
- HetznerStorage (EEA)
- Mistral (La Plateforme)Summaries (EU)
Every sub-processor is bound to data-processing terms equivalent to yours. We notify you before a new one is brought into use, so you have time to object.
One verified identity, reused across every number
A Norwegian number cannot be activated until the business identity behind it has been verified. telkit collects the documents into one RegulatoryBundle, and that bundle is reused every time you order another number.
RegulatoryBundle: what a Norwegian local number requires
Organisation number
A registered Norwegian company, validated against the Brønnøysund Register.
Certificate of registration (firmaattest)
A recent certificate confirming the company and its authorised signatory.
Representative with passport or ID
Identification for the person acting on behalf of the company.
Norwegian street address
A real Norwegian business address. A PO box does not qualify.
Proof of address under 3 months
A recent document confirming the address, such as an invoice or a bank statement.
The end user needs a presence in Norway. Nummerforskriften § 16 puts it plainly: allocated numbers may not be offered for permanent use outside Norway without permission from Nkom. Documents are stored and verified before the number goes live. Toll-free numbers may rest on a personal identity.
Telephony is regulated, and we spell out the limits
telkit has notified Nkom, the Norwegian communications authority, as a provider of electronic communications, and sources numbers from carriers instead of operating its own Nkom ranges. Two duties follow from that, and both are visible in the product: number porting and emergency calling.
Porting through NRDB
An end user may keep their number. The receiving provider collects a written LOA, the donor ports by the end of the next working day, and the end user pays nothing for the port. It all runs through NRDB and surfaces as number.port.* events.
Emergency calls (112 / 110 / 113)
Until full 112 routing with identity and location injection is built, we scope telkit as a service that does not replace ordinary telephony. Ekomforskriften requires such a limitation to be disclosed. We disclose it in the terms, and you have to make sure your end users know about it.
On top of that: authorised caller ID only, an acceptable-use policy enforced against spam, fraud and auto-dialing, and per-account rate limits. Under markedsføringsloven § 15, marketing by SMS requires prior consent.
Configurable retention, statutory where the law says so
You decide how long recordings and transcripts are kept. Some telecom data still cannot be erased on request until its statutory retention period runs out, and the processing agreement spells out how that is handled.
Erasure against statutory retention
Recordings and transcripts have customer-configurable retention and are erased on request. CDRs, KYC documentation and other data under statutory retention cannot be erased before the period expires. The processing agreement reconciles the GDPR right to erasure with the retention duty in the Norwegian e-comms act.
AES-256 at rest
Recordings, transcripts and message bodies are encrypted with AES-256 wherever they are stored.
TLS 1.3 in transit
API and webhook traffic runs over TLS 1.3. Webhooks carry an Ed25519 signature on top.
RBAC and MFA
Role-based access control per tenant, and enforced two-factor sign-in for the console.
Audit logging
Access and changes are logged with timestamps, which gives you the trail your own compliance and incident handling needs.
As a notified provider we keep maturing toward NIS2 and lawful-interception readiness.
Compliance, short and precise
The four questions procurement and legal ask us first.
Need the details? Talk to our team.
Does your legal team need a processing agreement?
Ask for the draft and the sub-processor list, or talk through residency, KYC and a public-sector setup.