AI Meeting Assistants & Notetakers
Sally
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Aliru GmbH · www.sally.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Sally at a glance
- Vendor
- Aliru GmbH
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Starting price
- “$0/ user / month $8/mo after 30-day trial; billed annually (excl. VAT)” (vendor’s words) source, captured 5 Nov 2026
- Panel verdict
- The AI panel rates Sally 3.5/5, the mean of 6 judges. Sally, an AI meeting assistant from Aliru GmbH of Mannheim, scores highest on consent and co-determination, data control and sovereignty, where scores cluster at 8-9, resting on a free nine-paragraph works-agreement template aligned with the DPA and TOMs citing § 87 (1) no. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 6 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Sally, an AI meeting assistant from Aliru GmbH of Mannheim, scores highest on consent and co-determination, data control and sovereignty, where scores cluster at 8-9, resting on a free nine-paragraph works-agreement template aligned with the DPA and TOMs citing § 87 (1) no. 6 BetrVG, a chat notice with an opt-out that immediately deletes captured data, per-workspace deletion rules carried into every backup the following night, deletion or return within 30 days of contract end, and hosting at Hetzner in Germany on the vendor's own language model. Its weakest cluster is summaries and knowledge at 6-7, with no public information on AI answers that cite the transcript passage they rest on, per-team templates or team libraries. Judges divide between 7 and 8 on capture and transcription over unpublished per-language accuracy, differing published language counts and phone capture sitting on the roadmap until December 2026, and between 8 and 9 on sovereignty, where the computed sovereignty attributes mark residency and the DPA as unknown next to the vendor's German-hosting statements and SOC 2 appears only as aligned.
Speaks for it
- A free nine-paragraph works-agreement template aligned with the DPA, the TOMs and the AI conformity declaration, citing § 87 (1) no. 6 BetrVG, anchors a strong consent package.
- Deletion is engineered rather than promised, with automatic rules per workspace for transcripts, recordings and summaries, deletions carried into every backup the following night, and deletion or return within 30 days of contract end confirmed in writing.
- Meeting content is hosted at Hetzner in Germany with the vendor's own language model on its own infrastructure, a published Art. 28 DPA signable online, and a named subprocessor list.
- Capture spans a bot on Teams, Zoom, Google Meet and Webex, botless Windows and macOS recorders, in-person recording and file upload, with dialect training and custom vocabulary.
- Integrations cover eight CRMs, calendars including on-premise Outlook and CalDAV, Zapier, Make, n8n and Power Automate, and a public API with webhooks and an MCP server.
Held against it
- No public information on AI answers that cite and link the transcript passage they rest on, on summary templates per meeting type, or on team libraries with permissions.
- Phone capture appears only as a roadmap item planned for December 2026, and accuracy is not published per language or capture method.
- The captured pages give different figures for the number of languages, 99+ and over 103, and for SOC 2, stated as certified on one page and as aligned on another.
- For in-person recordings and uploads the chat notice and opt-out are technically unavailable with consent documented by the recording person, the in-meeting notice can be set to Never, and consent is not logged per participant.
- A buyer cannot compute the full cost from public pages: monthly-billing rates, what counts as a seat and the price of the on-premise or own-LLM option are not public.
Best for
- You are rolling out an AI notetaker in a German company with a works council and need works-agreement material, notice and opt-out mechanics and an EU AI Act classification to negotiate from.
- You need meeting content hosted in Germany under a German contracting entity, with a published Art. 28 DPA and a named subprocessor list.
- Your team runs on Teams, Zoom, Google Meet or Webex alongside a CRM or project stack and wants summaries and tasks pushed into existing tools.
- You need centrally administered retention, deletion and audit logging rather than per-user manual cleanup.
Avoid if
- You need phone or dialer capture now — phone integration is listed as a roadmap item planned for December 2026.
- Your work centres on in-person recordings or uploaded files — the vendor states the chat notice and opt-out are technically unavailable there and consent must be documented by the recording person.
- Your procurement requires certified SOC 2 — the captured pages describe SOC 2 as aligned rather than certified, with one page giving a different figure.
The scores
| Criterion | Panel median |
|---|---|
| Recording, transcription & languages | 4 of 5 |
| Summaries, action items & meeting knowledge | 3 of 5 |
| Integrations, API & workflow | 4 of 5 |
| Consent, participant rights & works council | 4 of 5 |
| Retention, AI training & administration | 4 of 5 |
| European sovereignty | 4.5 of 5 |
Recording, transcription & languages
panel disagrees
Show reasoningHide reasoning
How this is scored
How the conversation gets in and how faithfully it is written down: a bot that joins Zoom, Microsoft Teams, Google Meet and Webex, botless capture from a desktop or mobile app, in-person meetings and phone calls, file upload, live transcription, speaker identification and names, the languages supported with German stated, meetings that switch language, custom vocabulary for names and jargon, timestamps linked to the recording, and editing of the transcript.
0 — Does not record or transcribe meetings; a note template or agenda tool without capture.
3 — A bot that joins one or two conferencing tools and produces a transcript; languages, speaker names, in-person capture and accuracy are basic or not described.
5 — A bot for Zoom, Teams and Google Meet, a desktop or mobile app for in-person meetings, file upload, speaker identification, German among the supported languages, timestamps linked to the recording, and an editable transcript.
8 — Botless capture documented next to the bot, Webex and phone or dialer calls, live transcription, mixed-language meetings handled, custom vocabulary, speaker names learned across meetings, and the transcription engine or its accuracy per language stated.
10 — Capture a regulated team relies on: every channel above with accuracy published per language and method, dialects and specialist vocabulary documented, on-device or customer-hosted transcription as an option, and how errors are corrected and fed back stated.
The Management Consultant
Sally covers every channel in my week: a visible bot for Teams, Zoom, Google Meet and Webex, Windows and macOS recorders that capture without a bot in the room, in-person recording via the app, and upload of audio and video files. Speaker labels, timestamps, an editable transcript, automatic language detection, mixed-language switching, dialect training and a custom vocabulary for names and jargon are documented, with transcription accuracy published as 98.8% and as 90.3% to 98.8% depending on the plan; phone or dialer calls appear only as a roadmap item planned for December 2026. 2 3 5 6 10 11 12
The Sales Team Lead
Sally joins as a bot on Teams, Zoom, Google Meet and Webex, and there are native Windows and macOS recorders for botless capture plus in-person recording through the app and file upload — every channel my discovery calls run on. Accuracy is published per plan, dialects and a custom vocabulary for names and jargon are documented, and meetings that switch language are transcribed passage by passage. Phone integration is planned for December 2026, and we found no public information on live transcription during the meeting or speaker names learned across meetings. 3 5 6 11 12
The Works Council Chair
A bot joins Teams, Zoom, Google Meet and Webex, Windows and macOS recorders capture meetings and calls locally with no bot, and in-person recording plus upload of many audio and video formats are documented alongside over a hundred languages with automatic detection, language switching within a meeting, dialect training, custom vocabulary, speaker labels, timestamps and an editable transcript. Accuracy is published as up to 90.3, 94.1 and 98.8 percent depending on plan, and an on-premises option with the vendor's own language model exists. We found no public information on accuracy per language, live transcription, or how transcription errors are corrected and fed back. 3 5 6 10 11 12
The Data Protection Officer
The bot joins Teams, Zoom, Google Meet and Webex, while Windows and macOS recorders shipped in September 2026 capture meetings and calls locally with no bot in the room, alongside in-person recording via the app and file upload in thirteen formats. Speaker labels, timestamps, editable transcripts, custom vocabulary, dialect handling and language switching within a meeting are documented, with German available as interface and summary language, though the captured pages give different figures for the number of languages (99+ versus 103) and for headline accuracy (98.8 percent versus up-to figures per plan). A phone-system integration is announced for December 2026, and we found no public information on accuracy per language or on how transcription errors are fed back. 2 5 6 10 11 12
The IT Lead
Sally joins Teams, Zoom, Google Meet and Webex as a visible bot, ships Windows and macOS recorders for botless capture, records in-person meetings and accepts twelve upload formats, with dialects, custom vocabulary, mixed-language handling, speaker labels and timestamps documented and accuracy published per plan. Phone integration is only on the roadmap (December 2026), and we found no public information on live transcription or accuracy per language, so I stop short of the top band. 2 5 10 11 12
The Skeptic
The intake is broad: a bot for Teams, Zoom, Google Meet and Webex, botless Windows and macOS recorders, in-person capture via app, file upload in twelve formats, speaker labels, timestamps and an editable transcript, plus custom vocabulary, dialect training, mixed-language handling and accuracy up to 98.8 percent with a stated basis of 28,000 analysed meetings. I hold back from the top band because accuracy is not published per language or capture method, the captured pages give different language counts of 99+ and over 103, phone calls appear only on the roadmap, and speaker names learned across meetings are not documented. 10 5 3 11 12 6
Summaries, action items & meeting knowledge
panel disagrees
Show reasoningHide reasoning
How this is scored
What the tool makes of the transcript: summaries and minutes by meeting type with editable templates, decisions and action items with owners and due dates, summaries in the meeting's language or a chosen one, follow-up emails, clips and highlights, search across all meetings, questions answered over the archive with citations back to the transcript passage, shared team folders or channels, and the minutes exported to Word, PDF or a wiki.
0 — No summaries of any kind; only the raw transcript or recording.
3 — One generic summary per meeting; templates, action items, search across meetings and citations are basic or not described.
5 — Summaries with templates per meeting type, action items and decisions extracted, the summary language selectable with German available, search across meetings, questions answered over one or several meetings, and sharing or export of the minutes.
8 — Custom templates per team, action items with owners pushed to task tools, answers that cite and link the transcript passage they rest on, topic or keyword tracking across meetings, team libraries with permissions, and the AI models used for summaries named.
10 — Meeting knowledge a company can audit: every generated statement traceable to its source passage, hallucination handling and human review documented, summary quality by language stated, and the archive queryable through an API or MCP server with the same permissions as in the app.
The Management Consultant
Decisions and action items are extracted with owners and pushed into Jira, Microsoft Planner or Confluence with the decision behind them, the summary language follows the meeting by default and can be set per user or fixed organisation-wide, and search answers questions across all meetings with export to PDF, Word and more. For client minutes two things are missing from the captured pages: templates per meeting type, and AI answers that cite the transcript passage they rest on, so generated statements remain non-traceable to their source. 1 3 11 13 14
The Sales Team Lead
Summaries capture decisions and action items with owners, the summary language can follow the meeting, the user's language or a fixed language organization-wide, and search answers questions across all meetings. Tasks with owners push into Jira, Planner and the like, and minutes export to PDF, Word and more. We found no public information on follow-up email drafts, answers that cite the transcript passage they rest on, or summary templates per team — the follow-up email draft is the first thing I'd ask about on a vendor call. 1 3 11 13 14
The Works Council Chair
Summaries with action items and decisions, tasks extracted with owners and pushed into Jira, Asana, Planner and other tools, summary language configurable per meeting, per user or fixed organization-wide, six export formats, and AI search across all meetings with generated answers are documented. The meetings archive is also reachable through the API and MCP-capable clients. We found no public information on answers that cite and link the transcript passage they rest on, per-team summary templates, or team libraries with permissions. 1 3 5 11 13 14
The Data Protection Officer
AI summaries, decisions and tasks with assigned owners are generated and delivered by email immediately after the meeting, with the summary language following the meeting, the user's interface language or a fixed organization-wide choice, and export to PDF, Word, Excel, subtitle and CSV formats. Search runs across all meetings and answers free questions with an AI response spanning the matching results, and the summarizing model is stated to be the vendor's own LLM on its own German infrastructure. We found no public information on answers citing and linking the transcript passage they rest on, on documented human review or hallucination handling beyond a contractual disclaimer of AI correctness, or on team libraries with permissions. 5 9 10 11 13 14
The IT Lead
Summaries can follow the meeting language, each user's language or a fixed organization-wide language that only owners and admins can set, which is exactly the central control I want at 400 seats. Tasks are extracted with owners and pushed to Jira, Planner and Asana, search spans all meetings with filters and an AI answer, the summaries model is named as Sally's own, and minutes export to pdf, docx, xlsx and more. We found no public information on answers that cite and link the transcript passage they rest on, or on custom templates per team, which caps this score. 3 4 5 11 13 14
The Skeptic
Decisions and action items with owners are extracted and pushed to Jira, Asana and the CRMs, the summary language follows the meeting, the user or a fixed organization-wide choice, search covers all meetings with an AI answer, and the minutes export to six formats from an own language model on the vendor's own German infrastructure. The traceability I demand is not evidenced: we found no public information on answers that cite and link the transcript passage they rest on, on templates per meeting type, or on team libraries with permissions. 5 13 14 3 11
Integrations, API & workflow
panel disagrees
Show reasoningHide reasoning
How this is scored
How the notes reach the place where work happens: calendar connection with rules for which meetings are recorded, CRM fields filled from the call (HubSpot, Salesforce, Pipedrive, Microsoft Dynamics), project and task tools, Slack and Microsoft Teams channels, Notion, Confluence and SharePoint, Zapier, Make or n8n, a documented REST API and webhooks, an MCP server for AI assistants, and browser extensions and native apps.
0 — No integrations and no export; the notes stay in the app.
3 — A calendar connection and an email or Slack summary; CRM, API and task tools are basic or not described.
5 — Google and Microsoft calendars, a native CRM integration (HubSpot or Salesforce), Slack or Teams, a task or wiki tool, Zapier or Make, and a documented API or webhooks.
8 — CRM field mapping per meeting type, several CRMs including Microsoft Dynamics or Pipedrive, a full REST API with webhooks and reference documentation, an MCP server, SharePoint or Confluence export, and recording rules per calendar or meeting type.
10 — An integration layer a company builds on: every object reachable by API with rate limits and versioning stated, granular OAuth scopes, data residency kept across integrations, and the integrations administered centrally with logs.
The Management Consultant
Calendars (Outlook online and on-premises, Google, Apple, CalDAV, Calendly) and eight CRMs including HubSpot, Salesforce, Pipedrive and Dynamics 365 are documented, alongside Confluence, Notion, Jira, Slack and Teams channels, Zapier, Make, n8n and Power Automate, and a public API with webhooks and an MCP server shipped in September 2026 that also runs as a native app in ChatGPT, Claude and GitHub Copilot. CRM field mapping per meeting type and API rate limits or versioning are not described on the captured pages. 3 5 6 15 16
The Sales Team Lead
HubSpot is the headline for my team: AI notes from sales calls land directly on leads and customers, with Salesforce, Pipedrive, Dynamics 365, Zoho and more beside it, and summaries post into Teams and Slack channels. A public API with webhooks and an MCP server shipped, Zapier, Make, n8n and Power Automate are documented, and Confluence and Notion take the minutes. We found no public information on CRM field mapping per meeting type or recording rules per calendar, which is what I'd need to write the fields that matter automatically. 3 5 6 16
The Works Council Chair
Eight CRMs including Dynamics 365 and Pipedrive, Confluence and Notion, Outlook on-premise and CalDAV alongside Google and Apple calendars, Slack and Teams channels, Zapier, Make, n8n and Power Automate, a public API with webhooks, an MCP server usable from ChatGPT to Visual Studio Code, and native desktop and mobile apps are all documented. We found no public information on CRM field mapping per meeting type or on API rate limits and versioning. 3 5 6 16
The Data Protection Officer
Seven calendar sources including Outlook on-premise and CalDAV, eight CRM systems including Dynamics 365, Pipedrive, Salesforce and HubSpot, ten task and wiki tools including Confluence and Notion, Slack and Teams channels, plus Zapier, Make, n8n and Power Automate are documented, with a public API, webhooks and an MCP server reached from ChatGPT, Claude, Copilot and other clients. We found no public information on CRM field mapping per meeting type, on API rate limits, versioning or OAuth scopes, or on SharePoint export, so centrally administered integrations with logs are not evidenced. 3 5 6 15 16
The IT Lead
For a Microsoft 365 shop like mine this catalogue is unusually complete: Outlook including on-premise, Teams channels, Dynamics 365, Planner, Azure DevOps and Power Automate, next to HubSpot, Salesforce and Pipedrive, Confluence and Notion, plus Zapier, Make and n8n. A REST API with webhooks shipped in September 2026 and Sally runs as an MCP server in ChatGPT, Claude and Copilot, with SCIM provisioning handled in one admin area. We found no public information on CRM field mapping per meeting type or on SharePoint export as such, which keeps it off the top level. 3 5 6 15 16
The Skeptic
Calendars including on-premise Outlook and CalDAV, HubSpot, Salesforce, Pipedrive, Dynamics 365 and four more CRMs, Confluence, Slack and Teams channels, Zapier, Make, n8n and Power Automate, plus an API with webhooks and an MCP server wiring Sally into ChatGPT, Claude and Copilot — most of the substance of the highest documented level. CRM field mapping per meeting type and a full API reference with rate limits and versioning are not shown, which is what keeps me from crediting the top grade. 3 5 6 16
Consent, participant rights & works council
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether every person in the meeting knows and can decide, and whether the tool can be introduced under German co-determination: a recording notice to all participants including external guests, consent or opt-out before the recording starts, a visible bot or a stated notice for botless capture, rules for when the assistant joins automatically, stopping and deleting a recording on request, per-person analytics (talk time, sentiment, engagement scores) off by default or switchable per organisation, material or a template for a works agreement (Betriebsvereinbarung, § 87 (1) no. 6 BetrVG), and support for a data protection impact assessment.
0 — Built to record people without their knowledge, or sells covert recording or individual performance scoring as a feature.
3 — A general privacy statement and a bot that appears in the participant list; notices to guests, opt-out, per-person analytics and works councils are basic or not described.
5 — A recording notice to participants by chat message, email or the bot's name, a way for a participant to stop the recording or opt out, admin rules for when the assistant joins, recordings deletable on request, and per-person analytics described with how to switch them off.
8 — Consent collected before recording starts for external participants, per-person analytics off by default or switchable per organisation, botless capture with its notice method documented, a works-council information pack or works-agreement template published, DPIA support, and the EU AI Act classification stated.
10 — Co-determination built into the product: every analytic and its granularity documented for the works council, consent and opt-out logged per participant, configuration changes logged, minimum group sizes for any team statistics, and references of works-council-approved rollouts published.
The Management Consultant
Sally posts a configurable chat notice on joining (every meeting, only with external participants, or never), any participant can opt out in the chat with immediate deletion of all captured data, and an email opt-in can require consent before Sally joins at all. Performance, behaviour, face and emotion analysis of individuals is contractually excluded, a free nine-section works-agreement template aligned with the DPA and TOMs is published for § 87 (1) no. 6 BetrVG, the EU AI Act classification and a DPIA are stated, and the vendor says plainly that for in-person app recordings and uploads the notice and opt-out are technically unavailable and the recording person must inform and document consent. 7 9 10 17 18
The Sales Team Lead
Every participant is told in the meeting chat that Sally is taking notes and how they can object; typing opt out makes Sally leave and deletes everything captured so far, and an email opt-in can hold Sally back until consent is given. A free nine-paragraph works-agreement template aligned with the DPA, TOMs and AI conformity declaration is published and cites § 87 (1) no. 6 BetrVG, with performance and behaviour analysis contractually excluded and the EU AI Act classification stated as limited-risk. One briefing point for the team: for in-person recordings and uploads the chat notice and opt-out are technically not available, and the recording person documents consent before starting. 7 9 17 18
The Works Council Chair
Every participant gets a chat notice when Sally joins, anyone can type opt out and all captured data is deleted immediately, an email opt-in can require consent before she joins at all, and for in-person recordings and uploads the recording person must inform and document consent because notice and opt-out are technically unavailable there. Behavior, emotion and individual performance analysis is contractually excluded, the EU AI Act classification and a DPIA are stated, and a free nine-paragraph works-agreement template citing section 87 (1) no. 6 BetrVG and aligned with the DPA and TOMs is published — the most usable co-determination material I have seen from a notetaker. Two caveats for our agreement: the in-meeting notice can be set to "never", and consent per participant is not logged. 7 9 10 17 18
The Data Protection Officer
For a German rollout this is the best-documented package I have seen from a notetaker: a free, customizable nine-paragraph works agreement template aligned with the DPA, the TOMs and the AI conformity declaration and citing § 87 (1) no. 6 BetrVG, plus contractual exclusion of performance, behavior, face and emotion scoring and an EU AI Act classification as a limited-risk system. Sally posts a configurable chat notice in Teams, Zoom, Meet and Webex, any participant's chat opt-out immediately deletes all captured data and Sally leaves, an email opt-in can require consent before she joins at all, and a vendor-side DPIA under Article 35 GDPR is stated. We found no public information on per-participant consent logging or minimum group sizes for team statistics, and for in-person app recordings and uploads the chat notice and opt-out are technically unavailable, with the duty to inform and document consent placed on the recording person. 7 9 10 17 18
The IT Lead
This is the strongest works-council story I have seen from a notetaker: a free, customizable nine-section works agreement template aligned with the DPA and TOMs citing section 87 (1) no. 6 BetrVG, performance and behaviour analysis contractually excluded, and secret recordings prohibited. In-meeting chat notices are configurable (every meeting, only with external participants, never) with custom text and variables, an email opt-in collects consent before Sally joins, an opt-out chat command deletes everything captured and removes Sally, and the EU AI Act classification is stated. App-based recordings require the recording person to document consent, and we found no public information on per-participant consent logging, so one notch below the top. 2 7 10 17 18
The Skeptic
The co-determination package is real: a chat notice on joining with three admin-set options, an advance email opt-in so Sally joins only after consent, a chat opt-out that immediately deletes all captured data and removes her, a nine-paragraph works agreement template aligned with the DPA and TOMs citing § 87 (1) no. 6 BetrVG, the EU AI Act limited-risk classification, a DPIA, and behaviour and performance analysis contractually excluded. My reservations: the recommended default posts the notice only with external participants and "Never" is a selectable option, in-person capture relies on the recording person to inform and document, and consent or opt-out is not logged per participant. 17 18 7 10 9
Retention, AI training & administration
panel disagrees
Show reasoningHide reasoning
How this is scored
What the employer can govern: retention periods and automatic deletion of recordings, transcripts and summaries, whether audio and video can be discarded after transcription, sharing defaults and link permissions, customer content excluded from model training by contract, the AI and transcription providers named with their region and their own retention, encryption, single sign-on (SAML), SCIM, roles and workspaces, admin policies on auto-recording and sharing, audit logs, export of the whole archive, and security certifications such as ISO 27001 and SOC 2.
0 — No administration and no deletion; every user decides alone and recordings are kept indefinitely.
3 — Users can delete their own recordings and a security page exists; retention policies, model training, SSO and audit logs are basic or not described.
5 — Retention settings per workspace, customer content excluded from model training, team workspaces with roles, single sign-on, admin control over sharing and auto-recording, encryption at rest and in transit, and ISO 27001 or SOC 2 stated.
8 — Automatic deletion by policy with audio discardable after transcription, the AI and transcription subprocessors named with region and zero retention, SAML with SCIM, granular roles, audit logs, legal hold or export of the full archive, and certifications with their scope published.
10 — Governance an auditor accepts: every retention, sharing and recording policy enforceable centrally and logged, models run on the vendor's own or the customer's infrastructure as an option, audit logs exportable to a SIEM, and the deletion of every copy, including at subprocessors, documented.
The Management Consultant
Retention and deletion are unusually concrete: automatic deletion rules per workspace for transcripts, recordings and summaries, raw audio discarded after transcription unless recording storage is enabled, deletions carried into every backup the following night, and deletion or return within 30 days of contract end with written confirmation. Customer content is excluded from AI training in the terms and the privacy policy, the model runs on the vendor's own German infrastructure, and single sign-on with SCIM, role-based access, audit logs, a detailed admin-access regime and ISO 27001:2022, 9001, 14001 and 42001 certifications with certifier and register number are published; audit-log export to a SIEM and legal hold are the pieces I could not find. 6 7 9 10 18 19 20
The Sales Team Lead
Automatic deletion rules per workspace cover transcripts, recordings and summaries, raw audio is deleted after transcription unless recording storage is on, deletions are carried into every backup the following night, and everything is deleted within 30 days of contract end with written confirmation. Customer content is contractually excluded from AI training, subprocessors are listed, access and admin actions are logged, SSO with SCIM is offered, and ISO 27001:2022 is certified with register number and validity to May 2028. We found no public information on legal hold or SIEM export of the audit logs. 7 9 10 18 19
The Works Council Chair
Retention per data type is set by the employer, automatic deletion per workspace covers transcripts, recordings and summaries, audio is discarded after transcription unless storage is enabled, and a deletion propagates into every backup system the following night, with deletion within 30 days after contract end confirmed in writing. Customer content is excluded from AI training by contract, and roles, SCIM provisioning, single sign-on, tenant isolation, TLS 1.3 and AES-256, audit logging of access and admin actions, ISO 27001:2022 with register number and validity, and the option of the vendor's own or on-premises infrastructure are documented. We found no public information naming SAML specifically, on legal hold, or on exporting audit logs to a SIEM. 5 6 7 10 18 19
The Data Protection Officer
Deletion rules for transcripts, recordings and summaries are configurable per workspace, raw audio is auto-deleted after transcription unless recording storage is enabled, deletions propagate into every backup system the following night, and contract-end deletion within 30 days with written confirmation is promised. Training on customer content is excluded in the terms, the language model runs on the vendor's own German infrastructure, SSO with SCIM, role-based access, tenant isolation and audit logging are documented, and ISO 27001:2022, 9001, 14001 and 42001 certificates are published with issuer, register number and validity to 26 May 2028; the captured pages give different figures for SOC 2, stating it as certified on one page and 'aligned' on another. We found no public information on legal hold, on export of the full archive or of audit logs to a SIEM, or on retention at the named subprocessors. 5 6 7 9 19 20
The IT Lead
Nearly everything I ask for at 400 seats is documented: SSO and SCIM provisioning in one administration area, automatic deletion rules per workspace for transcripts, recordings and summaries with deletion carried into every backup the following night, and complete access logging plus logged administrative actions. Customer content is excluded from AI training, audio is auto-discarded after transcription unless recording storage is on, ISO 27001:2022 is certified with register number and validity to 2028, and on-premise deployment with an own LLM is offered as an Enterprise option. We found no public information on exporting audit logs to a SIEM or on legal hold, so I stop just short of the top. 5 6 7 10 18 19
The Skeptic
Deletion is engineered rather than promised: per-workspace automatic deletion rules for transcripts, recordings and summaries, raw audio discarded after transcription unless storage is enabled, deletions carried into every backup the following night, all data gone within 30 days of contract end with written confirmation, and no AI training fixed in the terms — alongside ISO 27001 with issuer and validity, audit logs, SSO with SCIM and a documented admin-access regime. Below the top band because SOC 2 is stated as "aligned" rather than certified, SAML is not named, subprocessor retention is not stated, and we found no public information on legal hold or export of audit logs to a SIEM. 19 18 10 7 20 6
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where recordings, transcripts, summaries, voice profiles and account data are stored and processed, which language model and transcription providers read them and where, and who the other subprocessors are (hosting, email, support, analytics and payment tools). Independently sourced by the sovereignty pipeline. A conferencing platform outside Europe that the customer already uses is part of the meeting, not counted against the notetaker; where the notetaker stores and processes the conversation is.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (language models, transcription, email, support, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors including the AI providers listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, with transcription and language models run in Europe by European operators, data export and deletion documented, and certifications published with their scope rather than implied.
The Management Consultant
Aliru GmbH in Mannheim is the contracting entity with register court and number published, conversation content, transcripts and metadata are hosted at Hetzner in Germany, and the language model is the vendor's own on its own German infrastructure, with no external AI providers and no third-country transfers. A subprocessor list with roles (Hetzner, Strato, DeepL, Microsoft Dynamics 365, Stripe) plus an Art. 28 DPA with TOMs is published, and the ISO certifications carry certifier, register number and validity date; the locations of the translation and payment providers are not stated on the captured pages, and SOC 2 is described as aligned rather than certified. 5 7 8 9 10 18
The Sales Team Lead
Aliru GmbH of Mannheim is the contracting entity under German law, conversation content, transcripts and metadata sit in German data centres at Hetzner with no third-country transfer, and the language model runs on the vendor's own German infrastructure with no external AI providers. An Art. 28 DPA is published and signable online, the subprocessor list is public, and ISO 27001 is certified with register number and validity. SOC 2 appears as aligned, and we found no public information on the payment subprocessor's location or any parent company. 7 8 9 10 18
The Works Council Chair
The contracting entity is Aliru GmbH of Mannheim under German law with the German contract version binding, conversation content, transcripts and metadata are processed and stored exclusively in German data centers at Hetzner with no third-country transfers, and the language model is the vendor's own running in its own German infrastructure with no external AI providers. Subprocessors including DeepL for translation and Stripe for payments are named, a documented list and TOMs are downloadable, and an Article 28 DPA is published and signable online. SOC 2 appears only as "aligned" rather than certified, and we found no public information on a parent company. 5 7 8 9 10 18
The Data Protection Officer
The contracting entity and processor is Aliru GmbH of Mannheim (HRB 739079, Amtsgericht Mannheim), meeting content, transcripts and metadata are hosted at Hetzner in Germany with geo-redundant German backups and a stated absence of third-country transfers, and the model that reads the transcript is the vendor's own LLM on its own German infrastructure with no external providers. A published Article 28 DPA with TOMs, downloadable and signable online, and a documented subprocessor list — Hetzner, DeepL, Strato, Microsoft Dynamics 365 and Stripe, described as EU-based and contractually bound — close most of the chain, with ISO certificates including register number and validity. DeepL translates summaries and task descriptions but its own region and retention are not stated in the captured pages, and we found no public information on ownership structure or on the storage of voice profiles. 5 7 8 9 10 18
The IT Lead
Aliru GmbH in Mannheim is the contracting entity (HRB 739079, Amtsgericht Mannheim), the conversation chain runs at Hetzner in Germany, and summaries come from Sally's own language model on its own German infrastructure with no external AI providers and no third-country transfers. Subprocessors including Hetzner, DeepL, Strato and Stripe are named with their purposes, all stated to have EU infrastructure, the Article 28 GDPR data processing agreement is published online, and German law governs. Individual locations per subprocessor are not published and SOC 2 is only described as aligned, which keeps this one notch below sovereign end to end. 5 7 8 10 18
The Skeptic
The vendor's own pages prove a German GmbH with register number and VAT ID in Mannheim, hosting at Hetzner in Germany, an own language model on own German infrastructure with no external AI providers for meeting content, a published Art. 28 DPA, and a named subprocessor list of Hetzner, DeepL, Strato, Microsoft Dynamics 365 and Stripe. I stop short of the top grade because DeepL's and Stripe's locations are not stated, certification scope is not published, and the independently computed sovereignty attributes mark residency and the DPA as unknown next to these vendor statements. 8 10 7 5 18
Pricing transparency
not rated — the vendor publishes no price
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per seat and tier, what counts as a seat (every invited user, only recording users), transcription minutes or credits included, storage limits, which features (CRM integrations, API access, SSO, custom retention, EU hosting, AI credits) cost extra, the free tier and its limits, monthly versus annual billing, minimum seats and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with seats, minutes or features is unclear.
5 — Tiers are public with their seat price and main inclusions, but at least one commonly needed piece (SSO, CRM integration, API, custom retention, EU hosting, minute or credit limits) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (seats, minutes, credits, storage), add-ons priced, what counts as a seat stated, overage handling stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size and meeting volume, with every add-on, overage and support fee and the cancellation and data-return terms published.
The Management Consultant
Three tiers are public with their seat prices quoted exactly — Starter $8/mo, Pro $40/mo, Enterprise $79/mo, each after a 30-day trial with no credit card, billed annually, excluding VAT — plus the Starter's 1,200 transcription minutes per month, unlimited minutes on Pro, upload sizes per plan, fair-use meeting hours per plan, plan mixing and 30-day cancellation. Still open for a buyer: the monthly non-annual rates beyond "Save up to 50%", what counts as a seat, and the price of the on-premises or own-LLM option, which is named but unpriced. 1 3 6 9
The Sales Team Lead
Three tiers are public at $8, $40 and $79 per user per month after a 30-day trial with all features unlocked and no credit card, billed annually excluding VAT, with minutes, upload limits and fair-use hours per plan and the one-year annual minimum term stated; CRM and the 8,000-plus integrations are already in the Starter plan. We found no public information on what counts as a seat, the monthly-billing price, add-on or overage rates, or how the usage-based fees in the terms are charged — I can sketch my team of eight's cost, but not close procurement on public pages alone. 3 6 9
The Works Council Chair
Three tiers are priced per user per month at $8, $40 and $79 after a 30-day trial, billed annually and excluding VAT, with 1,200 transcription minutes on Starter and unlimited on Pro, per-file upload limits, fair-use meeting hours per plan, up to 50% saving on yearly billing, plan mixing, and cancellation and price-change terms public. What counts as a seat is not stated, and we found no public information on add-on pricing or overage handling. 1 3 6 9
The Data Protection Officer
Three tiers are public at $8, $40 and $79 per user per month after a 30-day trial, billed annually excluding VAT, with 1,200 transcription minutes on Starter, unlimited minutes on Pro, per-file upload limits, all features unlocked in the trial without a credit card, and monthly plans with no minimum term. The terms add a monthly base fee plus usage-based fees and fair-use caps of 8 and 12 meeting hours per user per day, but we found no public information on what counts as a seat, on pricing for on-premise deployment or the own-LLM option, or on overage fees. A buyer can approximate, not compute, the annual cost from the public pages. 1 6 9
The IT Lead
Three tiers are public with prices quoted as "$8/mo", "$40/mo" and "$79/mo after 30-day trial; billed annually (excl. VAT)", alongside transcription minutes (1,200 per month on Starter, unlimited on Pro), per-file upload caps, fair-use hours per user and day, plan mixing, and stated VAT treatment and minimum terms. However, the general terms describe prices as "a monthly basic fee and the usage-based fees" without published rates, we found no public information on what counts as a seat or on pricing for on-premise deployment and the own-LLM option, and monthly per-seat prices are not itemized, so I cannot compute the annual cost for 400 users from these pages alone. 1 3 6 9
The Skeptic
Three tiers are public at $8/mo, $40/mo and $79/mo per user after a 30-day trial without credit card, billed annually, excl. VAT, with 1,200 transcription minutes on Starter, unlimited minutes on Pro, fair-use meeting hours per day from the terms, per-file upload limits and licence mixing allowed. A buyer still cannot compute the full cost: monthly-billing prices are not shown, what counts as a seat is not stated, and the consequence of exceeding the Starter minutes or the fair-use hours is not described. 6 9 1
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Sally
Is Sally European?
Yes. whats-best.ai classifies Sally as EU-Made.
Where does Sally store data?
The default storage location for customer data is not stated on the vendor’s pages as of 5 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 5 Nov 2026.
Does Sally have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to Sally?
As of 6 Nov 2026, the panel rates MeetGeek (3.5/5), Noota (3.5/5) and Jamie (3.5/5) highest among the other 14 AI Meeting Assistants & Notetakers products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is MeetGeek (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Sally alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Hosting options, Data processing agreement, Transfer impact assessment. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (20)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.sally.io Checked 5 Nov 2026 Details →
- 2 Features page (Teams, Zoom and Meet integration) www.sally.io Checked 5 Nov 2026 Details →
- 3 Integrations page www.sally.io Checked 5 Nov 2026 Details →
- 4 Features page (developers) www.sally.io Checked 5 Nov 2026 Details →
- 5 Help centre help.sally.io Checked 5 Nov 2026 Details →
- 6 Pricing page www.sally.io Checked 5 Nov 2026 Details →
- 7 Security and GDPR page www.sally.io Checked 5 Nov 2026 Details →
- 8 Legal notice www.sally.io Checked 5 Nov 2026 Details →
- 9 Terms of service www.sally.io Checked 5 Nov 2026 Details →
- 10 Privacy policy (SaaS platform) www.sally.io Checked 5 Nov 2026 Details →
- 11 Recording, transcription & languages — found from sitemap www.sally.io Checked 5 Nov 2026 Details →
- 12 Recording, transcription & languages — found from sitemap www.sally.io Checked 5 Nov 2026 Details →
- 13 Summaries, action items & meeting knowledge — found from sitemap help.sally.io Checked 5 Nov 2026 Details →
- 14 Summaries, action items & meeting knowledge — found from sitemap help.sally.io Checked 5 Nov 2026 Details →
- 15 Integrations, API & workflow — found from sitemap www.sally.io Checked 5 Nov 2026 Details →
- 16 Integrations, API & workflow — found from sitemap www.sally.io Checked 5 Nov 2026 Details →
- 17 Consent, participant rights & works council — found from sitemap help.sally.io Checked 5 Nov 2026 Details →
- 18 Consent, participant rights & works council — found from sitemap help.sally.io Checked 5 Nov 2026 Details →
- 19 Retention, AI training & administration — found from sitemap help.sally.io Checked 5 Nov 2026 Details →
- 20 Retention, AI training & administration — found from sitemap help.sally.io Checked 5 Nov 2026 Details →