Kyiv, Ukraine headquarters is the primary sovereignty risk — ongoing conflict creates operational uncertainty and data security concerns regardless of GDPR compliance intent. No specific retention period for project audio or voice models after project completion. No SOC 2/ISO 27001 certification. High-profile nature of entertainment voice cloning (celebrity voices) creates reputational and legal risk if consent chain breaks.
Ensure all project contracts specify data deletion timelines and jurisdiction for dispute resolution using US or EU courts rather than Ukraine. Verify that all voice actor consent agreements are in writing and specify scope of use. Request data processing agreement with explicit data location guarantee (Burbank, CA). Use audio watermarking on all outputs.