KugelAudio

KugelAudio is a real-time text-to-speech platform built in Berlin by KugelAudio GmbH, founded in August 2025 by Kajo Kratzenstein and Viktor Presber and part of Y Combinator's Spring 2026 batch. The API streams speech over REST and WebSocket in 39 languages, with voice cloning, speed control, break tokens, IPA notation, pronunciation dictionaries and word-level timestamps, and the vendor ships SDKs for Python, JavaScript and Java plus integrations for Pipecat and LiveKit. Two hosted models are priced per generated minute and billed by the second: kugel-2-turbo at €0.035 and kugel-3 at €0.07 per minute excluding VAT, with a free tier that needs no card. Enterprise contracts add dedicated capacity and on-premise deployment. An earlier model, kugelaudio-0-open, is published on Hugging Face under the MIT licence; it builds on Microsoft's open VibeVoice model and was trained on compute from the HPI AI Service Centre, which the German research ministry funds.

The paperwork is more complete than most vendors several times this size publish. There are two public DPAs, an EU and a Global variant, both dated 19 August 2026 and readable without a login, each with its own sub-processor register in the trust centre. Organisations created in the EU/EEA get the EU DPA by default, which the vendor markets as "EU Sovereign Cloud". That name refers to KugelAudio's own contract variant, not to a hyperscaler's sovereign-cloud product: speech content is processed on Verda (Finland), Hetzner, Nebius, Contabo, OVHcloud and Scaleway, voice references are stored in Hetzner and Scaleway object storage, text and audio are held in memory only under a zero-data-retention clause, and AWS, Google Cloud, Microsoft Azure and Lambda are excluded. Those four appear only in the Global DPA used for customers outside the EU/EEA, pinned to EU regions. At audit on 2 October 2026 the public API answered from Hetzner and Verda servers in Finland, with TLS terminated on the vendor's own ingress and no CDN in front, which matches what the DPA describes. That is a point-in-time observation: the EU DPA names processing regions in Germany, France, the Netherlands, Poland and Finland and lets the vendor move workloads between the listed providers, so the hosting country recorded here is where the API was observed, not a contractual commitment to one country. Two entries in the EU register need a closer look: Contabo is a German company majority-owned by the US private-equity firm KKR since 2022, and Supabase, which holds account and billing data, is contracted through a Singapore entity. The privacy policy, not the register, also names US-owned services that touch account and support data rather than speech content: Intercom for the in-product messenger, PostHog for product analytics and session replay, Google and Vercel, plus Stripe for payments, which the DPA treats as an independent controller rather than a sub-processor. The table below combines both sources and marks which is which.

The determining fact is ownership. The shareholder list filed with the Berlin commercial register in April 2026 shows that all shares in KugelAudio GmbH are held by KugelAudio Inc., a Delaware corporation with a San Francisco address, which is the usual structure for a Y Combinator company. The German GmbH is the contracting party and the processor, but it is a German operating company wholly owned by a US parent, so ownership is recorded as EU subsidiary, US parent, and CLOUD Act exposure as Material, an editorial risk tier rather than a finding that a specific US disclosure obligation applies. The reading rests on the sole shareholder's statutory rights to instruct and replace the GmbH's managing directors and on the CLOUD Act's possession, custody or control standard, and it would change if the vendor published a structural or contractual measure that removes those rights over customer data. No court has yet decided this exact structure, and the zero-data-retention clause means that what a US order could realistically reach is account, billing and usage data rather than speech content. The set of EU-established providers answers the question of who runs the GPUs; the parent company is a separate question, and the directory applies the same reading to every EU operator with a US parent. No security certification is held yet; the DPA names ISO 27001 or SOC 2 Type II as a roadmap goal. Best fit: teams building voice agents in European languages who value an infrastructure chain of EU-established providers for speech content and can work with a US parent. Buyers whose procurement rules exclude a US parent should self-host the MIT model on EU GPU infrastructure or discuss the on-premise option, which can keep content inside their own perimeter depending on how the deployment is hosted, accessed and supported.