Home → Blog → Transcription privacy and security: what to check with a provider
Transcription privacy and security: what to check with a provider
A conversation recording is sensitive material: names, amounts, deal terms and sometimes medical detail. Before shipping that archive to somebody else's service, ask five specific questions. Here they are, along with our own answers.
Five questions for a provider
- How long are recordings and transcripts kept? An answer of "indefinitely", or an evasive one, is a bad sign.
- Is the data used to train models? This is the important one: a trained model can reproduce fragments of your recording.
- Which employees can access it? The acceptable answer is "nobody, except when you open a support ticket".
- How is the channel encrypted? The only acceptable answer is HTTPS only, with no exceptions.
- Can data be deleted on request? And how quickly it actually happens.
How it works here
Recordings and transcripts live no longer than 24 hours — exactly long enough for you to verify quality and download the result from the client area — and are then deleted automatically. Recognition runs on the operator's own hardware; audio is never passed to third-party recognition services and never used to train models.
Connections are accepted over HTTPS only: unencrypted access is closed and plain http does not serve the site at all. Your access key works like a password and can be replaced from the client area at any moment.
What is on your side
- Key storage. A key committed to a repository is the most common leak there is. Environment variables solve it.
- Your own transcript store. Once you have the text, its protection is yours: disk encryption, access rights, retention.
- Telling participants. In many jurisdictions recording a conversation requires notifying the other party — a process question, not a vendor one.
- Minimisation. Do not send recordings you do not need: the safest file is the one that never left your perimeter.
When data must not leave at all
Some industries settle this by regulation rather than retention policy: classified work, certain categories of medical data, closed banking environments. There the right answer is a self-hosted deployment inside the perimeter, even at a higher cost.
Everywhere else, compare risks honestly: your email provider, cloud drive and CRM already hold data at least as sensitive, for years rather than a day.
Try it on your own recordings. Sign-up takes a minute, and the free minutes are enough to judge the quality.
Get a free API keyFrequently asked questions
How long are my recordings stored?
No longer than 24 hours. They are available in the client area for quality checks, then deleted automatically along with the transcripts.
Is my audio used to train models?
No. Audio and transcripts are never used for training and never passed to third-party recognition services.
What if my key leaks?
Replace it in the client area. The old key stops working immediately and access through it is closed.
Can a recording be deleted sooner?
Yes, contact support and the data is removed on request without waiting for the automatic cleanup.
Related reading
- Self-hosted Whisper or a transcription API: what costs less — An honest comparison of running Whisper yourself versus using an API: GPU cost, maintenance, time to first result and the volume where self-hosting pays off.
- How to transcribe a call recording to text — A step-by-step guide to turning phone call recordings into text through an API in minutes: Python and C# samples, response formats and the errors you will meet.
- Speech-to-text pricing: what you actually pay for — How transcription billing works, which parts of your audio cost money, when self-hosting a GPU is cheaper than an API, and how to estimate your own monthly spend.