Security

Where we stand

We do not hold any security certifications today. This page describes the measures that are actually in place, and the roadmap below shows what we are working towards and where each item stands. We will never describe the service as certified or compliant with a standard until an independent audit says so.

Encryption

Every connection to our site and our file storage is encrypted in transit, and the site tells browsers to use encrypted connections only. Recordings, documents and transcripts are stored encrypted at rest.

Private storage and short-lived links

Uploaded files go straight into private storage that has no public address. Upload links expire after 15 minutes, and every later step of an order needs a signed ticket that is tied to the order and your email address and expires within a day. Payment and team links carry their own secret and are excluded from analytics.

Deletion

Audio and video files are deleted automatically 90 days after upload, and sooner if you ask. Interrupted uploads are cleaned up within a day. The free preview keeps nothing.

Access

Only the people working on your order (editors, quality reviewers, support and administration) can open your files, and everyone who works on Soundtoscript material has signed or agreed to a confidentiality agreement. Team tools need their own credentials. If you need a signed confidentiality agreement (NDA) before work starts, tick the box when you upload.

Automated processing

Our automated steps run with providers configured so that they cannot keep your recordings or use them to train their models, and they receive only the part of a recording they need. See our AI transparency page for what each step does.

Payments

Card and mobile-money details are entered on our payment provider's own secure checkout. We never see or store card numbers, security codes or PINs.

Abuse protection

Forms are protected by a bot check and rate limits, and links you ask us to import are checked so they cannot reach private networks.

Compliance roadmap

In progress: data processing agreements with each of our service providers; written records of processing and a data protection impact assessment; multi-factor sign-in on every account that can reach client data; training records for everyone who handles client files.

Planned: registration with Kenya's Office of the Data Protection Commissioner as a data controller and processor; a data processing agreement for business clients, with EU Standard Contractual Clauses; a public list of the categories of service providers we use; an enforced content security policy; an independent SOC 2 Type I report, then Type II; ISO/IEC 27001.

Not offered yet: HIPAA Business Associate Agreements. Please don't send recordings containing US patients' protected health information.

Report a security issue

If you think you've found a vulnerability, email support@soundtoscript.com with the details and how to reproduce it. Please give us a reasonable time to fix it before telling anyone else, and don't access other people's data or disrupt the service while testing. We'll acknowledge your report within three business days.