Seven questions to ask before you upload recordings to a transcription service

A recording of a meeting, an interview or a client call often holds more than its speakers would put in writing. Before you upload it anywhere, it is worth knowing where it goes. These seven questions can be answered from a service's privacy policy and security page — and if they cannot, that is an answer too.

1. Where are the recordings stored and processed?

"In the cloud" is not an answer. Look for the country or region of the servers that store your files and of the machines that transcribe them — they are not always the same. For organisations in the EU, processing inside the EU keeps the question of international transfers simple; processing elsewhere needs a legal basis for the transfer, such as standard contractual clauses.

2. Are recordings or transcripts used to train AI?

Some services say in their privacy policy that they train their models on customer recordings or transcripts, sometimes after removing identifying details. Others promise not to. Read the exact wording: "de-identified" is not the same as "not used".

3. Who else processes the data?

A privacy policy should list the companies that handle your data on the service's behalf — cloud hosting, payment, email, analytics, and increasingly AI model providers. If AI summaries are written by an outside model provider, your transcript travels there too. Ask for the list of sub-processors if it is not published.

4. Is the data encrypted — and how?

Encryption in transit (HTTPS) is the minimum. Encryption at rest protects files on the servers; some services go further and encrypt each file with its own key.

5. What does "delete" mean?

When you delete a recording, is it gone at once, or kept for a while? How long do backups keep it? Deleting your account should delete your files; check whether the policy says so.

6. Does the service recognise voices?

Features that recognise the same person across recordings work by storing a model of their voice. A voice print used to identify a person can count as biometric data, which the GDPR treats as a special category of personal data. If you do not need the feature, a service that does not keep voice prints has one risk fewer.

7. Who handles payments?

The payment provider sees your card details, not your recordings — but it may process them in a different country from the rest of the service. It is worth knowing which company that is.

How SonaFact answers these questions

• Where: recordings, transcripts and documents are stored and processed in the EU.
• Training: recordings and transcripts are not used to train AI.
• Who else: AI documents are written by a model SonaFact runs itself on hardware in the EU — not by OpenAI, Anthropic or Google.
• Encryption: every file is encrypted.
• Delete: deleting means deleting; backups expire after 30 days.
• Voices: SonaFact keeps no voice prints and does not recognise the same person across recordings.
• Payments: card payments are handled by Dodo Payments, which processes card details also outside the EU. Recordings and transcripts never go there.

The details are on our security page and in the privacy policy. This article is general information, not legal advice; if you process sensitive data, check your obligations with your data protection officer or lawyer.

Try it on your own recording

The free plan gives you 3 transcripts a day, up to 30 minutes each, without a card — enough to judge the transcript, the speakers and the editor yourself.