How we protect your data.
We keep as little as we can, for as short as we can, and we do not share it beyond the services we need to do the job. This page describes what we actually do, not a wish list.
Accounts and sessions
- Passwords are stored only as salted hashes. We cannot read your password and cannot mail it back to you.
- API keys are stored only as hashes. The full key is shown once, right after you create it, and never again.
- Sessions use signed tokens with a limited lifetime. Every request is authorised against the token that carries it.
- You can revoke any API key at any time. Revocation takes effect immediately.
Files in transit and at rest
- All traffic is encrypted with TLS. The website and the API are served over HTTPS only.
- Uploaded files are stored on our own infrastructure, separate from any other service we run, and are reachable only from the transcription path.
- Files are removed from the live system when you delete them, and from backups within 30 days.
Who can touch what
- Access to production is restricted to the people who need it, and every production change goes through review.
- Secrets live in environment variables, never in the code and never in the repository.
- Logs record what happened, not the content of your transcripts.
Your side
- Use a password you do not use anywhere else.
- Revoke an API key the moment you suspect it leaked. We cannot see it in use, so you are the one who must say it.
- Do not paste confidential recordings into chat tools or third-party sites to "fix" a transcript. Send the file to us instead.
Data flow, in one paragraph
Your browser sends the file to our API over TLS. The API stores it, queues the job, and passes it to the servers running our own transcription engine, which may be outside the United States. Clean English files may be routed to a cloud speech provider as a fallback, which processes them in the United States. The transcript comes back and is stored with your account. Payments go to Stripe and never touch our servers. The privacy policy has the same list in full, with retention periods.
Reporting a vulnerability
Write to security@transcrib.si. Tell us what you found, how to reproduce it, and what an attacker could do with it. We acknowledge reports within one working day.
We ask for two things: give us a reasonable chance to fix the problem before you disclose it publicly, and do not access other people's data, degrade the service, or use social engineering. We do not threaten researchers who act in good faith, and we do not require an NDA to receive a report. We will credit you in the fix if you want that, and we will not if you would rather stay anonymous.
What we do not have
No public status page yet, no third-party penetration test report yet, and no SOC 2 report yet. We would rather say that plainly than link to a badge that describes someone else's audit. When we have them, they will be on this page.