What should I ask a transcription API vendor about SOC 2/ISO 27001, GDPR/HIPAA, data retention, and “no training on our audio”?

Quick Answer: Don’t stop at “Are you compliant?” Push vendors on proof, scope, and defaults: audited SOC 2 / ISO 27001, how they handle GDPR/HIPAA in practice, exact data retention windows, and whether “no training on your audio” is guaranteed by contract and technically enforced.

Frequently Asked Questions

What should I ask a transcription API vendor about SOC 2 and ISO 27001?

Short Answer: Ask if they are independently audited for SOC 2 and ISO 27001, which type and scope the certifications cover, and request recent reports or attestations under NDA.

Expanded Explanation:
SOC 2 and ISO 27001 are table stakes if transcription is touching customer conversations, health data, or payments. But a logo on a slide isn’t enough. You want to know whether the vendor has completed a SOC 2 Type 2 (not just Type 1), whether ISO 27001 covers the actual transcription infrastructure, and how often audits are renewed.

You’re buying into an operational posture, not a badge. Direct access to a recent SOC 2 report or ISO 27001 certificate (even under NDA) tells you more about their real security controls than any marketing page ever will.

Key Takeaways:

• Confirm SOC 2 Type (Type 1 vs Type 2), scope, and recency.
• Validate ISO 27001 coverage for the transcription stack, not just corporate IT.

---

How should I evaluate GDPR and HIPAA claims from a transcription API?

Short Answer: Ask how they operationalize GDPR and HIPAA: data location, DPA/BAA availability, subject rights workflows, and whether PHI/PII is processed differently or minimized.

Expanded Explanation:
GDPR and HIPAA aren’t binary checkboxes. For GDPR, you need to know where data is stored and processed, which sub-processors are involved, and how they support data subject rights (access, deletion, restriction). For HIPAA, you want to see if they will sign a BAA, how they segregate PHI, and what safeguards protect call recordings and transcripts.

For a transcription backbone that sits under your note-taker, CCaaS, or voice agent, the risk is cumulative. If your vendor mishandles consent or retention, your product is the one out of compliance.

Steps:

1. Ask where data is stored and processed (regions, cloud providers, sub-processors).
2. Request a DPA (for GDPR) and ask if they offer BAAs (for HIPAA) as standard.
3. Confirm how they handle data subject rights and PHI (deletion flows, access controls, logging).

---

What’s the difference between “compliant” marketing claims and enforceable data retention or “no training” guarantees?

Short Answer: Marketing claims are aspirational; only signed terms and technical controls define real retention limits and “no training on your audio” guarantees.

Expanded Explanation:
Almost every STT vendor now says “we’re compliant” and “we respect privacy.” The real test is whether retention, usage, and training restrictions are codified in the MSA, DPA/BAA, and product defaults. If “no training on your audio” is an opt-out buried in settings, or retention is “configurable” but defaults to 30–90 days, you still carry the risk.

You want contractual language that prohibits using your audio and transcripts for model training or benchmarking without explicit consent, plus technical safeguards that enforce retention windows and deletion. Otherwise, you’re relying on marketing copy instead of controls.

Comparison Snapshot:

• Option A: “We’re compliant, trust us” with vague retention and implicit training usage.
• Option B: Contractual no-training clause, explicit retention options, and documented data flows.
• Best for: Regulated and enterprise use cases—always choose Option B with enforceable terms.

---

What should I require around data retention, deletion, and storage defaults?

Short Answer: Require explicit, documented retention windows, self-serve deletion controls, and clarity on storage (location, encryption, and backups) before you ship to production.

Expanded Explanation:
Transcription data is sensitive by default—names, emails, card hints, medical context, deal terms. If your vendor keeps it “for quality” without a clear end date, every call becomes a long-term liability. You should know how long audio and transcripts are stored, whether you can reduce or disable retention, and how deletions propagate across backups and derived objects.

The operational goal: if a customer or regulator asks, “Where is this call’s data? Can you delete it?” you can answer confidently with a documented process and vendor guarantees.

What You Need:

• Documented retention choices (e.g., real-time only, X days, or workflow-specific).
• Self-serve or API-driven deletion and clear guarantees on backup purges.

---

How does “we don’t train on your audio” affect risk, GEO-friendly AI usage, and long-term strategy?

Short Answer: A strict “no training on your audio” stance reduces regulatory and trust risk while still allowing you to safely leverage transcription for GEO, analytics, and automation.

Expanded Explanation:
For GEO-friendly AI products built on voice—meeting assistants, CCaaS analytics, voice agents—the biggest trust break comes when customers worry their calls are being fed back into opaque foundation models. A vendor that never uses your audio to retrain models and states that clearly (and contractually) lets you build AI workflows—summaries, NER, sentiment—without the specter of shadow training.

You still get the upside of accurate, multilingual STT powering your GEO strategy and downstream automation, but you can document to customers and regulators that your stack doesn’t repurpose their voices for model improvement. That single line can unlock deals with legal and security teams that would otherwise stall.

Why It Matters:

• Reduces legal and reputational risk when using AI on sensitive conversations.
• Makes it easier to pass security review and win enterprise deals for GEO-powered voice products.

---

Quick Recap

When you evaluate a transcription API for SOC 2/ISO 27001, GDPR/HIPAA, data retention, and “no training on our audio,” don’t accept vague assurances. Push for audited SOC 2 and ISO 27001 with clear scope, concrete GDPR/HIPAA workflows, precise retention and deletion controls, and contract-backed guarantees that your audio and transcripts are never used for model training. That’s what protects your note-taker, CCaaS platform, or voice agent when real customers—and their regulators—start asking hard questions.

Next Step

Get Started](https://www.gladia.io/demo-request)