How we protect your data.
Status: draft. This is the international short version; the main security page is the one linked from the menu. Neither has been reviewed by a lawyer.
We keep as little as we can, for as short as we can, and we do not share it beyond the services we need to do the job. This page describes what we actually do, not a wish list.
How the service is built
- The API, the worker, the database and the file storage run on infrastructure we operate ourselves, in containers on our own servers. Nothing is rented per request from a platform that would see the traffic.
- Traffic is encrypted with TLS. The website and the API are served over HTTPS only.
- Uploaded files are stored on a storage volume of their own, separate from any other service we run, and are reachable only from the transcription path.
- The site loads no assets from a third-party CDN and runs no third-party tracker, so your visit produces no analytics record about anyone but us.
How access works
- Passwords are stored only as salted hashes. We cannot read your password and cannot mail it back to you.
- API keys are stored only as hashes. The full key is shown once, right after you create it, and never again; we keep only its prefix so you can recognise it in the list.
- You can revoke any API key at any time. Revocation takes effect immediately.
- Sessions use signed tokens with a limited lifetime, and every request is authorised against the token that carries it.
- The MCP server uses OAuth 2.1 with PKCE — the authorisation code flow, with a code challenge that the client must prove it owns. Client secrets and authorisation codes are stored as hashes only.
Two-factor sign-in on a user account is not available yet. For automation, an API key is the stronger credential: it can be scoped, revoked and rotated without touching a person's login.
What we do not log
- Your audio. The sound of your recording never enters a log line.
- The text of your transcript.
- Card numbers or bank details. Those go to Stripe and stop there.
- Passwords, API keys, tokens and other secrets. Secrets live in environment variables, never in the code and never in the repository.
What the logs do keep: identifiers, timings, sizes, counts, error codes, IP address and user agent. They are kept for 30 days and are used for security and for diagnosing faults.
Where the data sits
- Transcripts, segments and usage records are in our own database.
- Uploaded audio and exported files are on the storage volume described above.
- Backups are a database dump plus a copy of the storage volume.
[ЗАПОЛНИТЬ: где хранятся бэкапы, как они защищены и как часто снимаются] - Payments are in Stripe. Marketing and support mail is in our mail provider.
Deletion
- Deleting a recording removes the file from the live system immediately, and the transcript and its segments from the database with it.
- Deleted content leaves our backups within 30 days.
- Closing an account deletes the account data within 30 days, except the billing and tax records we are legally required to keep.
[ЗАПОЛНИТЬ: владелец — автоматической уборки по срокам в API пока нет; либо включить её, либо смягчить эти сроки в тексте]
Updates and key rotation
- Every production change goes through review, and access to production is limited to the people who need it.
- Credentials are rotated on a defined schedule and immediately on suspicion: the signing secret for session tokens, the payment provider key, the transcription gateway key and the cloud fallback key each have their own rotation procedure, and the procedure is written down so it can be run under pressure.
- The repository is scanned for credential-shaped values before every release, so a secret cannot quietly land in a commit.
What we do not have
No SOC 2 report, no ISO 27001 certificate, no third-party penetration test report and no public status page — yet. We would rather say that plainly than link to a badge that describes somebody else's audit. When we have them, they will be on this page.
Reporting a vulnerability
Write to security@transcrib.si. Tell us what you found, how to reproduce it, and what an attacker could do with it. We acknowledge reports within one working day.
We ask for two things: give us a reasonable chance to fix the problem before you disclose it publicly, and do not access other people's data, degrade the service, or use social engineering. We do not threaten researchers who act in good faith, and we do not require an NDA to receive a report. We will credit you in the fix if you want that, and we will not if you would rather stay anonymous.
Contact
Security reports: security@transcrib.si
Legal and privacy: legal@transcrib.si
Support: support@transcrib.si