1. Our Commitment

At ConvertAudioToText, the security and privacy of your data is a top priority. We implement industry-standard security measures to ensure your files, transcripts, and personal information are protected at every stage.

2. Encryption

All data is encrypted in transit using TLS 1.2+ (HTTPS). Files stored in our cloud storage are encrypted at rest using AES-256 encryption. API communications between our services are encrypted end-to-end.

3. File Handling

We follow strict data minimization principles for file handling:

Uploaded files are processed by automated AI systems only. No human reviews your content.
For free tool usage (no account), processed files are automatically deleted within 1 hour of download, or within 24 hours if not downloaded.
For registered users, files are retained only as long as your account is active. You can delete files at any time from your dashboard.
Temporary processing files are cleaned up immediately after transcription completes.

4. Infrastructure

Our infrastructure is hosted on industry-leading cloud providers with SOC 2 compliance. File storage uses encrypted object storage with built-in redundancy. Our managed database has automated backups and point-in-time recovery.

5. Compliance

ConvertAudioToText is not itself SOC 2 or ISO 27001 certified, and we do not claim to be. The infrastructure we build on carries those certifications for the hosting and storage layers: Cloudflare for the edge network and object storage, Hetzner for application and database hosting. Payments are handled by our Merchant of Record, who is PCI DSS compliant. For GDPR, ReachUp LTD is the data controller; every subprocessor we use, what data it receives, and where it processes that data is listed on our subprocessors page.

6. Access Controls

Access to production systems is restricted to authorized personnel only. We use role-based access control, multi-factor authentication, and audit logging for all administrative access. Your transcripts are accessible only to you through authenticated API calls.

7. Third-Party Services

We use a third-party AI engine for transcription processing. It processes audio data in real time and does not retain your audio after processing. Payment processing is handled by our Merchant of Record, who is PCI DSS compliant.

8. Vulnerability Reporting

If you discover a security vulnerability, please report it responsibly by emailing security@convertaudiototext.com. We take all reports seriously and will respond within 48 hours.

Security