Data Security and Privacy
How long VoxScriber keeps your audio and transcriptions, where data is stored, how encryption works, and how to control retention.
Your audio files and transcriptions are the most sensitive asset you entrust to us. This article answers the three questions that matter most: how long we keep them, where the data lives, and who can read it.
How long we keep them
| Data | Retention |
|---|---|
| Uploaded audio/video | 30 days after transcription completes |
| Incomplete or failed upload | 1 day |
| File waiting for retries | 7 days |
| Anonymous upload (test page, no account) | 6 hours if not claimed; 30 days after being claimed |
| Transcription text | You decide (see below) |
By default, your transcription text stays in your account forever. In privacy settings, you can enable automatic deletion after 30, 90, 180, or 365 days — the rule only applies to inactive accounts and never deletes transcriptions you've made public via link.
The original audio is deleted 30 days after transcription — what remains is the text. Need the media file long-term? Keep your own copy.
Where data is stored
Data residency follows the account region:
- European accounts (EU/EEA/UK): database in Amsterdam and files in a dedicated European bucket;
- Brazil and other regions: database in Chicago and files in the standard bucket.
The router that decides the region doesn't store personal data — it works via an irreversible hash of the email. More in Domains and regions.
Who can read it (encryption)
Transcription content — text, speakers, and enriched data — is encrypted with AES-256-GCM using a per-user individual key (DEK) on all plans. CPF and phone numbers are also encrypted at rest, separately.
In practice: a database leak alone results in unreadable content. The full design, including the trade-off that allows password recovery without losing transcriptions, is at Encryption and data key (DEK).
Your controls
- Text retention: set automatic deletion in privacy settings;
- Sessions: view and disconnect devices in the sessions panel (up to 5 simultaneous);
- LGPD/GDPR rights: export, correct, and delete data — see LGPD and GDPR;
- Delete account: definitive process described in Delete my account.
Frequently asked questions
Do you use my audio to train AI?
Your files are processed to generate your transcription and deleted within 30 days. The content remains encrypted with your key — it's not an internally open dataset.
I deleted a transcription — is it really gone?
Deletion removes the content from your account. Remember that the original audio is already deleted automatically 30 days after processing.
I'm in Europe — do my data leave Europe?
European accounts reside in infrastructure in Europe (database in Amsterdam, files in a European bucket).
Is a transcription shared via link public?
Only for whoever has the link/token you generated. Public transcriptions are outside automatic retention deletion — remove sharing if you want the rule to apply to them.
Do VoxScriber employees read my transcriptions?
Content is encrypted per user. Support operations work with metadata (status, dates, usage); content access is exceptional and audited.
Keep learning
- Encryption and data key (DEK) - How content is encrypted
- LGPD and GDPR - Your rights as a data subject
- Domains and regions - Data residency
- Delete my account - Permanent deletion
Still have questions? Open a ticket and we'll get back to you quickly.