Where your files are stored and who processes them. What deleting removes. What we don't offer yet.
Your recordings travel over HTTPS and are stored on our servers in Germany, at Hetzner. Speech recognition and the AI features are run by named partners, and every one of them is on our sub-processor list. We don't sell your recordings, and our code never uses them to train models. You can delete a recording or your whole account yourself at any time.
This page is written so you can check it. If something here doesn't match what you see in the product, tell us at [email protected]. The legal text is in our privacy policy.
Everything a reviewer usually asks for is public: the Trust Center with every control and its evidence, a security questionnaire answered in advance, how SozAI uses AI, the sub-processor list and a Data Processing Agreement with the EU Standard Contractual Clauses, which applies automatically to business use.
Your recordings and everything made from them live on our servers at Hetzner in Germany. Hetzner's data center parks there are certified to ISO/IEC 27001:2022. That certificate belongs to Hetzner, not to SozAI: we have no certification of our own.
Every connection from every app and extension uses HTTPS (TLS 1.2 or 1.3). Cloudflare sits in front of our sites, so traffic is decrypted at Cloudflare's edge and encrypted again on the way to our servers. We don't add disk encryption on the servers ourselves. The nightly database backups are encrypted on the server before they leave it.
Audio stays on our servers until you delete the recording or your account, unless you choose in the app to have it deleted 30 days after transcription or right after it. Transcripts are never deleted automatically.
Storage is in Germany, but the work is done by partners, and the largest one is in the US: the audio of every uploaded file and app recording goes to AssemblyAI's US endpoint for speech recognition. The table shows which partner gets what for each thing you do. The full list, with links to each company's own privacy page, is on /subprocessors/.
| When you | Who processes it | What they receive |
|---|---|---|
| Upload a file or record in the app | AssemblyAI (US) | The audio. It returns the text with speakers and timestamps. |
| Paste a YouTube link | Google Gemini API | The link and our instructions. No audio from you. |
| Ask for a summary, notes, flashcards, a quiz, a translation of a transcript or a chat answer | OpenRouter, which passes the request to models from Anthropic, Google or xAI (DeepSeek as a fallback) | The transcript text, plus the pages of a PDF or the photos you add as a source |
| Dictate into a note or use Voice Translate | Apple or Google speech recognition, through your phone's system | The audio you dictate |
| Subscribe | Apple or Google, and RevenueCat | Purchase receipts, subscription status, your app user ID and email |
| Write to support from the app | Telegram, where our support inbox is | Your message and email address; the app adds its version |
The app also sends push notifications through Google Firebase and reports app events such as installs and purchases to Meta for ad measurement. Your recordings and transcripts are not part of those events.
You can delete a recording, or your whole account, yourself, in any of our apps or at web.sozai.app. You don't need to write to support.
Deleting a recording removes its audio file from our servers, along with everything generated from it: the transcript, summary, notes, flashcards, quizzes, translations and chat messages. Two things stay: notes you wrote yourself in Notes from that recording, and an empty chat thread. Deleting your account removes everything that belongs to it, including those notes. If you signed in with Apple, we also revoke the Apple sign-in token.
Three limits you should know about:
There are three ways in: Google, Apple, or a six-digit code we email you, valid for three minutes. SozAI has no passwords, so there are none to leak or reuse. The phone app can also start as a guest, without an email; the web app always asks you to sign in. One account works everywhere you can sign in to SozAI.
There is no separate two-factor option. If your Google or Apple account has two-factor sign-in turned on, that protects your SozAI sign-in too.
A security review goes faster when the gaps are written down, so here they are:
The quiz and flashcard tools and the summarizers on sozai.app/tools/ need no account and keep your results in your browser. To make the questions or cards, they send the text you paste, or the text of the YouTube video or PDF you choose, to free AI models through OpenRouter. The providers of free models may store or use what they receive under their own terms. Don't paste anything confidential there; use the app instead.
When a tool transcribes a file, it sends the first five minutes of audio to AssemblyAI and deletes that job after processing.
Email [email protected] with "Security" in the subject. Tell us what you found, how to reproduce it, and which part of SozAI it affects. We usually reply within a working day. Please give us a chance to fix the problem before you publish it, and don't access other people's data while testing. We don't run a paid bug bounty.
Email us what you found and how to reproduce it. We usually reply within a working day.
Answers
On the way to us and back, yes: every connection uses HTTPS (TLS 1.2 or 1.3). On our servers it can't be hidden from us, because our servers and the speech recognition partner have to read the audio to transcribe it. We don't add disk encryption on the servers. The nightly database backups are encrypted before they leave the server, with a key that stays with us.
Your recordings and account data are stored on our servers at Hetzner in Germany. The audio does leave the EU once: speech recognition runs at AssemblyAI's US endpoint. The AI features send transcript text to OpenRouter and the model providers behind it. Each partner and its location is listed on our sub-processors page.
We don't, and we don't sell them. Nothing in SozAI's code sends your recordings or transcripts into model training. The partners that process them, such as the speech recognition provider and the AI model providers, work under their own terms, and we link each one from the sub-processors page so you can read them yourself. The free tools on the website use free models, whose providers may keep what they receive.
The audio file and everything generated from it are removed from our servers right away. Notes you wrote yourself in Notes stay until you delete them. An encrypted copy of the database can remain in our backups for up to 12 months. The speech recognition partner's copy follows its own retention terms; we don't send it a delete request yet.
Neither. We don't sign a Business Associate Agreement and we have no SOC 2 report, so SozAI is not the right tool for patient information. It's fine for lectures and research interviews. Clinicians can look at notavik, our sister app, which keeps the recording and the notes on the device. The data centers we rent are ISO/IEC 27001 certified, but that certificate is Hetzner's.
Not yet. You sign in with a Google or Apple account, or with a six-digit code sent to your email, which is valid for three minutes. There are no SozAI passwords. If your Google or Apple account uses two-factor sign-in, that protects your SozAI sign-in as well. Single sign-on and team admin roles don't exist today; if your team needs them, tell us at [email protected].
We don't put a badge on it, because a badge proves nothing. Here is what you can check: your data is stored in Germany, every company that processes it is listed publicly, and you can export your transcripts and delete a recording or your whole account yourself. Speech recognition happens in the US. Our Data Processing Agreement includes the EU Standard Contractual Clauses and applies automatically to business use.
