Trust Center
Can your company trust SozAI with its recordings?
Where your data lives and who processes it, plus the certificates we don't have. Every answer links to its proof.
The short answer
SozAI is a transcription app for phones, tablets, Macs and the web. It stores your recordings and transcripts on servers at Hetzner in Germany, and every connection uses HTTPS. The audio of each file or recording goes to AssemblyAI in the US for speech recognition, and transcript text goes through OpenRouter to AI models for notes and chat. SozAI's code does not use your recordings to train models, and you can delete a recording or your whole account yourself. We have no SOC 2 report, no ISO 27001 certificate of our own, no SSO, no audit logs and no HIPAA BAA.
The table below is the whole picture on one screen. Each row links to the page that backs it up, so a security reviewer can check us instead of trusting us.
Controls at a glance
Answers as of 27 October 2026. If a row and the page it links to ever disagree, tell us at [email protected] and we'll fix the one that's wrong.
| Control | What SozAI does | Evidence page |
|---|---|---|
| Where data is stored | The database (accounts, transcripts, notes, flashcards, quizzes) and the audio files are on our servers at Hetzner in Germany. Hetzner's data center parks are ISO/IEC 27001 certified. That certificate is Hetzner's, not ours. | Security, Sub-processors |
| Encryption in transit | Every connection to SozAI uses HTTPS (TLS 1.2 or 1.3). Cloudflare decrypts traffic at its edge and encrypts it again on the way to our servers. | Security |
| Encryption at rest | Not added by us. We don't encrypt the server disks ourselves. The nightly database backups are encrypted on the server before they leave it. | Security |
| Access to your library | Your recordings open after you sign in to your own account. Each person has their own account and library. On a Team or Education plan, the buyer manages seats and cannot open members' recordings. | Terms |
| Sign-in | Google, Apple, or a six-digit code we email you, valid for three minutes. There are no SozAI passwords. There is no two-factor setting of our own and no SSO. | Security |
| Deletion | You delete a recording or your whole account yourself in any app or at web.sozai.app. That removes the audio and everything made from it from our servers. | Delete a recording, Delete an account |
| Retention | Transcripts and notes stay until you delete them. Audio stays as long as your setting says: keep it (the default), 30 days, or delete it right after transcription. A deleted transcript can remain in an encrypted backup for up to 12 months, and AssemblyAI keeps the copy it processed under its own terms. | Security |
| Backups | The database is backed up every night to Cloudflare R2, encrypted. We keep 14 daily, 8 weekly and 12 monthly copies and test a restore once a month. Audio files are not in these backups. | Security |
| Sub-processors | Every company that receives your data is named, with what it gets and which action sends it there. The page and its date change whenever the list does. | Sub-processors |
| AI and model training | Speech recognition runs at AssemblyAI (US). Text tasks go through OpenRouter to models from Anthropic, Google or xAI. Our code does not use your recordings to train models. Providers work under their own terms. | How SozAI uses AI |
| Payments | App subscriptions are billed by the App Store or Google Play. Web plans are sold by Polar, our merchant of record, which charges the card and issues receipts and invoices. Card details never reach SozAI: you enter them at the store or in Polar's checkout. | Terms, Refund policy |
| Certifications | None of our own. No SOC 2 report, no ISO 27001 certificate, no HIPAA compliance, no BAA. | Security |
| Team administration | One buyer adds seats and sends invites. No SSO, no SCIM provisioning, no audit log, no admin roles, no shared team folders. | SozAI for business |
| Service status | No public status page. The Terms do not promise uninterrupted access. | Terms |
| Data processing agreement | Our DPA and how to request it. | DPA |
| Security questionnaire | 80 vendor-review questions, each answer dated and traced to its source. | Security questionnaire |
| Vulnerability reporting | Email [email protected] with “Security” in the subject. No paid bug bounty. | How to report, security.txt |
Where one recording travels
Take a one-hour interview you upload at web.sozai.app. The file reaches our servers in Germany over HTTPS and is stored there. Its audio goes once to AssemblyAI in the United States, which sends back the text with speaker labels and timestamps. From then on the AI features work from that text: when you ask for notes or a quiz, the transcript goes through OpenRouter to the model assigned to that task. No AI model other than speech recognition receives the audio.
Two routes are different. A YouTube link goes to the Google Gemini API, which gets the link and our instructions and none of your audio. A meeting recorded in the Mac app is transcribed on the Mac itself: the audio is not uploaded, and only the finished text is saved to your account. The details, including what consent the apps ask for, are on How SozAI uses AI.
The free tools on sozai.app follow other rules
The free study and summary tools at sozai.app/tools/ work without an account. They send the text you paste to free AI models through OpenRouter, and the providers of free models may keep or use what they receive. Keep confidential text out of them and use the app instead, where the table above applies.
When SozAI is not a fit
Pick something else if any of these is true for you:
- you handle patient information and need a HIPAA BAA. For clinical notes, our sister app notavik keeps the recording and the notes on the device;
- your security policy requires a SOC 2 report or SSO from every vendor;
- audio must never leave the EU. Speech recognition runs in the US;
- an administrator needs to see or manage every member's recordings. Each person's library is their own.
If none of these applies, SozAI fits interviews and internal meetings, as long as the people you record know about it.
If something goes wrong
- Contain: cut the affected access, rotate keys, stop the affected service if needed.
- Assess: what data, which accounts, since when, from the server logs.
- Notify: customers whose data is affected, by email, without undue delay; we aim for 72 hours after confirming a breach (DPA, Section 10).
- Fix and review: close the cause, check that the fix holds, and update this page and the security questionnaire if anything in them changed.
The database is backed up every night and a restore is tested monthly. Our targets are at most 24 hours of data lost and the service back within 24 hours.
Reporting a vulnerability
Email [email protected] with “Security” in the subject. Tell us what you found and the steps to reproduce it, and name the part of SozAI it affects. We read reports in English and Russian, and we usually reply within a working day.
While you test, we ask three things:
- Use only your own account. Don't open or change data that belongs to anyone else, and stop as soon as you see someone else's data.
- Don't run denial-of-service or load tests, and don't send automated floods of requests.
- Give us time to fix the problem before you publish it, and tell us when you plan to.
We don't run a paid bug bounty. The same contact is published in machine-readable form at /.well-known/security.txt.
Answers
Frequently asked questions
Is SozAI safe to use for confidential business meetings?
It is if your rules allow a US speech recognition processor and AI model providers that work under their own terms. Files are stored in Germany, every processor is named on /subprocessors/, and you can delete a recording yourself. If audio must stay on your own machine, record the meeting in the Mac app, which transcribes on the Mac.
Does SozAI train AI models on my data?
SozAI does not: nothing in our code sends your recordings or transcripts into model training. The companies that process them (AssemblyAI and the model providers behind OpenRouter) handle data under their own terms, linked from /subprocessors/. Details are on /trust/ai/.
Where does SozAI store my data?
On our servers at Hetzner in Germany: the database and the audio files. The encrypted nightly database backups are in Cloudflare R2. Processing is not limited to the EU: speech recognition runs at AssemblyAI in the United States.
Is SozAI SOC 2 or ISO 27001 certified?
No. We have no SOC 2 report and no ISO 27001 certificate of our own. The Hetzner data center parks that host our servers are ISO/IEC 27001 certified, but that certificate belongs to Hetzner.
Does SozAI support SSO or SCIM for my organization?
No. There is no SSO (SAML or OIDC), no SCIM provisioning and no audit log. People sign in with Google, Apple or a one-time email code, and a team buyer invites members by email or a single-use link.
Is SozAI HIPAA compliant, and will you sign a BAA?
No. SozAI is not HIPAA compliant and we don't sign a Business Associate Agreement, so don't use it for patient information. Our sister app notavik keeps clinical recordings and notes on the device.
Does SozAI have a data processing agreement?
Our data processing agreement and the way to request it are on /dpa/. For a question it doesn't answer, write to [email protected].
How do I report a security vulnerability in SozAI?
Email [email protected] with “Security” in the subject. Describe what you found and how to reproduce it. Test only on your own account, don't run load tests, and give us time to fix it before you publish. We don't run a paid bug bounty.
Turn your next recording into text
Record, upload a file or paste a link. You get the transcript, speakers and a summary back.
Free on iOS and Android. No account required for YouTube transcripts.