Vendor review
SozAI security questionnaire, answered
Answers as of 27 October 2026. 78 questions about how SozAI handles customer data, each answered next to the page that backs it up.
The short answer
Answers as of 27 October 2026. SozAI stores customer data on servers at Hetzner in Germany and encrypts every connection with HTTPS, but does not encrypt server disks itself. Speech recognition runs at AssemblyAI in the US, and text tasks go through OpenRouter to named model providers. Users delete their own data; encrypted database backups keep it for up to 12 months. There is no SOC 2 report, no ISO 27001 certificate of our own, no SSO, no SCIM, no audit log and no HIPAA BAA.
Below are 78 questions taken from the short vendor questionnaires security teams send, in the order those questionnaires usually ask them. Answers are literal. If a question you need is missing, write to [email protected].
Company
| Question | Answer | Where to check |
|---|---|---|
| What is the vendor's legal name and country? | VAST FLOW, TOO, a company registered in Kazakhstan and founded by Merey Tleugazin. The registered address is printed on the refund policy. | About, Refund policy |
| When was the product first released? | September 2025, in the App Store. | About |
| How many people work at the company? | One. SozAI is built and run by its founder, Merey Tleugazin. | About |
| Which products do these answers cover? | The SozAI apps for iPhone, iPad, Mac and Android, the web app at web.sozai.app, and the browser extensions. The free tools on sozai.app/tools/ work differently and are listed separately. | Sub-processors |
| Who is the security contact? | [email protected], with "Security" in the subject. | Reporting a vulnerability |
Data handling
| Question | Answer | Where to check |
|---|---|---|
| What customer data do you process? | Account details: the email address, and the name that comes with Google or Apple sign-in. Content: the audio you upload or record and the YouTube links you paste, plus the transcripts and everything made from them. Purchase status and app usage events. | Privacy policy, Sub-processors |
| Do you sell customer data? | No. | Security |
| Is customer content used for advertising? | No. The apps report events such as installs and purchases to Meta for ad measurement. Recordings and transcripts are not part of those events. | Sub-processors |
| Are recordings visible to other users? | No, unless you share one yourself. | Where recordings are stored |
| Can the buyer of a Team plan read members' recordings? | No. Each member's recordings stay in that member's own account. | Terms |
| Can SozAI be used without an account? | The phone app and the extensions can start as a guest, without an email address. The web app always asks you to sign in. | Security |
Storage and location
| Question | Answer | Where to check |
|---|---|---|
| Where is customer data stored? | On our servers at Hetzner in Germany: the database and the audio files. | Security |
| Is the hosting provider certified? | Yes. Hetzner's data center parks are ISO/IEC 27001 certified. The certificate is Hetzner's, not SozAI's. | Sub-processors |
| Does data leave the EU? | Yes. Speech recognition runs at AssemblyAI in the United States, and OpenRouter and the model providers behind it, which receive transcript text for the AI features, are outside the EU as well. | Sub-processors |
| Can we choose the region where data is stored or processed? | No. | Sub-processors |
| Is each customer's data kept apart? | Each person has their own account and library. There are no shared team workspaces. | Security |
Encryption
| Question | Answer | Where to check |
|---|---|---|
| Is data encrypted in transit? | Yes. HTTPS on every connection, TLS 1.2 or 1.3. | Security |
| Where is TLS terminated? | At Cloudflare's edge. Traffic is encrypted again between Cloudflare and our servers. | Security |
| Is data encrypted at rest on your servers? | No. We don't add disk encryption to our servers. | Security |
| Are backups encrypted? | Yes, on the server before upload. The key stays with us. | Security |
| Is audio encrypted so that SozAI itself cannot read it? | No. Our servers and the speech recognition provider read the audio to transcribe it. | Security |
Access and authentication
| Question | Answer | Where to check |
|---|---|---|
| How do users sign in? | With a Google or Apple account, or with a six-digit code we send by email, which is valid for three minutes. | Security |
| Do you store user passwords? | No. SozAI accounts have no passwords. | Security |
| Is multi-factor authentication available? | Not as a SozAI setting. If a user signs in with a Google or Apple account that has two-factor sign-in turned on, that second factor protects the SozAI sign-in as well. | Security |
| Is SSO (SAML or OIDC) supported? | No. | Security |
| Is SCIM user provisioning supported? | No. | Not published |
| Are there admin roles or permission levels? | No. On a Team or Education plan, the buyer adds seats and invites members. There are no other roles. | Terms |
| Are audit logs of user activity available? | No. | Security |
| Are sign-in and sign-up attempts rate-limited? | Yes. | Not published |
| Is a stored audio file reachable only after sign-in? | Yes. Since 26 October 2026 an audio file is served only to the account that owns it; any other request gets “not found”. | Not published |
| Who at SozAI can access customer data? | Only the founder. No other employee or contractor has access to production systems or customer data. | Not published |
| Is staff access to production protected by MFA? | Yes. Administrative access to production is protected by two-factor authentication or key-only access. | Not published |
Sub-processors
| Question | Answer | Where to check |
|---|---|---|
| Do you publish a list of sub-processors? | Yes, with what each one receives and which action sends it there. | Sub-processors |
| Who receives the audio of a recording? | Hetzner stores it on our servers in Germany, AssemblyAI transcribes it in the United States, and Cloudflare carries it on the way there, as it carries all traffic to our domains. | Sub-processors |
| Who receives transcript text? | OpenRouter, which passes each request to a model from Anthropic, Google or xAI. DeepSeek answers only when the main model for a task fails. | Sub-processors |
| Who handles YouTube links? | The Google Gemini API. It receives the link and our instructions, no audio from you. | Sub-processors |
| Where do support messages sent from the app go? | To Telegram, where our support inbox is. | Sub-processors |
| How are sub-processor changes announced? | We update the sub-processors page and its date, and note the change in the changelog. On request, we email you when the list changes. | Sub-processors, Changelog |
| Can we object to a new sub-processor? | Yes. We announce a new sub-processor on the sub-processors page at least 14 days before it starts, and you may object on reasonable data-protection grounds. | DPA, Section 8 |
AI and model training
| Question | Answer | Where to check |
|---|---|---|
| Does SozAI train models on customer data? | No. Nothing in our code sends recordings or transcripts into model training. | How SozAI uses AI |
| Which tasks use AI? | Speech recognition; YouTube transcription; summaries and notes; titles; flashcards and quizzes; translation; chat with a recording; reading text from PDF pages and photos you add. | How SozAI uses AI |
| Does audio go to the models that write notes and summaries? | No. Those models receive the transcript text. PDF pages and photos you add as a source go to a model that reads the text in them. | Sub-processors |
| Can the model behind a task change? | Yes. We choose the model for each task on our side and can switch it without an app update; when that changes the provider, the sub-processors page changes with it. | Sub-processors |
| Do users consent to AI processing? | Yes. The apps and the web app show "How SozAI handles your recordings" once, with one button, "Accept and continue". An account that has not accepted gets no automatic AI notes or summary. | How SozAI uses AI |
| Is there an on-device option? | For meetings on a Mac, yes. SozAI for Mac transcribes them on the Mac; the audio is not uploaded and only the text is saved to the account. | How SozAI uses AI |
| Do the free tools on sozai.app follow the same rules? | No. They send the text you paste to free models whose providers may keep or use it. | Sub-processors |
Retention and deletion
| Question | Answer | Where to check |
|---|---|---|
| How long is customer data kept? | Until you delete the recording or the account. Ending a subscription deletes nothing. | Security |
| Is audio deleted automatically after transcription? | If you choose it. You choose in the app how long audio stays after transcription: keep it (the default), 30 days, or delete it as soon as the transcript is ready. Transcripts and notes stay until you delete them. | Security |
| Can users delete a recording themselves? | Yes: Delete recording is in every app and in the web app. | Delete a recording |
| What does deleting a recording remove? | The audio file and the transcript, with everything made from it (summary, notes, flashcards, quizzes, translations, chat messages). Notes you wrote yourself from that recording stay until you delete them or the account. | Security |
| Can users delete their whole account themselves? | Yes. The app and the web app both have Delete account, and it removes everything that belongs to the account. | Delete an account |
| Do deleted records remain in backups? | Yes, for up to 12 months, in the encrypted database backups. | Security |
| Does deletion reach the speech recognition provider? | No. Deleting in SozAI does not send AssemblyAI a delete request; its copy follows AssemblyAI's own retention terms. | Security |
| Can we export our data? | Partly. Each transcript exports as PDF, TXT, SRT, VTT or JSON in the app, and the web app exports TXT and subtitles (SRT, VTT). Audio files and a one-file export of a whole account are not available; for a full copy, write to us. | Download my recordings |
Backups and continuity
| Question | Answer | Where to check |
|---|---|---|
| How often is the database backed up, and where to? | Every night, to Cloudflare R2, encrypted before upload. | Security |
| How long are backups kept? | 14 daily, 8 weekly and 12 monthly copies. | Security |
| Are restores tested? | Yes. Once a month the latest backup is restored and checked. | Security |
| Are audio files backed up? | No. | Security |
| Do you have a documented disaster recovery plan with recovery time and recovery point targets? | Yes. The database is backed up every night and a restore is tested every month. Targets: at most 24 hours of data lost and the service back within 24 hours. | Trust Center |
| Is there a public status page? | No. | Not published |
| Do you commit contractually to service availability? | No. The Terms do not promise uninterrupted access. | Terms |
Incident response
| Question | Answer | Where to check |
|---|---|---|
| How do we report a security problem? | Email [email protected] with "Security" in the subject. We usually reply within a working day. | Reporting a vulnerability, security.txt |
| Do you run a paid bug bounty? | No. | Reporting a vulnerability |
| Do you have a documented incident response plan? | Yes, a short one: contain, assess, notify the affected customers, fix and review. | Trust Center |
| How and how fast will you notify us of a breach affecting our data? | By email, without undue delay after we become aware of it; we aim to send the notice within 72 hours of confirming the breach. | DPA, Section 10 |
Compliance and certifications
| Question | Answer | Where to check |
|---|---|---|
| Do you have a SOC 2 report? | No. | Security |
| Do you hold an ISO 27001 certificate? | No, not of our own. Hetzner's data center parks are certified. | Sub-processors |
| Are you HIPAA compliant, and will you sign a BAA? | No to both. Don't use SozAI for patient information. | Security |
| Are you GDPR compliant? | We don't claim a GDPR badge. Data is stored in Germany, every processor is named, and users delete their data themselves. Speech recognition runs in the US. | Security |
| Do you offer a data processing agreement? | See our DPA page. | DPA |
| Is a third-party audit or penetration test report available? | No. | Not published |
Payments
| Question | Answer | Where to check |
|---|---|---|
| How are app subscriptions paid? | Through the App Store or Google Play. | Terms |
| Who sells web plans? | Polar, our merchant of record. It charges the card and handles sales tax or VAT. Receipts and invoices come from Polar. | Terms |
| Can invoices carry our company name and tax ID? | Yes. Polar's invoices show the buyer's company name and tax ID, with EU VAT reverse charge where it applies. | Not published |
| Can we pay by purchase order, bank transfer or net-30? | Not available. Web plans are paid by card in Polar's checkout. For anything else, write to [email protected]. | Not published |
| What is the refund policy? | Web plans: a full refund within 14 days of a payment if no more than 60 minutes were transcribed in that period. Store purchases: Apple or Google decide. | Refund policy |
Support
| Question | Answer | Where to check |
|---|---|---|
| How do we reach support? | Email [email protected]. | Contact |
| What is your response time? | We usually reply within a working day. There is no contractual response time. | Contact |
Answers
Frequently asked questions
Can I copy these answers into our vendor questionnaire?
Yes. Copy them with the date at the top of the page, and check the linked page for any answer your review depends on, since that page changes first when a control changes.
Is this a SOC 2 report or a certified CAIQ?
No. It is a list of common vendor-review questions that we answered ourselves. No auditor has checked it, and SozAI has no SOC 2 report.
Will SozAI fill in our own security questionnaire?
Send it to [email protected] with "Security questionnaire" in the subject. We answer from the same facts as this page, so expect the same answers, including the honest no's.
Does SozAI use customer data to train AI models?
SozAI's own code does not. The AI providers that process the data work under their own terms, and our requests set no option that forbids training or retention. The details are on /trust/ai/.
Where is SozAI customer data stored?
On servers at Hetzner in Germany. Processing is not limited to the EU: speech recognition runs at AssemblyAI in the United States.
Turn your next recording into text
Record, upload a file or paste a link. You get the transcript, speakers and a summary back.
Free on iOS and Android. No account required for YouTube transcripts.