Security

Protecting your data is our priority

AssemblyAI uses enterprise-grade security practices to keep your data safe. We approach security by design and default.

Security

Your data stays yours

Every request follows the same path: audio in, transcript out, deleted on a documented schedule. How long anything is kept depends on the API, and you can shorten it.

Audio received

Sent over an encrypted TLS 1.2+ connection

Transcript delivered

Returned to you via API response or webhook

Deleted on schedule

Removed per its retention schedule, or on request via the API

Retention you control

Streaming keeps no audio or transcripts once you opt out of model training. For pre-recorded audio, set a time-to-live as low as one hour, or delete transcripts on demand.

Opt out of model training

Paid accounts can opt out from the Data Controls page. Data under a signed BAA or sent to our EU servers is never used for training.

Encrypted end to end

Data is encrypted in transit with TLS 1.2+ and at rest with AES.

Compliance

Independently verified

Our controls are audited by independent third parties. The latest evidence, reports, and updates always live in our trust center.

SOC 2 Type 2 report

We maintain a SOC 2 Type 2 report covering security, availability, and confidentiality, audited annually by an independent firm. Download the latest report anytime in our trust center.

Penetration tests and vulnerability scans

We conduct third-party penetration tests and run vulnerability scans on a regular cadence across our infrastructure and applications.

Practices

Defense in depth

Security is not one control, it is layers of them. From how engineers reach production to how we ship code and select vendors, each layer is built to hold on its own.

Access control

Role-based access, SSO, and least-privilege permissions govern access to production systems.

Infrastructure security

Hardened cloud infrastructure with network isolation and continuous configuration monitoring.

Monitoring and logging

Centralized logging and continuous monitoring detect and alert on anomalous activity.

Incident response

A documented incident response process with defined roles, escalation paths, and post-incident reviews.

Secure development

Code review, dependency scanning, and security checks are built into our development lifecycle.

Vendor management

Third-party vendors are reviewed for security posture before and throughout engagement.

Full details in our docs

Our documentation is the source of truth for how each API handles retention, encryption, model training, and compliance.

Browse the security FAQ

Deployment options

The same security, wherever you run

Run on our fully managed cloud or inside your own environment. The controls, defaults, and guarantees stay the same either way.

Managed

AssemblyAI Cloud

Fully managed infrastructure with encryption, access controls, and monitoring built in. Retention and model-training controls are managed self-serve from your dashboard, with per-API details in our docs.

Explore deployments

Self-hosted

Self-Hosted Voice AI

Run our models inside your own environment. Audio never leaves your network boundary, with the same controls enforced on your terms.

Explore deployments

Common questions

: Yes, on any paid plan. Owners and Admins can opt out from the Data Controls page; the change applies to new requests. A signed BAA opts you out automatically. How to opt out.
: It depends on the API. Streaming keeps no audio or transcripts when you're opted out of model training. For pre-recorded audio, uploads are deleted within 24–48 hours and transcripts after 30 days by default. You can shorten this with a time-to-live as low as one hour, or delete on demand. Certain metadata is kept for logging and billing. See Data retention and model training for the full schedule.
: For Streaming, yes: audio and transcripts aren't stored once you've opted out of model training. LLM Gateway offers zero data retention for Anthropic and Google models under a signed BAA. Pre-recorded transcription doesn't offer zero retention; set a short time-to-live or delete transcripts via the API instead. See our docs for current per-API details.
: We run third-party external penetration tests plus credentialed internal tests; the latest external summary is in our Trust Center.
: All current compliance evidence, reports, and audit updates are available in our Trust Center. For answers to common security questions, see our FAQ and documentation.
: Our docs are the source of truth. See Data retention and model training for per-API retention schedules, Data Controls for managing opt-out, time-to-live, and BAA settings, and the FAQ for common security questions.