Encryption in transit
The API and the website accept HTTPS and secure WebSockets only, with TLS 1.2 or 1.3. Plain HTTP is redirected to HTTPS. Traffic between our own servers also runs over encrypted connections.
Security
How we handle your audio and data.
Plain facts about what we keep, where the API runs and who else is involved. The API privacy notice and API terms are the binding versions.
Last updated November 2, 2026.
Audio and transcripts
The same on every plan, including the free trial. There is nothing to switch on.
- Audio is never stored. It is processed in memory, never written to disk, and gone when your stream or request ends.
- Transcripts are not logged. They are sent back to you and not written to our logs.
- No training on your data. We don't train or tune models on your audio or transcripts.
- Debug logging only if you ask. If you ask us in writing to help debug a problem, we may log transcripts for your key for a time you agree to, then turn it off and delete those logs.
What we do keep
| Data | Why | How long |
|---|---|---|
| Usage records: key id, account id, minute, seconds of audio, number of streams | Billing, limits, abuse prevention | As long as tax and accounting law requires (typically 7 years) |
| Technical logs: request id, key id (never the full key), IP address, stream start and end, audio format, timing, error codes | Running, securing and debugging the service | 30 days |
| API keys | Checking access | Only a one-way hash and the public key id, until you revoke the key or close your account |
| Account details and messages you send support | Running your account and answering you | Until you close your account |
API keys
A new key is shown once. We store only a SHA-256 hash of it and its public id, so a lost key can't be recovered, only replaced. You can label and revoke keys and set a monthly spend cap in the dashboard. Keep keys on your server, not in browsers or apps.
Dashboard sign-in
There are no passwords to leak. You sign in with a one-time link sent to your email, which works once and expires after 30 minutes.
Payments
Card payments go through Stripe Checkout and the Stripe billing portal. Card numbers never reach our servers.
Access
Our servers accept connections only on the ports the service needs. Staff access is limited to what running the service requires.
Incidents
If we learn of a security incident that affects your data, we'll tell you without undue delay. Found a vulnerability? Email support@saidwire.com.
Where it runs
In the United States, in AWS US East.
The API processes audio on our servers in AWS US East (Ohio). The website and dashboard also run in AWS US East (Ohio).
A backup API server runs in Google Cloud US East (South Carolina). It takes traffic only when our AWS servers are unavailable.
Live checks of the API, every 5 minutes, are on the status page.
Subprocessors
The outside companies that process data for us to run the API. Audio and transcripts only ever pass through our own servers at the hosting providers; we don't send them to any other company.
| Company | What for | Data involved | Location |
|---|---|---|---|
| Amazon Web Services | Hosting for the API, website and dashboard | Audio in memory while it's transcribed, transcripts in transit, account and usage data | United States (US East) |
| Google Cloud | Backup API hosting, used only when our AWS servers are unavailable | Audio in memory while it's transcribed, transcripts in transit, usage data | United States (US East) |
| Stripe | Payments and billing | Billing name and email, card details, usage totals for invoices | United States |
| Cloudflare | Email routing for saidwire.com addresses | Emails sent to saidwire.com addresses | Global network |
| Google (Gmail) | Our support inbox and the emails we send (sign-in links, usage alerts) | Your email address and the messages | Google data centers |
Compliance, honestly
We're a new company. Here is where we stand today.
- No SOC 2 report yet. We don't have SOC 2 or ISO 27001 certification. We'll say so here when that changes.
- No HIPAA agreement yet. We don't sign business associate agreements (BAAs) yet. Our API terms ask you not to send health, payment card or other specially regulated data unless we've signed an agreement that covers it.
- Data processing agreement on request. For audio you send, you are the controller and we are your processor. Email us for a DPA.
- No uptime commitment during the beta, unless we agree one in writing. Our live checks are public on the status page.
Questions, a DPA or a security review? Email support@saidwire.com.