Audio and video can contain identity, commercial, health, or employment information. A transcription tool should be assessed across its entire data lifecycle—not only by model accuracy.
Uploads and storage
Confirm whether files enter private storage, upload capabilities expire quickly, actual container formats are validated, and source files have a defined deletion point.
- Avoid public buckets and permanent download links.
- Verify that each user can access only their own files and transcripts.
- Ensure failed jobs and orphaned uploads have cleanup policies.
Models, logs, and third parties
Providers should describe model regions, retention, training policies, and subprocessors. Application logs should not contain transcripts, tokens, cookies, or complete provider responses.
- Strip query parameters, fragments, and request bodies before error reporting.
- Inject payment, email, and model keys through a Secret Store.
- Give integrations only the minimum data required for their task.
Sharing, retention, and deletion
Share links should expire, be revocable, and limit fields. Account deletion should coordinate database records, object storage, and active-subscription constraints.
- Do not put raw share tokens in URL queries or logs.
- Define retention for transcripts, share history, and billing audits.
- Understand that lawful third-party retention does not disappear automatically with app deletion.