Answers to your vendor security review.

Data is encrypted in transit (TLS) and at rest (AES-256). Nothing about your calls travels or sits unencrypted.

Firm data is isolated per firm. Access is limited to what's needed to run the service; your confidential audio and transcripts stay inside our systems and are never handed to anyone else.

Your audio is deleted the moment it is transcribed, and transcripts and reports are purged within 72 hours of your readout, or immediately if you ask in writing. If you move to a pilot, your data carries over under the pilot agreement, and the same 72-hour purge applies. Your calls are never used to train our models.

We analyze and transcribe your calls with our own models, over encrypted connections. We do not use your calls, transcripts, or the results to train our models, and we do not sell or share your data. Intake QA does not claim to be SOC 2 certified or HIPAA compliant as a company. We make plain-English commitments and put them in writing.

A data-processing agreement (DPA) is available on request, and we'll sign your NDA, or work from your firm's own paper.

If we become aware of a breach affecting your data, we will notify you within 72hours of becoming aware, with what we know and what we're doing about it.

Intake QA processes calls your firm already recorded. California is an all-party-consent state (Penal Code §632); your firm is responsible for its consent posture. The compliance page covers the recording and disclosure detail.