Security · Privacy · Compliance

Trust, built into every transcript.

Syntrace records, transcribes and analyses online meetings. The content we process is among the most sensitive material a company creates — strategy, customers, people. This page documents how we keep it protected, who can see it, and which independent attestations back that up.

System status All systems operational
Continuous monitoring 142 controls · live
Last updated May 19, 2026
Data residency EU (europe-west1)
01 — Frameworks

Independent attestations & certifications.

A combination of internationally recognised frameworks governs how we operate, with audit reports available under NDA.

SOC 2
Type II
Certified

Annual independent audit of security, availability and confidentiality controls. Continuous evidence collection through Vanta.

Last audit: Mar 2026 · Auditor: Prescient
ISO 27001
2022
Certified

Information security management system covering people, processes and technology. Surveillance audits annually.

Certificate #IS-722491 · Expires Nov 2027
GDPR
EU 2016/679
Compliant

Standard Contractual Clauses, signed DPA available, DPIA on file, Article 30 records maintained and reviewed quarterly.

DPO appointed · Lead authority: IMY (SE)
ISO 27701
Privacy extension
In progress

Privacy information management system extending our 27001 program. Stage 1 audit scheduled.

Target: Q4 2026
ISO 42001
AI management
In progress

First-of-its-kind standard for AI management systems. Aligned with our EU AI Act commitments and model governance.

Target: Q1 2027
EU AI Act
Reg. 2024/1689
Mapped

Classified as limited-risk with transparency obligations. Acceptable use prohibits employee performance monitoring without lawful basis.

Conformity assessment on file
NIS 2
Supply chain
Ready

Supply-chain readiness for customers classified as essential or important entities under Directive (EU) 2022/2555.

NIS 2 questionnaire on request
DORA
Financial sector
On request

ICT third-party provider contract templates and resilience testing for customers in regulated financial services.

Article 30 clauses available
02 — Controls

Three pillars of protection.

Every meeting we process touches each of these in turn — from the moment a participant joins, through transcription and analysis, to long-term storage.

i.

Data Protection

Cryptography, isolation and lifecycle management for every byte of recorded and derived data.

  • AES-256 encryption at rest, per-customer key wrapping
  • TLS 1.3 in transit, mTLS between services
  • BYOK / CMEK available on enterprise plans
  • Configurable retention from 24 hours to 7 years
  • Cryptographic erasure on revocation
ii.

Privacy by Design

Designed so that participants — not just account holders — keep meaningful control over their data.

  • Audible and visual recording notice to every participant
  • Per-participant opt-out with automatic redaction
  • Right-to-erasure executable at the speaker-turn level
  • Granular DSAR tooling for customer admins
  • EU-only data residency by default for EU tenants
iii.

AI Safeguards

Models that summarise and analyse meetings operate under strict use-and-handling guarantees.

  • Zero training on customer data, contractually enforced
  • LLM inference within EU-resident inference clusters
  • Prompt-injection detection & output filtering
  • Acceptable-use policy prohibits employee surveillance
  • Per-tenant audit trail of every AI invocation
03 — Architecture

How meeting data moves.

A transparent map of every step a meeting takes through Syntrace — from the moment a bot joins, to the moment data is permanently erased.

Capture. A meeting bot joins the call through the platform's documented API (Microsoft Teams, Google Meet, Zoom). Participants see an explicit "Recording" indicator and the bot announces itself by voice.

Ingest. Audio and video streams are encrypted in transit (TLS 1.3) and written to an isolated per-tenant object store in the EU region the customer selected.

Transcribe and analyse. Speech-to-text runs in our EU compute environment. Summarisation and analysis prompts are sent to a contractually scoped LLM provider with training disabled.

Store and serve. Transcripts and derived analytics are stored with field-level encryption. Access is mediated by role-based authorisation, SAML SSO and SCIM provisioning.

Retain or erase. Default retention is 90 days; customers can configure between 24 hours and 7 years. Deletion is cryptographic and verifiable.

01

Bot joins meeting

Via documented platform APIs · recording-notice displayed

02

Streams encrypted in transit

TLS 1.3 · per-tenant isolation

03

Transcription & redaction

EU-resident GPU cluster · PII detection · speaker diarisation

04

AI analysis (gated)

No-training contract · per-call audit log · output filtering

05

Encrypted storage

AES-256 · KMS · field-level encryption · configurable retention

06

Cryptographic erasure

Verifiable deletion · per-participant DSAR

04 — Subprocessors

Every subprocessor, named.

A complete list of the third parties that process customer data on our behalf. Subscribe to updates to be notified at least 30 days before any change.

Subprocessor Purpose Region Transfer mechanism
Google Cloud Platform
Primary cloud infrastructure & storage
 europe-west1 EU/EEA Google Cloud Terms · DPA
Anthropic
LLM inference for summarisation & analysis
 eu-west EU/EEA Zero Data Retention · SCC
Recall.ai
Meeting bot infrastructure
 eu-central-1 EU/EEA DPA · SCC
Customer.io
Transactional email (account holders only — no meeting data)
 EU EU/EEA DPA · SCC
05 — Documents

Audit reports & policies.

Documents marked "NDA" require a click-through agreement. Others are open. We respond to requests within one business day.

SOC 2 Type II Report
PDF · 64 pages · Mar 2026
NDA required Request →
ISO 27001 Certificate
PDF · 2 pages · Nov 2025
Public Download →
Data Processing Agreement
PDF · 18 pages · v4.2
Public Download →
Penetration Test Report
PDF · 32 pages · Feb 2026
NDA required Request →
DPIA Summary
PDF · 12 pages · Apr 2026
Public Download →
Information Security Policy
PDF · 24 pages · v3.1
NDA required Request →
Business Continuity Plan
PDF · 16 pages · Jan 2026
NDA required Request →
Vendor Security Questionnaire
CAIQ v4 · SIG Lite available
On request Contact →

Get the full security review pack in one click.

Sign once, get instant access to SOC 2 report, ISO 27001 certificate, DPIA, pen test summary and our latest questionnaire responses.

Request access & sign NDA Subscribe to updates
06 — FAQ

Most asked, upfront.

The eight questions security teams ask us most often, answered in plain language.

Do you use customer data to train AI models?
No. We have contractually enforced no-training clauses with every LLM and STT provider in our supply chain. Customer audio, transcripts and derived analytics are never used to train, fine-tune or evaluate any third-party model. Our own internal models are trained exclusively on synthetic or fully-consented public data.
Where is meeting data stored?
EU customers' data is stored exclusively in Google Cloud europe-west1 (Belgium). Data never leaves the EU/EEA at any point in its lifecycle, including for AI inference. All application services, Cloud SQL, and object storage run in the same region.
How does opt-out work for individual meeting participants?
Each participant receives an explicit recording notice on join (visual and audible). They can opt out via a single click, which excludes their audio from transcription in real time and redacts their speaker turns from any retained recording. The customer admin also has a granular DSAR workflow to handle post-meeting requests, including from non-customers.
What happens when I cancel my subscription?
Your data enters a 30-day grace period during which you can export everything via our API or admin UI. After 30 days, we trigger cryptographic erasure: encryption keys are destroyed, rendering the data permanently unrecoverable. We provide a deletion certificate on request.
Can the platform be used for employee performance monitoring?
Our Acceptable Use Policy explicitly prohibits using Syntrace to evaluate, score or surveil individual employees without an independent lawful basis. We do not provide individual-performance dashboards, and any feature that could be misused for that purpose ships with administrative guardrails. Customers in EU jurisdictions retain full responsibility for works council consultation where applicable.
Are you compliant with NIS 2 and DORA?
We are not directly in scope of NIS 2 ourselves, but we are supply-chain ready for customers who are. For DORA, we offer Article 30-compliant contract addenda for customers in EU financial services, including provisions for resilience testing, subcontracting notice and exit strategies. Both questionnaires are available on request.
Do you support SSO, SCIM and audit log export?
Yes. SAML 2.0 SSO and OIDC are available on all plans; SCIM 2.0 provisioning and audit log streaming (to S3, Splunk, or via webhook) are included on Business and Enterprise plans. BYOK is available on Enterprise.
How do you handle vulnerability disclosure?
We operate a coordinated disclosure program with safe-harbor provisions. Report issues to security@syntrace.com or via our public bug bounty program. We acknowledge within 24 hours and aim for triage within 72.
07 — Contact

Talk to a human.

For anything our Trust Center doesn't cover, reach the team directly.

Security inquiries
Security team

Pen testing, vulnerability reports, security architecture questions and customer audits.

security@syntrace.com
Data protection
DPO & privacy

DSAR requests, DPA execution, sub-processor questions, data residency arrangements.

dpo@syntrace.com
Vendor reviews
Sales & legal

Custom contract language, regulatory questionnaires, procurement reviews and onboarding.

trust@syntrace.com