Is HappyScribe safe? How we protect your data
Your recordings, transcripts and meeting notes are encrypted in transit, stored in the EU and only used to train AI if your workspace opts in. Our security is independently audited to SOC 2 Type II.
Rated 4.6 on G2
SOC 2 Type II
GDPR compliant
Trusted by 6M+ users and 41,000+ teams of all sizes
Certified, compliant and stored in the EU
An independent auditor checks our controls, every customer can sign a DPA, and your files are stored in the EU.
SOC 2 Type II
GDPR compliant
Hosted in the EU
Stored in Europe, with every provider listed
HappyScribe is a European company. Your files are stored in the EU, on AWS in Ireland, Wasabi in France and Cloudflare with EU data jurisdiction. Our applications and databases run in Ireland and Germany, and every connection is encrypted with TLS.
Some AI features, such as summaries and AI Chat, use providers outside the EU under Standard Contractual Clauses.
GDPR compliant
HappyScribe is a European company, so GDPR is the baseline we build on. Here is what it means for your data:
- A Data Processing Agreement for every customer who needs one
- Files stored in the EU, with every subprocessor and its location listed publicly
- Transfers outside the EU covered by Standard Contractual Clauses
- EU-only processing on the Enterprise plan, so AI features run on models hosted in the EU
- Export or delete your files at any time, and a deleted workspace's data is erased after 30 days
The right access for the right people
Give every person a role, owner, admin, member or guest, and choose who can view or edit each file and folder. Link sharing stays off until you turn it on.
- Two-factor authentication on every plan
- Single sign-on for Enterprise, set up with our team
- Brute-force attempts on accounts are blocked automatically
Controls your IT team can set once
On the Enterprise plan, admins set the rules for the whole company:
- Require single sign-on for every member
- Add people to the right workspaces automatically when they sign in with your identity provider
- Turn on EU-only processing for AI features
- Block downloads for members who can only view files
- Choose which meetings the AI Notetaker may join, and lock the setting
- Set automatic retention rules for recordings, transcripts and summaries
Your files only train AI if you opt in
Workspace owners decide whether files can be used to improve AI models. If you opt in, files are de-identified first. If you don't, they aren't used, and you can withdraw at any time.
Delete any recording, transcript or note whenever you want: it goes to the trash, and from there you can delete it permanently. When a workspace is deleted, its data is erased 30 days later.
- Automatic data retention on the Enterprise plan: delete recordings, transcripts and summaries on their own schedule, from 14 days to 10 years
A notetaker everyone on the call can see
The HappyScribe AI Notetaker joins Zoom, Google Meet and Teams as a named participant and posts a recording notice in the meeting chat, so everyone knows notes are being taken.
You choose which meetings it joins automatically. Anyone on the call can type !pause or !remove to stop it, and if you'd rather have no bot at all, record from your Mac or phone.
Checked by outside auditors, not only by us
Our SOC 2 Type II audit by Prescient Assurance covered November 2024 to March 2026, and an external penetration test ran in 2025. More than 60 security controls are monitored continuously.
Request the SOC 2 report, bridge letter and pentest summary in our Trust Center, under NDA.
How we keep HappyScribe secure
-
Encryption
Every connection uses TLS, and files stored with our cloud providers are encrypted at rest.
-
Network protection
Firewalls, intrusion detection and DDoS mitigation sit in front of every service.
-
Backups and recovery
Critical systems are backed up, and our business continuity and disaster recovery plans are tested.
-
Secure development
Code review, dependency checks and automated security testing before code ships.
-
Secure payments
Payments run through Stripe, a PCI Level 1 provider. We never store card details.
-
Report a vulnerability
Email hi@happyscribe.com. We investigate every report and won't take action against good-faith research.
Security in detail
Infrastructure
HappyScribe runs entirely on established cloud providers. We don't operate our own servers or data centers.
- Applications run on Heroku and AWS in Ireland, and on Hetzner in Germany
- Databases are hosted by Crunchy Bridge in Ireland
- Media files are stored on AWS in Ireland, Wasabi in France and Cloudflare with EU data jurisdiction
- Production systems sit in private networks behind firewalls, with intrusion detection and DDoS protection
Encryption
Every connection to HappyScribe uses HTTPS with TLS, enforced in production. Files stored with our cloud providers are encrypted at rest, and access to encryption keys is restricted.
Accounts and sign-in
- Two-factor authentication with an authenticator app and backup codes, on every plan
- Repeated failed sign-in attempts are detected and blocked
- Single sign-on on the Enterprise plan, which can be required for every member
- Roles (owner, admin, member, guest) and per-file permissions decide who sees what
Application security
We monitor our applications for errors, anomalies and attacks, protect them against common web attacks such as those in the OWASP Top 10, and keep logs that provide an audit trail of system activity.
Secure development
- Every code change is reviewed before it ships
- Dependencies are kept up to date and checked for known vulnerabilities
- Static and dynamic security testing runs on our code and applications
- Engineers take regular security training
AI providers and subprocessors
Transcription and AI features use specialised providers, including AssemblyAI, Speechmatics, Deepgram, Soniox, Google Cloud, ElevenLabs, OpenAI and Anthropic, as well as models we host ourselves. Each provider, what it does and where it processes data is listed in our Trust Center.
Your files are only used to train AI if your workspace opts in, and they are de-identified first.
Data retention and deletion
Your files stay in your account until you delete them. Deleted files go to the trash, and deleting them from there permanently removes the media and every transcript version. When a workspace is deleted, its data is erased 30 days later. On the Enterprise plan, admins can set automatic retention rules for recordings, transcripts and summaries.
Backups and business continuity
Critical systems are backed up, and our business continuity and disaster recovery plans are documented and tested. We also carry cybersecurity insurance.
Employee access
Access to production systems is limited to the people who need it and requires a unique account. Staff only access a customer account to help with a support request, and that access is logged. Every employee signs a confidentiality agreement when they join.
Payments
Card payments are processed by Stripe, a PCI Level 1 certified provider. HappyScribe never sees or stores your card details.
Vulnerability disclosure
If you find a security issue, email hi@happyscribe.com. We investigate every legitimate report and won't take legal action against anyone who reports in good faith. Please:
- Share enough detail for us to reproduce the issue
- Avoid privacy violations, data destruction and service disruption
- Keep the issue confidential until we have had reasonable time to fix it
Compliance
HappyScribe is SOC 2 Type II certified, audited by Prescient Assurance for November 2024 to March 2026, and GDPR compliant. An external penetration test ran in 2025. The SOC 2 report, bridge letter and pentest summary are available on request in our Trust Center.
HappyScribe is now essential for our work, streamlining our processes and enhancing client connections.
Quentin Guestin
Production Operations Team Lead, Welcome to the Jungle
Security questions, answered
Is HappyScribe safe to use?
Yes. HappyScribe is SOC 2 Type II certified and GDPR compliant. Your files are stored in the EU, every connection is encrypted, and your content is only used to train AI if your workspace opts in. Our security controls are monitored continuously and published in our Trust Center.
Does HappyScribe use my recordings to train AI?
Only if your workspace opts in. Owners and admins choose in the workspace settings. Files used for training are de-identified first, and you can withdraw your consent at any time.
Where is my data stored?
Your files are stored in the EU, in Ireland and France, and our applications and databases run in Ireland and Germany. Some AI features use providers in the US under Standard Contractual Clauses, and Enterprise workspaces can switch to EU-only processing. The full list of providers is in our Trust Center.
Is HappyScribe GDPR compliant, and can I sign a DPA?
Yes. HappyScribe is GDPR compliant and signs a Data Processing Agreement with every customer who needs one. Contact our team to get yours.
How can I get your SOC 2 report?
Request it in our Trust Center at trust.happyscribe.com. We share the SOC 2 Type II report, bridge letter and penetration test summary under NDA.
Can HappyScribe employees see my files?
Only to help with a support request. Internal procedures restrict access to customer content, every employee signs a confidentiality agreement, and staff access to accounts is logged.
Running a security review?
Get our SOC 2 report and subprocessor list in the Trust Center, or talk to our team about your requirements.
SOC 2 Type II · GDPR · Stored in the EU