What should be on a transcription vendor security checklist before sending sensitive audio?

Choosing a transcription vendor without a security review is one of the easiest ways to leak confidential information, and the consequences are well documented. In 2023, the PJ&A data breach linked to Concentra exposed the records of nearly 4 million patients, demonstrating that even large, established transcription and medical documentation vendors can be compromised. If you handle legal recordings, medical dictation, HR interviews, or proprietary business audio, you need a formal transcription vendor security checklist before you upload a single file. This guide walks through every item that checklist should contain, why each one matters, and how to evaluate vendors like AI transcription platforms and human-in-the-loop services against it.

Why Vendor Security Matters More Than Ever

Also worth reading: How Does Offline Voice Transcription Privacy Protect Your Sensitive Conversations? · What Does a Reliable HIPAA Transcription Compliance Checklist Include in 2026? · Can FIDO2 Backup Key Security Protect Your AI Transcription Data?

The transcription industry has shifted dramatically toward AI-powered services that process audio in the cloud, often within minutes. That speed is a genuine productivity gain, but it also means your recordings are being transmitted, stored, and processed on infrastructure you do not control. Every upload is a data transfer to a third party, and under regulations like HIPAA, GDPR, and various state privacy laws, you remain responsible for what happens to that data even after it leaves your hands.

The PJ&A and Concentra incident is the cautionary tale here. A breach at a transcription subcontractor exposed records affecting almost 4 million patients, and the fallout took years to resolve. The lesson is not that transcription is inherently risky, but that the chain of custody matters. Many vendors subcontract work to freelancers or smaller processors, and each additional handoff multiplies your exposure. A vendor that cannot tell you exactly where your audio goes, who touches it, and how long it is retained is a vendor you should not trust with sensitive material.

There is also a legal dimension. Reed Smith has published analysis on the legality of AI-powered recording and transcription, noting that consent requirements for recording conversations vary significantly by jurisdiction. Some regions require all-party consent, meaning recording a call without every participant agreeing can itself be illegal, regardless of what you do with the transcript afterward. Your security checklist should therefore start before the vendor is even involved: confirm you have the legal right to record and transcribe the audio in the first place.

The Core Checklist: Certifications and Compliance

The first section of any transcription vendor security checklist is formal certifications. These are not perfect proxies for security, but they demonstrate that an independent auditor has reviewed the vendor's controls. Ask for the following and verify, do not just take a salesperson's word.

SOC 2 Type II is the baseline expectation for any vendor handling business data. It confirms that security, availability, and confidentiality controls were audited over an extended period, typically 6 to 12 months of observation. A SOC 2 Type I report only covers a point in time and is much weaker evidence. ISO 27001 is the international equivalent and is common among European vendors. If you handle health data, the vendor must sign a Business Associate Agreement under HIPAA, and they should be able to produce one without hesitation. Refusal or hesitation on a BAA is an immediate disqualifier.

For legal and government work, ask about FedRAMP authorization or ITAR compliance where relevant. For European audio subjects, GDPR compliance means the vendor needs a data processing agreement, a documented lawful basis for processing, and clarity on data residency. Some vendors process audio in the United States even for EU customers, which can create transfer complications under GDPR Chapter V. Ask directly where processing occurs and whether EU data can be kept within EU data centers.

One nuance worth being critical about: certifications are table stakes, not proof of safety. Companies with certifications have been breached. Treat SOC 2 as a filter that removes the obviously careless vendors, then dig deeper into the items below.

Data Handling: Encryption, Retention, and Deletion

The second section of the checklist covers the data lifecycle. Start with encryption in transit: the vendor should use TLS 1.2 or higher for all uploads and API calls. Then encryption at rest: audio files and transcripts stored on their servers should be encrypted with AES-256 or equivalent. These are standard expectations in 2026, and any vendor that cannot confirm both should be removed from your shortlist.

Retention policy is where vendors differ most, and where you need to read the fine print. Some AI transcription services delete audio automatically within 24 hours to 30 days; others retain it indefinitely unless you manually delete it. Ask three specific questions: How long is the raw audio stored after transcription completes? How long are transcripts stored? Can I trigger immediate deletion, and is deletion propagated to backups? A vendor that deletes audio within 7 days and lets you hard-delete transcripts on demand is materially safer than one with vague language like we retain data as needed to improve our services.

That last phrase deserves special attention. Some AI vendors use customer audio to train or fine-tune their speech recognition models. If your audio contains confidential client information, trade secrets, or personal health details, you do not want it in a training corpus. Look for explicit contractual language that your data will not be used for model training, or at minimum an opt-out that is honored by default on enterprise plans. This single clause is one of the most important items on the entire checklist and is frequently overlooked.

Human Transcribers vs AI Processing: Who Touches Your Audio

A major fork in the road is whether your audio is processed purely by machines or reviewed by human transcribers. The New York Times has covered the trend of services pairing AI with human review to improve accuracy, and for difficult audio, that hybrid approach often produces the best results. But from a security standpoint, human involvement changes the risk profile substantially. A machine mis-transcribing your file is an accuracy problem; a human contractor leaking your file is a breach.

If a vendor uses human transcribers, your checklist must ask: Are transcribers employees or contractors? Are they bound by confidentiality agreements, and are those agreements enforceable in their jurisdiction? Are they background-checked? Are they located in a specific country or distributed globally? Do they access audio through a platform that prevents downloading, or can they save files locally? Vendors with serious security postures use controlled workstations, watermarking, access logging, and prohibit local storage. Vendors that email audio files to freelance transcribers should be avoided for anything sensitive.

The comparison below summarizes the trade-offs:

Neither option is universally safer. AI-only processing eliminates human leak risk but concentrates risk in the vendor's cloud infrastructure and model-training practices. Human transcription spreads risk across many individuals but usually comes with stronger contractual controls at professional vendors. Match the option to the sensitivity of the audio.

Access Controls, Subprocessors, and the Supply Chain

The PJ&A breach showed how dangerous subcontracting chains can be. Your checklist should require the vendor to disclose their subprocessors: any third party that touches your data, including cloud hosting providers, speech recognition engine providers, and quality-review contractors. Reputable vendors publish a subprocessor list and notify customers before adding new ones. A vendor that cannot produce this list is either hiding something or does not know its own supply chain, and both are disqualifying for sensitive work.

Ask about access controls on their side too. Who at the vendor can view your files? Is access limited by role and logged? Do they support single sign-on, role-based access controls, and audit logs on your account? For teams, the ability to restrict which team members can access which transcripts matters as much as the vendor's own controls. A transcript of a sensitive HR investigation sitting in a shared workspace visible to your entire company is an internal breach waiting to happen.

Also confirm incident response commitments. The vendor should have a documented breach notification process, and your contract should specify a notification window. GDPR requires processors to notify controllers without undue delay, and 72 hours is the commonly referenced benchmark for regulator notification. If the vendor's terms of service are silent on breach notification, negotiate it into the agreement.

Legal and Jurisdictional Considerations

Recording and transcription legality is its own checklist item, and it comes before vendor selection. Reed Smith's legal analysis of AI-powered recording and transcription highlights that consent frameworks differ sharply: some US states and many countries follow one-party consent, while others, including several EU member states, effectively require all parties to consent to processing of their recorded speech. In Australia, the RACGP has published medicolegal guidance for GPs using AI scribes, emphasizing patient consent, transparency about AI use, and the practitioner's ongoing responsibility for the accuracy of the record. Those principles generalize: whoever initiates the recording should inform participants, obtain consent where required, and treat the AI output as a draft requiring human verification rather than an authoritative record.

Data residency is the second jurisdictional issue. If your audio contains EU personal data, processing it on US servers may require safeguards such as standard contractual clauses. If you operate in regulated healthcare, some jurisdictions effectively require data to stay in-country. Ask vendors where their processing infrastructure is located and whether they offer regional data residency options. Many enterprise AI transcription plans now offer EU or US-only processing as a configuration choice; free and consumer tiers usually do not.

Finally, consider professional confidentiality obligations. Lawyers, doctors, and journalists may be bound by stricter duties than general privacy law imposes. A law firm sending privileged deposition audio to a consumer transcription app could waive privilege protections in the worst case. If you operate under professional confidentiality rules, run vendor selection past your compliance or legal team, not just IT.

Practical Steps: How to Run the Vendor Evaluation

Here is a workable process you can complete in one to two weeks. First, classify your audio. Public marketing content, internal meeting notes, and confidential client or patient material sit at very different sensitivity levels, and only the last category needs the full checklist. Second, shortlist three to five vendors and send each a security questionnaire covering the items in this article: certifications, encryption, retention, training-data use, subprocessors, human access, data residency, and breach notification. Vendors accustomed to enterprise customers will respond within days; evasive or slow answers are themselves informative.

Third, run a pilot with synthetic or low-sensitivity audio that mimics your real use case. Test accuracy on your actual acoustic conditions, multiple speakers, accents, and background noise, because accuracy failures create their own risk: a garbled medical transcript is a patient-safety problem, and a mis-transcribed legal quote is a liability. Fourth, before going live, execute the paperwork: BAA or DPA as applicable, a no-training clause if you need one, retention and deletion terms, and breach notification commitments. Fifth, configure your account properly: enable SSO if available, restrict workspace access, set auto-deletion where supported, and document the configuration so it survives staff turnover.

A reasonable timeline: one week for questionnaires and shortlisting, three to five days for a pilot, and two to three days for contracting and configuration. Total elapsed time of two to three weeks is normal for a defensible vendor selection on sensitive material.

Common Mistakes People Make

The most common mistake is assuming a well-known brand means a secure default configuration. Many AI transcription tools have consumer-grade defaults, indefinite retention, and training-data usage enabled, with stronger protections available only on enterprise tiers. Buying the product is not the same as buying the protections; you have to configure and contract for them.

The second mistake is ignoring the free tier. Employees frequently paste sensitive audio into free tools they signed up for personally, outside any procurement process. If your organization handles confidential audio, your security policy should explicitly name which transcription tools are approved and prohibit the rest. A written policy plus a single approved vendor is more effective than any checklist applied after the fact.

The third mistake is treating accuracy and security as separate concerns. A transcript that misattributes a statement or invents content is a real harm, and the RACGP guidance on AI scribes makes clear that the human user remains responsible for verifying output. Build a review step into your workflow: someone reads the transcript against the audio before it is relied upon, filed, or published. The fourth mistake is forgetting deletion on your side. Downloading your transcripts and then closing the account does not always delete server-side copies; use the vendor's deletion tools and get written confirmation for high-sensitivity material.

When to Act and What It Costs

Act now if you are currently sending any confidential audio to a vendor you have not vetted, because exposure compounds with every file. The best trigger points for a full review are onboarding a new vendor, entering a regulated market, signing a large client with data protection requirements, or experiencing any security incident. An annual re-review of existing vendors is a sensible baseline, since vendors change subprocessors, retention policies, and training practices without always notifying lower-tier customers.

On cost, security review effort is modest relative to the downside. AI transcription typically runs $0.10 to $0.50 per audio minute or $10 to $30 per user per month on subscription plans, with enterprise tiers adding SSO, BAAs, no-training guarantees, and data residency for roughly 30 to 100 percent more. Human transcription runs $1.00 to $3.00 per minute. Budgeting a few thousand dollars of legal and IT time to vet a vendor is proportionate when a single breach, like the one that affected nearly 4 million Concentra patients, can generate regulatory fines, litigation, and reputational damage orders of magnitude larger. The checklist in this article is the minimum bar; for regulated industries, treat it as the starting point of a conversation with your compliance function, not the end of one.