Transcription security and audio privacy

For a local video file, the browser extracts its audio track and the source video stays on your device. Supported audio uploads unchanged; any other audio is prepared in your browser before upload. A file or browser recording submitted to the public preview sends a clip of up to 5 minutes for speech recognition, not the full recording.

No bot joins your calls: Hushscript never joins meetings, accesses your calendar, or records in the background. You choose which recording to submit.

For an audio link, Hushscript fetches the linked file on the server to make a preview of up to 5 minutes; this differs from uploading a local file clip. Video links are not accepted because video audio extraction happens on your device.

Hushscript removes its transcription-audio copy after processing, and asks the speech provider to delete its transcript copy once the job is finalized. If that request fails, removal can be delayed, so treat deletion as a cleanup flow, not instant erasure.

Dedicated transcript, AI-artifact, and account deletion return a downloadable receipt recording what was removed and when. Scheduled retention sweeps store a receipt on the deleted-transcript record.

Hushscript encrypts your stored transcripts at rest: transcript text, titles, speaker names, translations, and Insights. A copy of the stored data is unreadable without the keys. Hushscript holds the keys, so this is encryption at rest, not end-to-end encryption.

Audio from the EU, EEA, Switzerland, and the UK is processed in the EU. A Teams workspace is pinned to one of four data regions (US, EU, Asia-Pacific, or Oceania) when it is created, and every member's account lives in that region. This covers audio processing in the regions named here; other services and regions may differ.

Hushscript is operated by LW Agency Limited, a Hong Kong company, Business Registration 76684183. Registered office: Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong.

No human transcription workforce handles customer files, and Hushscript never trains models on your recordings.

In a Teams workspace, private custody keeps transcripts with the member who created them. In firm custody, a member with the separate reviewer right can read workspace transcripts, and reviewer access is audited. The admin right alone does not open a transcript, but an admin can grant themselves reviewer access with an audit trail. An email to the transcript owner is attempted when each reviewer first opens that transcript.

In normal mode, keep transcripts until you delete them or set automatic deletion after 7, 30, 90, or 365 days; you can set a date for an individual transcript. Private mode saves no transcript to your account. Speech recognition still runs online on your audio, and a short-lived encrypted result lets you download a password-protected archive, then expires if not acknowledged.

A Teams workspace can set a retention default and an optional enforced maximum. Lowering the maximum applies to new transcripts at once; existing transcripts are re-clamped after 14 days' notice. A legal hold can exempt a firm-custody transcript from automatic deletion.

The subprocessor list is published and kept current. AssemblyAI (transcription) processes audio and transcripts, and OpenAI (Insights, cleanup and translation) processes transcript text, for us under signed HIPAA Business Associate Agreements. Hushscript itself does not sign BAAs with customers. For questions about a data processing agreement or confidentiality addendum, contact support@hushscript.com.

Hushscript does not today hold SOC 2, ISO 27001, or similar certifications, and does not claim them. If that changes, this page will say so.

Report a security issue to support@hushscript.com. Include enough detail for the team to investigate and follow up.