Answers to your vendor security review.

Data is encrypted in transit (TLS) and at rest (AES-256). Nothing about your calls travels or sits unencrypted.

Firm data is isolated per firm. Access is limited to what’s needed to run the service; your confidential audio and transcripts stay inside our systems and are never handed to anyone else.

Your audio is deleted the moment it is transcribed. Free Leak Audit transcripts and reports are purged within 72 hours of your readout. If you join the desk, transcripts are kept only while we serve you (so your team can check the evidence behind each flag), purged on a rolling 90-day window, and deleted immediately if you ask in writing. Your calls are never used to train AI models.

We analyze and transcribe your calls on specialist engines under our data-processing agreement, every subprocessor is named in the DPA, over encrypted connections. Your calls, transcripts, and results are never used to train AI models, and we do not sell or share your data. Intake QA does not claim to be SOC 2 certified or HIPAA compliant as a company. We make plain-English commitments and put them in writing.

A data-processing agreement (DPA) is available on request, and we’ll sign your NDA, or work from your firm’s own paper.

If we become aware of a breach affecting your data, we will notify you within 72 hours of becoming aware, with what we know and what we’re doing about it.

Intake QA processes calls your firm already recorded. California is an all-party-consent state (Penal Code §632); your firm is responsible for its consent posture. The compliance page covers the recording and disclosure detail.