Trust and security

Last updated: 15 September 2026

Speech listens to you all day. This page is what happens to that: what we keep, who can reach it, which country it physically sits in, and which of the things a security review asks for we have not built.

Your data stays in India

Servers, database and backups run in AWS Mumbai (ap-south-1).

Privacy Mode keeps nothing

A switch in Settings. Audio and transcripts are discarded the moment they are transcribed.

Nobody reads your words

Not even us, unless you turn it on for your own account. Off by default.

Delete means delete

One page in your account removes the account and everything stored for it.

What we hold, and for how long

The switch you set in Settings decides this.

	Privacy Mode	Standard
Your audio	Never written to disk	Deleted after 60 days
Your transcripts	Never written to disk	Kept, and may be used to improve Speech's own accuracy and models
Account and usage records	Kept while the account exists. Counts and timings, not content.
Pictures Agent Mode made for you	One year
Bug reports you sent	One year
Database backups	60 days in S3, 14 most recent on the server

Your transcripts are never sold, and never used to train anybody else's models. The privacy policy has the full detail.

Who can see your dictations

You, and by default nobody else.

An administrator at your company sees when you dictated, into which kind of app, for how long, how many words, and whether it worked. They cannot read the words or play the audio.
They can read your words only if you switch that on from your own account page. Nobody can set that switch on your behalf, and you can turn it off again whenever you like.
Every time anyone at Rupees opens another person's transcript or plays their audio, an append-only audit log records who, whose, when and from where. Reads, not only changes.
Our own admin console is limited to named accounts and asks for a second factor from an authenticator app. The 7 day session your desktop app holds cannot open it.

How it is protected

In transit

TLS 1.2 and 1.3 only, with HSTS, a strict Content Security Policy, and certificates that renew themselves. The apps talk to nothing except our API.

At rest

The database sits inside the private network and is not published to the internet; nothing outside the application container can reach it. Nightly backups go to S3 with AES-256 server-side encryption and expire on a lifecycle rule after 60 days. The identity that uploads them can write backups and do nothing else.

Access

The admin console is a separate thing from the product: an account with raised dictation limits does not get it. Access is granted from a declared list on every boot, so a grant cannot quietly exist that nobody remembers making, and every change and every content read is audited.

In the code

Every change goes through a pull request with the full test suite, a dependency vulnerability scan of everything we ship, and a secret scan of the whole history before it can merge. Dependency updates arrive as pull requests weekly.

For companies

Sign in with Google, enforced. An organization can require every address on its domains to sign in through its own Google Workspace. Passwords and emailed codes stop working for them, so identity stays yours, and suspending somebody in Workspace ends their access here.
SCIM 2.0 provisioning. Connect Okta, Microsoft Entra ID, Google Workspace or JumpCloud and joiners get accounts and leavers get disabled without anybody having to remember. Deprovisioning disables an account and never deletes one, because an identity provider mis-sync should not destroy somebody's work.
Organization controls. Feature defaults, caps, the team board, a shared dictionary, and an audit feed scoped to your own people.
A Data Processing Addendum is available at /dpa.html, with the subprocessor list at /subprocessors.html.

Where it runs

AWS ap-south-1 (Mumbai), India: the application, the database and the backups. Two of the model providers that transcribe or format a dictation run in the United States, so a request taking those paths crosses a border for the seconds it takes to process. Nothing about it is kept there. The full list, with what each one receives, is on the subprocessors page.

Your rights, and how to use them

Export or delete everything. The delete page in your account removes the account, the dictations, the audio, the images and the usage records.
Under the Digital Personal Data Protection Act, 2023 we have a Grievance Officer. We acknowledge a grievance within 72 hours and respond within 30 days. The contact details are in the privacy policy, section 10.
Privacy questions go to support@rupees.com, answered within two working days.

Found a security problem?

Tell us before you tell anybody else: security@rupees.com. We will reply, keep you posted while we fix it, and will not pursue legal action against anybody who follows our disclosure policy.

What we do not have yet

Most pages like this one list only what a company has. This is the other half, because you are going to ask and we would rather you heard it here.

SOC 2 and ISO 27001: neither, yet. We are working towards ISO/IEC 27001:2022 first. We will not imply an attestation we do not hold.
An independent penetration test: not commissioned yet. The code is reviewed and scanned on every change, which is not the same thing.
SAML single sign-on for Okta, Entra ID and Ping: not built. Google Workspace enforcement and SCIM provisioning are, and they cover the lifecycle half. Talk to us if SAML is the thing standing between us.
A customer-facing audit log export: organization admins see an audit feed in the console; there is no export or SIEM stream yet.
Data residency outside India: not offered.