Reviewed by Stephen Hopkins, CTO Last updated October 2026

Secure transcription

TLS in transit.
AES-256 at rest.
Never used to train AI.

Sonix protects every recording and transcript with encryption at each step and SOC 2 Type II controls that an independent firm audits every year.

Your files are never used to train AI models, our team cannot open them without your written consent, and you can delete them permanently whenever you choose.

SOC 2 Type II

HIPAA with BAA

GDPR with DPA

AES-256 at rest

At a glance

Security and compliance
at a glance

For the reviewer working through a vendor checklist: where Sonix stands on each item, with the detail further down the page.

SOC 2 Type II: Certified, with controls audited by an independent firm every year.
HIPAA: Compliant through Medical Sonix, with a signed Business Associate Agreement.
GDPR: Compliant, with a DPA and SCCs available inside your account on request.
Encryption at rest: Server-side AES-256 protects stored media, transcripts and our database.
Encryption in transit: TLS on every connection to Sonix and on every copy between our data centers.
Two-factor sign-in: Available on every account: a six-digit authenticator code after your password.
Role-based access: Roles from Admin to View Only, granted and revoked by your team in seconds.
AI training: Never. No audio, video or transcript you upload is used to train our models.

Your data is never used to train AI

Sonix never uses the audio, video or transcripts you process to train its models, on any plan or trial.

It is the first question a security team asks an AI vendor, so here is the answer without qualification. Sonix does not use customer files to train or tune its models. The policy is not an Enterprise upgrade: it covers a free trial exactly the way it covers a hospital system.

The same rule applies to people. Sonix employees cannot open your recordings or transcripts unless you give express written consent, for example to investigate a support issue you raised. Our security team watches systems, event logs, notifications and alerts continuously to catch anything that should not be there.

It applies to third parties too. We do not sell, rent or share your information with anyone for their promotional use. Privacy is designed into how the product works, and it is how we choose to treat the people who trust us with their recordings.

Encrypted and protected from upload to deletion

Your files are encrypted from the moment they leave your device until the moment you delete them.

In transit

Everything that moves between you and Sonix is encrypted with TLS (Transport Layer Security), using TLS 1.3 on modern browsers: uploads, playback, edits and exports. Data is encrypted again whenever it moves between data centers for backup and replication, so there is no unprotected hop anywhere in the pipeline.

At rest

Stored media, transcripts and our database are protected with server-side AES-256 encryption, one of the strongest block ciphers available and the standard financial institutions rely on for their own data.

Where your data lives

All customer data is stored with AWS in the USA, in enterprise-grade facilities with 24/7/365 monitoring, on-site security staff and regular security audits. The network in front of it runs firewalls, intrusion protection systems and network segregation configured to industry best practices. Enterprise customers who need data kept in a specific region can set up data residency with our team.

Who can open it

You decide who sees each file. Role-based permissions set what every teammate can view, edit and share, and a share link can carry its own password when a transcript leaves your workspace. Sonix staff stay out of your content unless you consent in writing.

Keeping and deleting

Your files are yours. You can view, export, download and delete them at any time, and they stay accessible even after your subscription ends. When you delete a file, Sonix wipes both the audio and the transcript from the platform. Enterprise accounts can also set retention rules that delete media and transcripts automatically after a period you choose.

Compliance

Certified, audited and
independently verified

The three frameworks procurement teams ask about first, and what each one means at Sonix.

SOC 2 Type II

SOC 2 Type II certifies that controls worked over an extended audit period, not on a single day. An independent firm audits Sonix every year for security, availability and confidentiality, and Drata monitors more than 100 internal controls between audits with automated alerts and evidence collection.

HIPAA and BAAs

Healthcare organizations get HIPAA compliance through Medical Sonix. We sign Business Associate Agreements and apply the required technical and administrative safeguards to protected health information, from encryption to access controls.

Learn about Medical Sonix

GDPR

Sonix follows GDPR protocols and signs a Data Processing Agreement and Standard Contractual Clauses, both available inside your account on request. Because you can export or delete your own data, access and erasure requests never wait on a support ticket.

Access controls that scale from one seat to thousands

Every account gets two-factor sign-in, account lockout and role-based permissions, and Enterprise adds single sign-on through SAML 2.0.

Two-factor authentication

Turn on 2FA and Sonix asks for a six-digit code from an authenticator app, such as Google Authenticator, Authy or 1Password, in addition to your password. You can also sign in with Google and lean on the account security you already manage there.

Lockout and session timeouts

Five failed sign-in attempts lock an account for an hour, or until its user unlocks it from the email Sonix sends, which stops password guessing cold. Sessions left idle for two days sign out on their own, so a forgotten browser tab does not stay signed in to your transcripts.

Single sign-on

Enterprise plans connect Sonix to your identity provider over SAML 2.0, including Okta, Microsoft Entra ID and OneLogin. People join and leave through the directory your IT team already runs, instead of keeping a separate Sonix password.

Role-based permissions

Admin, Team Lead, Editor, Team Member and View Only roles each see and do different things, Billing Admin handles invoices without touching media, and external roles let a client or contractor edit or view without joining your team. Grant access the day someone starts and revoke it the day they leave.

Audit logs, IP restrictions and password policies for Enterprise

Enterprise accounts can add the controls a compliance team asks for: audit logs that record who uploaded, viewed, edited, shared and deleted each file, IP restrictions that limit sign-in to your network, and organization-wide password requirements. Our team sets them up with yours to match your policies.

API and AI assistant connections

The Sonix API is available on Core plans and higher for automated workflows. The Sonix MCP server connects AI assistants to your library over OAuth 2.1 with read-only access, and only Admins and Team Leads can authorize a connection, so nobody else can hand account-wide access to an outside tool.

Security reviews for Enterprise

Enterprise plans add dedicated security reviews: our team works directly with yours on questionnaires, documentation and the controls your policies require.

The questions your security team will ask, answered

Five questions come up in nearly every vendor review, so here are the short answers, with the reasoning after each one.

Do you train AI models on our data?

No. None of the data processed through Sonix is used for training purposes. It is a standing policy on every plan, written into how the product works, not a setting you have to find.

Where is our data stored?

With AWS in the USA, in enterprise-grade facilities with 24/7/365 monitoring. Data is encrypted at rest with AES-256 and in transit with TLS, including the copies made for backup and replication.

What happens when we delete a file?

Sonix wipes both the audio and the transcript from the platform. Anyone with the right role can delete a file at any time from the web app, without contacting support or waiting for a retention window.

How do you prevent security incidents?

With layers that run all year: continuous monitoring of more than 100 controls, annual network and application penetration tests by independent security firms, annual security training for every employee, and manual and automated security checks throughout development. Anyone can report a vulnerability to [email protected], and the team investigates every report promptly.

Can we review your SOC 2 report?

Yes. The SOC 2 Type II report is not published on the website, but customers in a security review can request the latest report from their account manager or by writing to [email protected].

Common questions

Secure transcription, answered

Is Sonix safe for confidential recordings?

Yes. Sonix is SOC 2 Type II certified, with more than 100 security controls monitored continuously. Files are encrypted with TLS in transit and AES-256 at rest, employees cannot open your content without your written consent, and your data is never used to train AI models. Legal, healthcare and enterprise teams rely on Sonix for sensitive recordings.

Does Sonix use my audio or transcripts to train AI?

No. None of the data processed through Sonix is used for training purposes. Your audio, video and transcripts remain strictly confidential, are never used to train our systems, and are never sold, rented or shared with third parties for their promotional use. The policy applies to every plan, including the free trial.

Is Sonix SOC 2 certified?

Yes. Sonix is SOC 2 Type II certified, which verifies that security controls operated effectively over time, not just on audit day. An independent firm audits the controls every year, and more than 100 internal controls are monitored continuously through Drata's platform with automated alerts and evidence collection.

Is Sonix HIPAA compliant?

Yes, through Medical Sonix for healthcare organizations. We sign Business Associate Agreements and implement the required technical and administrative safeguards to protect PHI, including encryption, access controls and role-based permissions. The medical transcription page covers the clinical model, the BAA and pricing in detail.

Is Sonix GDPR compliant?

Yes. Sonix follows GDPR protocols and can sign a Data Processing Agreement and Standard Contractual Clauses, both available inside your account on request. You can view, export, download and delete your data at any time, which lets you answer data subject access and erasure requests directly.

Where does Sonix store my data?

All data is stored with AWS in the USA, in enterprise-grade data centers with 24/7/365 monitoring, on-site security staff and regular security audits. Data is encrypted at rest with AES-256 and encrypted again in transit whenever it moves between data centers for backup and replication.

Can I permanently delete my files?

Yes. You can delete any file at any time, and Sonix wipes both the audio and the transcript from the platform. Until you delete them, your files stay accessible, even after your subscription ends, so you never lose a transcript because a plan lapsed.

Does Sonix support two-factor authentication and SSO?

Yes. Any account can turn on two-factor authentication with an authenticator app such as Google Authenticator, Authy or 1Password, and you can sign in with Google. Enterprise plans add single sign-on with SAML 2.0, so access follows your identity provider and your team's existing directory.

Get started

Start transcribing with
complete confidence

Every plan includes the same encryption, the same no-training policy and the same certified infrastructure. Try it free with 30 minutes of transcription, no credit card required.

Secure transcription

Security and compliance
at a glance

Your data is never used to train AI