Compliance
Data security and handling for speech data programmes
How recordings, transcripts and personal metadata are stored, moved, restricted and deleted across a collection programme.
- Access
- Role-based, logged
- Transfer
- Encrypted, access-controlled
- Retention
- Contractual window
- Deletion
- Certified in writing
The short version
- Recordings move from capture device to controlled storage on the same day, with no personal devices in the chain
- Access is role-based: recruiters cannot read transcripts, transcribers cannot read consent records containing names
- Transfer to the buyer runs over an access-controlled channel of their choosing, with download logging
- Working copies are deleted at the end of the contractual window and deletion is certified in writing
- Subcontracted studios operate under back-to-back confidentiality and handling terms
Why it matters in practice
Data security in collection work is mostly an operations problem rather than a technology one. The failure modes are a recruiter with a spreadsheet of phone numbers, a transcriber working from a personal laptop, and audio left on a studio machine after a project closes.
Controls are written into the studio agreement and checked, rather than assumed.
How it is operated
| Stage | Control |
|---|---|
| Recruitment | Contact data held in a controlled system, purged after the programme |
| Capture | Project-issued devices, same-day upload, no personal storage |
| Transcription | Access to audio only, no identifying metadata |
| QA | Sampled access with logged review sessions |
| Delivery | Encrypted transfer to buyer-nominated storage |
| Close-out | Working-copy deletion with written certification |
What you receive
- The relevant policy or template as a document, not a claim on a web page
- Programme-specific artefacts delivered with the corpus manifest
- Named contact for audit questions during and after the programme
- Written confirmation at close-out
If your legal or procurement team has a questionnaire, send it with the specification. It is faster to answer it once, up front, than to unblock a signed programme later.
Frequently asked
Where is the data stored during collection?
In access-controlled storage under our control, in-region unless your contract specifies otherwise. Personal devices are not part of the chain at any stage.
Can we require in-region storage?
Yes. Storage region is a contract parameter and we will operate entirely within India if your policy requires it.
Do subcontracted studios hold copies?
Only until same-day upload completes, after which local copies are removed under the studio agreement.
Do you provide a deletion certificate?
Yes, as standard at programme close-out, covering all working copies and identifying metadata.
Related pages
Send your compliance questionnaire with the spec
We answer procurement, legal and security questionnaires alongside the technical scope, in the same working day where we can.