SonaFact
Security & privacy

Recordings of conversations deserve careful handling

Everything below is a commitment we hold ourselves to today, not a plan. The binding wording is in the privacy policy, and each answer says which section of it to read.

What happens to your recording

A recording of a meeting is somebody's conversation. These are the four things we can state about ours today.

Encrypted in storage

Every recording is encrypted with its own key, and that key is itself encrypted with a master key that never leaves our server. Transcripts and AI documents are encrypted the same way.

Processed only in the EU

Our server and database are in Warsaw. The GPUs that transcribe are in Romania. Nothing is processed outside the European Union.

The audio stays put

AI documents and translations are made from the text of the transcript. The recording itself never leaves storage for them.

No voice profiles

We do not build voice prints and do not recognise people across recordings. Speakers are separated inside a single recording and nothing about their voice is stored.

Recording people is your call, not ours

Whether you may record a conversation, and whether the people in it need to be told, depends on where you are and who they are. That decision stays with you — we only process the file you upload.

What AI does and does not do

Links every claim to the recording

Each decision, task and objection carries the timestamp of the sentence it came from, so any reader can check it in one click.

Removes what it cannot support

Items with no basis in the transcript, invented names and invented deadlines are dropped, and the document reports how many were removed.

!
Marks itself outdated

When you edit the transcript after generating a document or subtitles, they are flagged as outdated rather than silently left wrong.

×
Does not decide for you

AI output is a draft you can edit as markdown, regenerate, or reject. Roles, speaker names and scorecard criteria stay under your control.

Questions people ask before the first upload

Short answers, with the section of the privacy policy that says the same thing in full.

Where it is processedThe server and database are in Poland. Transcription, AI documents and translations run on GPUs in the European Union. Recordings, exports and backups are stored in the European Union.Privacy § 5
How long we keep itRecordings, transcripts, documents and translations stay until you delete them or delete your account. Nothing is deleted automatically, and nothing expires behind your back.Privacy § 8
Deleting the uploadThe recording is kept so you can play the transcript back against it. Deleting a recording or the whole account removes it from storage.Privacy § 8
BackupsEncrypted database backups are kept for 30 days. They hold account data, transcripts and documents, but no audio. Data you delete disappears from them within 30 days.Privacy § 8
Sub-processorsOVH (server and database, Poland), Cloudflare (storage and website, EU), RunPod (GPUs, EU), Resend (service emails), Google (only if you sign in with Google).Privacy § 6
Training on your dataWe do not use your recordings, transcripts or documents to train AI models, and we do not sell or share your data for advertising.Privacy § 4
Data processing agreementBusiness customers can ask for one at privacy@sonafact.com.Privacy § 10

Accessibility

The app targets WCAG AA contrast and a visible focus state on every control, so it can be operated without a mouse and read at a glance. Where we are not there yet, write to us and tell us what is in your way — support@sonafact.com.

Voice data noticePrivacy policyRequest a DPA