Security & Trust
How we look after your client conversations
Your meetings hold your clients’ most confidential conversations. Here’s where they’re kept, who can see them and what we’ve put in writing, ready for you to check or pass on to your IT provider, insurer or partners.
- Where your meetings are stored
- Australia
- Encryption
- TLS 1.2+ and AES-256
- AI training on your meetings
- Never
- Breach notice to your firm
- Within 48 hours
- Provider copies deleted
- Within 30 days
- AI training on your meetings
- Never
- Encryption
- TLS 1.2+ and AES-256
- Breach notice to your firm
- Within 48 hours
- Provider copies deleted
- Within 30 days
- Stored in
- Australia, under the UK IDTA
- AI training on your meetings
- Never
- Encryption
- TLS 1.2+ and AES-256
- Recording and transcription providers
- SOC 2 and ISO 27001
- Breach notice to your firm
- Within 48 hours
- Stored in
- Australia (AWS Sydney)
Written into our Data Processing Agreement
- Australian Privacy ActHandled under the Australian Privacy Principles
- TPB Code of ConductYour clients’ information stays confidential
- Notifiable data breachesWe help you assess and report to the OAIC
- Hosted on AWS in SydneyISO 27001 and SOC 1, 2 and 3 certified
Written into our Data Processing Agreement for UK firms
- UK GDPRProcessor terms under the UK GDPR and Data Protection Act 2018
- A UK representativeVinyl AI Ltd in London, your contact for the ICO
- Safeguarded transfersThe UK IDTA, or the UK–US Data Bridge for certified providers
- English lawDisputes go to the courts of England and Wales
Written into our Data Processing Agreement
- A DPA for every firmBuilt into our Terms of Service, no negotiation needed
- ConfidentialityEveryone who handles your data is bound by it
- 30 days’ noticeBefore we add or replace a provider
- Your data backA full copy, deletion or both when you leave
Find the answers your firm needs
Tell us who you are and we’ll put the questions people in your role ask first at the top. Every answer here is one we’ve committed to in writing.
Where is our client data kept?Often asked
The lasting copy of every recording, transcript, summary and file note is stored on AWS in Sydney, and the AI behind Vinyl Studio runs on AWS in Australia. Recording, transcription and speaker separation use providers in the United States and the European Union, which return their results to Australia and delete their copies within 30 days.
The lasting copy of every recording, transcript, summary and file note is stored on AWS in Sydney, and the AI behind Vinyl Studio runs on AWS in Australia. Recording, transcription and speaker separation use providers in the United States and the European Union, which return their results to Australia and delete their copies within 30 days. Transfers from the UK are covered by the UK International Data Transfer Agreement, or the UK–US Data Bridge for certified US providers, both written into our Data Processing Agreement.
The lasting copy of every recording, transcript, summary and file note is stored on AWS in Sydney, and the AI behind Vinyl Studio runs on AWS in Australia. Recording, transcription and speaker separation use providers in the United States and the European Union, which return their results to Australia and delete their copies within 30 days. The recording and transcription providers are US companies that hold SOC 2 and ISO 27001.
Is our data used to train AI?Often asked
No. We don’t train models on your meetings, and our contracts require every provider we use to make the same promise. Vinyl uses AI only to produce your transcripts, summaries and answers.
No. We don’t train models on your meetings, and our contracts require every provider we use to make the same promise. Vinyl uses AI only to produce your transcripts, summaries and answers.
No. We don’t train models on your meetings, and our contracts require every provider we use to make the same promise. Vinyl uses AI only to produce your transcripts, summaries and answers.
Can Vinyl staff see our meetings?Often asked
Only when you’ve asked us to help with something, or when the law requires it. Everyone who works with your data is bound by confidentiality, and every time a recording or transcript is opened, it’s written to a log that can’t be changed for seven years.
Only when you’ve asked us to help with something, or when the law requires it. Everyone who works with your data is bound by confidentiality, and every time a recording or transcript is opened, it’s written to a log that can’t be changed for seven years.
Only when you’ve asked us to help with something, or when the law requires it. Everyone who works with your data is bound by confidentiality, and every time a recording or transcript is opened, it’s written to a log that can’t be changed for seven years.
What happens if there’s a breach?Often asked
We’ll tell you within 48 hours of becoming aware of it, with what happened, what data was involved and what we’re doing about it. We’ll help you decide whether it’s notifiable under the Privacy Act, and we won’t contact the OAIC or anyone involved without your agreement unless the law requires us to.
We’ll tell you within 48 hours of becoming aware of it, with what happened, what data was involved and what we’re doing about it, and we’ll help you meet your own reporting duties to the ICO.
We’ll tell you within 48 hours of becoming aware of it, with what happened, what data was involved and what we’re doing about it, and we’ll help you meet your own obligations.
How do we handle recording consent?Often asked
Your firm tells clients a meeting is being recorded and gets consent where the law requires it. Vinyl helps: it joins as a visible participant under the name your firm chooses, shows when it’s recording, and leaves if the platform doesn’t allow recording. Our Terms of Service include wording for invitations and for the start of a meeting.
Your firm tells clients a meeting is being recorded and gets consent where the law requires it. Vinyl helps: it joins as a visible participant under the name your firm chooses, shows when it’s recording, and leaves if the platform doesn’t allow recording. Our Terms of Service include wording for invitations and for the start of a meeting.
Your firm tells clients a meeting is being recorded and gets consent where the law requires it. Vinyl helps: it joins as a visible participant under the name your firm chooses, shows when it’s recording, and leaves if the platform doesn’t allow recording. Our Terms of Service include wording for invitations and for the start of a meeting.
How do we control who sees what?Often asked
Your admins decide who has an account and what they can do. Each meeting has an owner, and others see it only when it’s shared with them, with edit or view access. Your team can sign in with Google or Xero, and add two-step verification with an authenticator app.
Your admins decide who has an account and what they can do. Each meeting has an owner, and others see it only when it’s shared with them, with edit or view access. Your team can sign in with Google or Xero, and add two-step verification with an authenticator app.
Your admins decide who has an account and what they can do. Each meeting has an owner, and others see it only when it’s shared with them, with edit or view access. Your team can sign in with Google or Xero, and add two-step verification with an authenticator app.
What happens to our data if we leave?Often asked
You choose whether we send you a full copy in a standard format, delete it, or both, and we’ll confirm in writing once it’s done. Backups age out within 30 days.
You choose whether we send you a full copy in a standard format, delete it, or both, and we’ll confirm in writing once it’s done. Backups age out within 30 days.
You choose whether we send you a full copy in a standard format, delete it, or both, and we’ll confirm in writing once it’s done. Backups age out within 30 days.
What will we be signing?Often asked
Our Terms of Service, with our Data Processing Agreement built in. The DPA covers the Australian Privacy Act and UK GDPR, sets 48-hour breach notice, rules out AI training on your data and lists every provider. Ask us for a copy, countersigned if your policies need it.
Our Terms of Service, with our Data Processing Agreement built in. The DPA covers the Australian Privacy Act and UK GDPR, sets 48-hour breach notice, rules out AI training on your data and lists every provider. Ask us for a copy, countersigned if your policies need it.
Our Terms of Service, with our Data Processing Agreement built in. The DPA covers the Australian Privacy Act and UK GDPR, sets 48-hour breach notice, rules out AI training on your data and lists every provider. Ask us for a copy, countersigned if your policies need it.
Who else handles our data?Often asked
Ten providers are used for every firm and five more only if you connect them. Further down this page you can see what each one does, where it runs and its certifications; ask us and we’ll send you their names. We give at least 30 days’ notice before adding or replacing one.
Ten providers are used for every firm and five more only if you connect them. Further down this page you can see what each one does, where it runs and its certifications; ask us and we’ll send you their names. We give at least 30 days’ notice before adding or replacing one.
Ten providers are used for every firm and five more only if you connect them. Further down this page you can see what each one does, where it runs and its certifications; ask us and we’ll send you their names. We give at least 30 days’ notice before adding or replacing one.
How are transfers out of the UK protected?Often asked
For UK firms, transfers to Vinyl in Australia are covered by the UK International Data Transfer Agreement, which is part of our DPA. Transfers to US providers certified under the UK–US Data Bridge rely on that instead. Vinyl AI Ltd in London is our UK representative and your contact for the ICO.
For UK firms, transfers to Vinyl in Australia are covered by the UK International Data Transfer Agreement, which is part of our DPA. Transfers to US providers certified under the UK–US Data Bridge rely on that instead. Vinyl AI Ltd in London is our UK representative and your contact for the ICO.
For UK firms, transfers to Vinyl in Australia are covered by the UK International Data Transfer Agreement, which is part of our DPA. Transfers to US providers certified under the UK–US Data Bridge rely on that instead. Vinyl AI Ltd in London is our UK representative and your contact for the ICO.
Still have a question?
Send us your question and a person on our team will reply. We use your details only to answer you.
34 controls across 6 areas
The protections in place for every firm
Open any line to see what it means for your firm, or search for the thing your IT provider asked about.
Data protection
Where your meetings are kept and how they’re protected.
Stored in Australia
Recordings, transcripts, summaries and file notes are stored on Amazon Web Services in Sydney. That’s where the lasting copy of every meeting is kept.
Encrypted in transit
Everything sent between your team, Vinyl and our providers travels over TLS 1.2 or higher.
Encrypted at rest
Stored data is encrypted with AES-256.
Recordings are never public
A recording can only be opened through a private link that expires after a short time.
Backed up in Australia
Our database runs in two separate data centres in Sydney with 30 days of backups we can restore to any point in time, and recordings are copied to a second, separate backup in Australia.Our database runs in two separate data centers in Sydney with 30 days of backups we can restore to any point in time, and recordings are copied to a second, separate backup in Australia.
Access and sign-in
Who can get into your firm’s account, and what they can see.
Sign in with Google or Xero
Your team can use the Google or Xero account they already have, so there’s one less password to manage.
Long passwords
Anyone signing in with a password needs one at least 15 characters long.
Two-step verification
Anyone can add a second step at sign-in with an authenticator app. We recommend every firm asks its staff to turn it on.
Roles for your firm
Admins decide who has an account and what they can do. Team members and external guests get only the access they’re given.
Sharing meeting by meeting
Each meeting has an owner. Other people see it only when it’s shared with them, with either edit or view access.
Staff access is limited and logged
Vinyl staff only look at your content when you’ve asked us to help, or when the law requires it. Every time a recording or transcript is opened, it’s written to a log that can’t be changed or deleted for seven years.
AI and privacy
How AI is used on your meetings, and the limits we’ve set.
Your meetings never train AI
We don’t train models on your meetings, and our contracts require every provider we use to make the same promise. Clause 4.10 of our Data Processing Agreement puts this in writing.
Vinyl Studio’s AI stays in Australia
When your team asks Vinyl Studio or Ask Vinyl a question, the AI that answers runs on models hosted in AWS’s Australian regions (Sydney and Melbourne). Requests travel encrypted and can’t be routed outside Australia.
Provider copies deleted within 30 days
The specialist providers that produce transcripts and summaries delete their copies within 30 days. The lasting copy stays with us in Australia.
No emotion or sentiment scoring
Vinyl analyses what was said, not how people sounded. It doesn’t score emotions, sentiment or engagement.Vinyl analyzes what was said, not how people sounded. It doesn’t score emotions, sentiment or engagement.
Voice recognition is opt-in
A team member can record a voice sample so Vinyl recognises them in in-person meetings, but only with their own separate, explicit consent. The voiceprint is stored in Australia and deleted whenever they or your admin ask.A team member can record a voice sample so Vinyl recognizes them in in-person meetings, but only with their own separate, explicit consent. The voiceprint is stored in Australia and deleted whenever they or your admin ask.
Recording and consent
Recording only with everyone’s knowledge.
A visible, named recorder
Vinyl joins an online meeting as a participant everyone can see in the attendee list, and your firm can choose the name it shows.
A clear recording indicator
The recorder’s video tile shows whether it’s recording.
Leaves if recording isn’t allowed
If the meeting platform doesn’t allow recording, Vinyl leaves the call rather than staying in it.
Removable at any time
The person running the meeting can remove Vinyl whenever they like.
Each person chooses auto-record
Every team member decides whether Vinyl records their meetings automatically.
Consent wording ready to use
Our Terms of Service include wording you can put in a meeting invitation or say when the meeting starts.
Platform and operations
How the service itself is run and protected.
Hosted on AWS
Vinyl runs on Amazon Web Services, which is certified to ISO 27001 and SOC 1, 2 and 3.
Web application firewall
A firewall sits in front of the app and filters known attacks before they reach it.
Weekly security scans
Our systems are scanned for known security issues every week.
Tested before release
Development, testing and production run in separate environments, and every change is tested before an approval step lets it reach your firm.
Confidentiality for everyone
Everyone who works with your data is bound by confidentiality.
Incidents and your obligations
What we promise if something goes wrong, and when you leave.
Breach notice within 48 hours
If a breach affects your firm’s data, we’ll tell you within 48 hours of becoming aware of it, with what happened, what data was involved and what we’re doing about it.
Help with the Privacy Act
We’ll give you what you need to decide whether a breach is notifiable under the Privacy Act and to prepare any statement to the OAIC.
Your clients stay your clients
We won’t contact the OAIC or anyone whose information is involved without your agreement, unless the law requires us to.
TPB confidentiality respected
Information about your clients is treated as confidential, used only to provide Vinyl and shared only with the providers listed on this page.
Notice before provider changes
We give at least 30 days’ notice before adding or replacing a provider, so your firm can object.
UK transfers safeguarded
For UK firms, transfers out of the UK are covered by the UK International Data Transfer Agreement or the UK–US Data Bridge, and Vinyl AI Ltd in London is our UK representative and your contact for the ICO.
Returned or deleted when you leave
You choose whether we send a full copy of your data in a standard format, delete it, or both, and we’ll confirm in writing once it’s done.
Where your meeting data goes
Select any step to see what it handles and how long it keeps it.
- Your firmYour firm
An online meeting, or an in-person meeting recorded in the Vinyl app. In-person recordings go straight to Vinyl in Australia.
Nothing is kept on the call itself.
Your meeting
Online or in person
- What it handles
- An online meeting, or an in-person meeting recorded in the Vinyl app. In-person recordings go straight to Vinyl in Australia.
- How long it keeps it
- Nothing is kept on the call itself.
- United StatesUnited States
A specialist meeting-recording service joins the online meeting as a visible participant and records its audio and video. The recording is then copied to Vinyl in Sydney over an encrypted connection.
A working copy only, deleted within 30 days.
Meeting recorder
Joins online meetings
- What it handles
- A specialist meeting-recording service joins the online meeting as a visible participant and records its audio and video. The recording is then copied to Vinyl in Sydney over an encrypted connection.
- How long it keeps it
- A working copy only, deleted within 30 days.
- AustraliaAustralia
Keeps the lasting copy of your recordings, transcripts, summaries and file notes.
Up to seven years by default, or less if your firm asks.
Vinyl
AWS Sydney
- What it handles
- Keeps the lasting copy of your recordings, transcripts, summaries and file notes.
- How long it keeps it
- Up to seven years by default, or less if your firm asks.
- AustraliaAustralia
Answers your team’s questions in Vinyl Studio and Ask Vinyl, using AI models hosted on AWS in Australia. Every request is pinned to AWS’s Australian regions, Sydney and Melbourne, and travels encrypted.
Questions and answers stay in Vinyl’s AWS account in Australia, and aren’t used to train models.
Vinyl Studio
AI models on AWS Sydney
- What it handles
- Answers your team’s questions in Vinyl Studio and Ask Vinyl, using AI models hosted on AWS in Australia. Every request is pinned to AWS’s Australian regions, Sydney and Melbourne, and travels encrypted.
- How long it keeps it
- Questions and answers stay in Vinyl’s AWS account in Australia, and aren’t used to train models.
- United StatesUnited States
Speech-to-text AI models turn the audio into a transcript, tell speakers apart and draft the meeting summary, then return them to Vinyl. Everything travels encrypted.
A working copy only, deleted within 30 days.
Speech-to-text AI
Transcripts and summaries
- What it handles
- Speech-to-text AI models turn the audio into a transcript, tell speakers apart and draft the meeting summary, then return them to Vinyl. Everything travels encrypted.
- How long it keeps it
- A working copy only, deleted within 30 days.
- European UnionEuropean Union
A voice-biometrics service separates speakers, and recognises team members who have chosen to record a voice sample. Voiceprints are only made with that person’s explicit consent.A voice-biometrics service separates speakers, and recognizes team members who have chosen to record a voice sample. Voiceprints are only made with that person’s explicit consent.
A working copy only, deleted within 30 days. Results are stored in Australia.
Voice recognition
Speaker separation
- What it handles
- A voice-biometrics service separates speakers, and recognises team members who have chosen to record a voice sample. Voiceprints are only made with that person’s explicit consent.
- How long it keeps it
- A working copy only, deleted within 30 days. Results are stored in Australia.
- Your firmYour firm
Sees the meetings shared with them. If you connect Xero, Karbon or FYI, the notes you choose are synced there.
Your firm decides what’s shared and what’s connected.
Your team
And your connected apps
- What it handles
- Sees the meetings shared with them. If you connect Xero, Karbon or FYI, the notes you choose are synced there.
- How long it keeps it
- Your firm decides what’s shared and what’s connected.
- Online meetings
- In-person meetings recorded in the Vinyl app
- Encrypted in transit
What happens when meeting data leaves Australia
Recording and transcription use specialist providers in the United States, and speaker separation runs in the European Union. Here’s what that means for your clients’ conversations.
Encrypted on the way
Recordings and results travel to and from each provider over TLS 1.2 or higher.
Processed, not kept
Each provider does one job and sends the result back. Its working copy is deleted within 30 days.
Never used for training
Our contracts forbid every provider from training AI on your meetings.
Kept in Australia
The lasting copy of every recording, transcript and summary is stored in Sydney, encrypted, and Vinyl Studio’s AI runs in Australia too.
Under the Australian Privacy Principles, we stay accountable for how every overseas provider handles your clients’ information.
For UK firms, these transfers are covered by the UK International Data Transfer Agreement, or the UK–US Data Bridge for certified providers, in our DPA.
For US firms, the recording and transcription providers are US companies that hold SOC 2 and ISO 27001.
This covers your meeting content. Billing, support and error monitoring use the providers listed further down.
How long we keep things
Accountants have to keep client records for years, so Vinyl keeps them as long as you need them, and no longer.
30 days
The longest any recording or transcription provider keeps its copy.
Up to 7 years
How long we keep meeting records by default, in line with record-keeping obligations.
Any time
Delete a meeting whenever you like, or ask us to delete your firm’s records sooner.
When you leave
A full copy in a standard format, deletion, or both, confirmed in writing. Backups age out within 30 days.
Access logs
The record of who opened what is kept for seven years and can’t be altered, for your audit trail and ours.
The providers we use
These services process your firm’s data to deliver Vinyl. Each one is bound by a written agreement at least as protective as ours. We list them by what they do; ask us and we’ll send you their names.
Request the full provider listAmazon Web Services
Australia (Sydney)
Hosting, storage, sign-in, email and the AI models behind Vinyl Studio
ISO 27001SOC 1/2/3Region: AustraliaMeeting recording service
United States
Joins and records online meetings
SOC 2ISO 27001Region: United StatesSpeech-to-text AI
United States
Transcripts, telling speakers apart and meeting summaries
SOC 2ISO 27001Region: United StatesVoice biometrics service
European Union, results stored in Australia
Separating speakers and recognising team members who opt inSeparating speakers and recognizing team members who opt in
SOC 2 Type 2 in progressRegion: European UnionPayments provider
United States
Subscription billing and payments
PCI DSS Level 1SOC 1/2ISO 27001Region: United StatesCustomer support platform
United States
Customer support conversations
SOC 2ISO 27001Region: United StatesError monitoring
United States
Spotting and fixing errors in the app
SOC 2Region: United StatesFeature management
United States
Turning features on for the right accounts
SOC 2Region: United StatesProduct analytics
United States
Understanding how the app is used
SOC 2ISO 27001Region: United StatesIP location lookup
United States
Working out a visitor’s country from their IP address
Region: United StatesXero
Varies
Syncing clients and meeting notes
Only if you connect itSOC 2ISO 27001Region: VariesKarbon
Varies
Syncing clients and work notes
Only if you connect itSOC 2Region: VariesFYI
Varies
Syncing clients and meeting summaries
Only if you connect itRegion: VariesGoogle Calendar
United States
Finding the meetings to record
Only if you connect itSOC 2ISO 27001Region: United StatesMicrosoft Outlook
United States
Finding the meetings to record
Only if you connect itSOC 2ISO 27001Region: United States
Agreements and policies
Everything your firm signs up to, in one place, plus what to ask for if your policies need more.
- Data Processing AgreementUK and Australia: the Privacy Act, UK GDPR, breach notice and every provider by name. Countersigned if your policies need it.Request
- Full provider listThe names, locations and certifications of every provider we use.Request
- Terms of ServiceThe agreement between your firm and Vinyl.Read
- Privacy PolicyHow we collect, use and protect personal information.Read
- Security questionnaireSend us your firm’s or your insurer’s questionnaire and we’ll fill it in.Request
What’s changed
New Data Processing Agreement and Terms of Service
Our Data Processing Agreement (UK and Australia) and Terms of Service take effect. They set 48-hour breach notice, rule out AI training for us and every provider, and require separate consent for voiceprints.
Get notice of provider changes
We give at least 30 days’ notice before adding or replacing a provider. Leave your work email and we’ll send it to you.
Ready to pass this on?
Send your IT provider, insurer or partners a link set up for your region, a short summary by email, or a PDF. If something’s missing, ask us and a person will reply.