Trust & Privacy

Ownership

You own your data. Period.

No client content is ever sold or repurposed without consent. A full export is available anytime. What you record stays yours.

How we protect what you record

🔒
Encryption in transit and at rest
Your recordings and transcripts are encrypted while moving between devices and while stored.,
🔑
Access controls
You decide who can see, edit, and publish. Private-by-default settings and role-based permissions keep sensitive stories restricted.
👁️
Continuous monitoring
Systems are monitored around the clock, with logging and alerting so unusual activity is caught early.
🛡️
Reliable, resilient hosting
Backups and redundancy mean your archive stays available and recoverable even if something fails.
🤖

Your recordings are never used to train someone else’s AI

Transcription and search run on your content for your benefit only. Nothing you record is fed into third-party model training.

🔔

If something goes wrong, we tell you

We maintain a clear incident-response commitment: if there’s an issue affecting your data, you hear it from us.

🛡️SOC 2 in progress

Compliance & assurance

Our security program covers governance, vendor review, and ongoing monitoring. A SOC 2 program is active; certifications will be listed here when they are finalized.

Common questions

The questions we get asked most

Are my recordings private?

Yes. Submissions are private by default. We don't use, publish, or share a recording beyond what's needed to provide the platform to you unless you choose to share it.

Does TheirStory train AI on our recordings?

No. Transcription and search run on your content for your benefit only. Nothing you record is fed into third-party model training.

What happens to our archive if we stop using TheirStory?

We recognize that we often serve institutions who intend to preserve information created through TheirStory in-perpetuity. As such, we endeavor to ensure we never lose customer data, your data is never locked into our platform, and should you choose to cancel your subscription, you have your data in hand before we delete any data from our servers. Ultimately, it is your responsibility to download your data, and, contractually, after canceling your subscription, we retain your data for 30 days before deletion to ensure you have time to download your data if you have not already done so during the time of your subscription. We endeavor to ensure all of your data -- video, audio, metadata, transcripts, indexes, annotations, documents, images -- can be downloaded in standard, interoperable, archival formats at all times both via our UI and API. We also recognize from time to time a customer may have have limited capaicty, and in the past, we have helped customers export their data as necessary upon canceling their subscription to ensure no data is lost.

How do I request access to, correction of, or deletion of my data?

Email privacy@theirstory.io. We verify your identity first, then respond within the time applicable law requires. You may also designate an authorized agent to make a request for you where the law permits it. Deletion or anonymization happens within 60 days, except where we're legally required to retain something.

What rights do I have under GDPR or UK GDPR?

You can request access, correction, restriction, or erasure of your personal data, receive a copy in a portable format, object to processing based on our legitimate interests or to direct marketing, and lodge a complaint with your local data protection authority. Where the GDPR applies, we process data on the basis of contract, legitimate interests, legal obligation, or your consent.

Where is our data stored?

TheirStory is based in the United States, and the information we collect is generally stored and processed there. If you use the platform from outside the US, your information is transferred to and processed in the US. Where required, we rely on appropriate safeguards such as standard contractual clauses for those transfers.

What happens if there's a security incident?

If we confirm an incident involving unauthorized access to or disclosure of your personal data, we notify affected individuals and the relevant organization without undue delay, and no later than 72 hours after we become aware of it, to the extent applicable law requires.

Can students under 18 use TheirStory?

We don't knowingly collect personal information from children under 13 without verifiable parental consent. For users aged 13 to 17, the subscribing organization is responsible for obtaining and retaining verifiable parental or guardian consent before those users record, and for providing copies to us on request.

The consent form provided below is a template for reference only and does not constitute legal advice. Please consult your own legal counsel to confirm the language is appropriate for your use case before adopting it.

TheirStory example consent form

Have a security question? Ask us directly.

We’re happy to walk your team, and your IT reviewers, through exactly how it works.

Contact us