Security and privacy, stated plainly
Recordings are often the most sensitive files an organisation holds — interviews, patient conversations, legal matters, internal meetings. Here is exactly what Transgate does with them, without marketing hedging.
What we actually do
You can delete any transcription, permanently, at any time
Your transcriptions belong to you. Deletion is user-initiated and permanent — there is no retention period you have to wait out and no support ticket to file.
Data is encrypted in transit
Audio you upload and transcripts you retrieve travel over encrypted transport.
Scoped API keys
API keys carry fine-grained scopes, so an integration can be limited to exactly the endpoints it needs rather than being handed full account access.
Per-key rate limiting
Limits are enforced per key, which contains the blast radius of a leaked or misused credential.
Audit logging
API activity is recorded, giving teams a trail they can review for compliance reporting and incident response.
Built against HIPAA and GDPR requirements
The API layer was designed against HIPAA and GDPR compliance requirements. To be precise about what that means: it describes how the system was built, not a completed third-party certification or audit.
Frequently asked
- Is Transgate HIPAA compliant?
- Transgate's API layer is built against HIPAA compliance requirements, including scoped API keys, per-key rate limiting, and audit logging. This describes the system's design rather than a completed third-party certification. Organisations with a formal HIPAA obligation should contact us to discuss their specific requirements before processing protected health information.
- Who owns the transcriptions I create?
- You do. You can permanently delete any transcription at any time, and Transgate does not require you to keep content on the platform to retain access to your account.
- Is my audio encrypted?
- Yes — audio and transcripts are encrypted in transit between your device and Transgate.
- Can I limit what an API integration can access?
- Yes. API keys are scoped, so each key can be restricted to specific endpoints, and rate limits are applied per key rather than per account.
- Does Transgate support GDPR requirements?
- The API layer is built against GDPR compliance requirements, and user-initiated permanent deletion supports the right to erasure.