---
title: GDPR Compliance
slug: trust-centre/gdpr-compliance
createdAt: 2025-08-27T15:20:45.097Z
---

Autoscriber is fully committed to GDPR compliance and safeguarding the privacy of personal data across all our services. We adhere to robust privacy standards grounded in our [Privacy Policy](docId:7AeUdbWnWt4UfXdbAP_IY) and supported by the following measures:

### Data Management & Storage Practices

- We operate under a strict policy of **data minimisation**: audio from consultations is **never stored**, and transcript and summary retention is limited strictly to the session, and only until the end user deletes it. In integrated deployments (e.g., with EHR systems), **no transcripts or summaries are stored at all**. All stored data is located **within the EU at all times**.

### Encryption & Secure Infrastructure

- Our platform ensures **end-to-end encryption**, safeguarding data both **at rest** and **in transit**. 
- We maintain **secure cloud infrastructure** partnerships with **Microsoft Azure** and **Google Cloud**, and employ **regular penetration testing** and **vulnerability assessments** to continuously fortify our systems. 

### Supplier Governance

- We apply a **rigorous procurement policy**: any vendor entrusted with customer or patient data must be **GDPR‑compliant** and hold at least **ISO 27001 certification**. They are also subject to **quarterly reviews** for uptime and security incident monitoring. 

### Access Control & Personnel Training

- Data access is strictly limited to **end users only**. Internal staff cannot access consultations belonging to other users. In rare cases (e.g., for troubleshooting), access may be granted temporarily - but only **with explicit permission** from the end user.
- We offer **multifactor authentication (MFA)** for standalone application access, while integrations commonly use your EHR’s **Single Sign-On (SSO)** capability. 

### Governance & Transparency

- Our practices are formalised in our **Privacy Policy**, which clearly outlines what data we collect, why, how long it is retained, and how users can manage their data rights (e.g., deletion, correction, export, objection).
- Autoscriber processes personal data only **as long as necessary**, in accordance with legal or operational requirements, and provides transparent mechanisms for data exercise rights. We process data under lawful bases such as consent (e.g. for product improvement), legal compliance, fraud prevention, customer support, and analytics - limited to what is strictly needed.