People use Heardsafe to write down things they cannot safely say out loud. That sets the bar for how we handle their data. This page describes what we actually do today, what we do not yet do, and what we are building next.
Heardsafe is not self-contained. Converting a conversation into a structured record requires sending its content to AI providers, and reaching you by phone or email requires telecoms and mail providers. These are our sub-processors and what each one receives.
| Sub-processor | Receives | Purpose |
|---|---|---|
| Anthropic | Conversation and incident content | Assistant responses, structured extraction |
| OpenAI | Conversation and incident content | Fallback processing when the primary provider is unavailable |
| Twilio | Phone number, call audio, SMS content | Voice line and text messaging |
| ElevenLabs | Call audio and transcripts | Conversational voice |
| SendGrid | Email address, message content | Transactional email |
| Hosting provider | All stored data, at rest | Application and database hosting |
We do not sell personal information, and we do not disclose an individual's records to their employer. Full detail is in our Privacy Policy.
| Control | Status | Detail |
|---|---|---|
| Encryption in transit | In place | HTTPS enforced site-wide with HSTS; plain HTTP is redirected, not served. |
| Credential storage | In place | PINs and admin passwords are stored as bcrypt hashes, never in plaintext or reversible form. |
| Session hardening | In place | Session cookies are HttpOnly and SameSite=Lax, and Secure-only in production. Sessions expire on a configured timeout. |
| SQL injection defence | In place | Database access goes through parameterised prepared statements. |
| CSRF protection | In place | State-changing forms carry per-session CSRF tokens. |
| Rate limiting | In place | Authentication endpoints are rate limited per IP and per account. |
| Audit logging | In place | Significant account and record actions are written to an audit log so access to sensitive records can be reviewed. |
| Browser hardening headers | In place | HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy are set at the edge. |
| Encryption at rest | In place | Incident content and uploaded evidence are encrypted at rest, in addition to the storage-layer protection provided by our hosting provider. |
| Independent penetration test | Planned | Not yet commissioned. |
| Single sign-on (SAML/SCIM) | Planned | For ClearView and BoardView enterprise deployments. |
Heardsafe does not hold a SOC 2 report. Not certified We have not engaged an auditor and there is no observation window underway. We will not describe ourselves as SOC 2 compliant, aligned, or “audit-ready” until a report exists that we can send you.
Several of the controls in Section 2 map to the SOC 2 Security criteria, and the roadmap in Section 8 is ordered with an eventual Type II observation window in mind. If SOC 2 is a hard procurement gate for you, tell us — that information genuinely affects how we sequence the work.
An individual using SafeVoice provides their information directly and consents to the processing described in our Privacy Policy. Where Heardsafe is deployed by an organization across its workforce, that organization is ordinarily the controller and Heardsafe the processor, governed by a Data Processing Agreement.
Users may request access, correction, deletion, restriction, portability, and withdrawal of consent — including withdrawal from attorney referral. Requests go to help@heardsafe.com and we respond within the statutory period.
Our sub-processors include US-based providers, so personal data may be transferred outside the UK and EEA.
Heardsafe scores documented matters for legal merit, and that score influences whether a matter is offered to an attorney. This is automated processing of sensitive information about identifiable people, at scale, in a context where the individual is in a position of relative vulnerability. We treat it as high-risk processing for which a Data Protection Impact Assessment is required.
Scoring is not a legal assessment and predicts no outcome. Users may request human review of a score and may withdraw from referral entirely.
For California residents, we support the access, deletion, correction and opt-out rights provided by the CCPA as amended by the CPRA. We do not sell personal information as that term is defined, and we do not share it for cross-context behavioural advertising.
We keep information only as long as there is a reason to. The schedule below is what we operate to. Two things shape it: records need to outlive the legal deadlines that apply to workplace claims, and nothing should sit on our systems once that purpose has passed.
| What | Kept for | Measured from |
|---|---|---|
| Account and incident records | Life of the account | — |
| Account deleted at your request | Purged within 30 days | Deletion request. The 30 days is a recovery window in case the request was a mistake. |
| Dormant accounts | 24 months, then 30 days’ notice before deletion | Last sign-in |
| Uploaded evidence | With its incident; purged 30 days after that incident is deleted | Incident deletion |
| Call audio | 90 days | Call date. The transcript is kept with the incident; the recording itself is not. |
| Conversation messages and transcripts | With their incident | — |
| Case scores | With their incident | — |
| Matters referred to an attorney | 7 years | Referral date. Retained to evidence what was shared, with whom, and on what basis. |
| Audit logs | 24 months | Event date |
| Email and SMS queue | 90 days after delivery | Delivery |
| Rate-limiting records | 30 days | Event date |
| Generated exports and temporary files | 24 hours | Generation |
| Backups | 35 days, rolling | Backup date |
The 24-month default is deliberate. Deadlines for workplace claims run from roughly 30 days for some safety complaints to about two years for wage and hour matters, so a record deleted at twelve months could disappear while a claim is still live.
You can delete an individual record or your whole account at any time without waiting for these periods. Deletion removes content from live systems immediately and from backups as those backups age out. Where we are legally required to keep something — or where a matter has already been referred to an attorney at your direction — we retain only what that obligation requires and nothing further.
If you believe you have found a security issue, email help@heardsafe.com with enough detail to reproduce it. We will acknowledge receipt, keep you updated, and will not pursue legal action against researchers who investigate in good faith, avoid privacy violations and service disruption, and give us reasonable time to fix the issue before disclosing it.
Security questionnaires, DPA requests and architecture questions go to help@heardsafe.com. If the honest answer to a question is “not yet”, that is the answer you will get.
Related: Privacy Policy · Terms of Service · UK Corporate Governance Code, Provision 29