Privacy And Security
Rev is trusted by more than 1 million users and 125,000 organizations to securely transcribe, caption, and subtitle their content. This article explains Rev's security certifications, how Rev protects and stores your data, and how Rev handles AI and data privacy. For Rev's Terms of Service, Privacy Policy, and other legal documents, visit the Legal Center.
In This Article
Security Statement
Rev's security program uses a multi-layered approach that includes encryption, access controls, regular security assessments, and incident response. To learn more about Rev's security standards, visit the Rev Security page.
Core Security Frameworks
SOC 2 Type 2
SOC 2 Type II is an independent audit of a company's security controls. An auditor examines Rev's controls over a period of time to verify that Rev consistently protects customer data. Rev also has a SOC 3 report available for review.
Specifically, it focuses on these "trust service criteria":
- Security: Protecting data from unauthorized access.
- Availability: Ensuring our services are reliably accessible.
Essentially, SOC 2 Type 2 demonstrates that we have robust, documented, and consistently applied security controls.
To request Rev's SOC 2 Type II report, contact support@rev.com or your account manager. Rev shares the report only with customers who have a signed NDA or contract with Rev.
HIPAA
(Health Insurance Portability and Accountability Act)
If you're dealing with any health-related information, HIPAA is crucial. It sets strict rules for protecting "protected health information" (PHI).
Rev.com implements specific safeguards to ensure PHI is handled securely, including:
- Administrative Safeguards: Policies and procedures governing access to PHI.
- Physical Safeguards: Measures to control physical access to systems and facilities.
- Technical Safeguards: Technology-based controls, such as encryption and access controls.
We take HIPAA extremely seriously and have implemented controls to protect any PHI that may be processed through our services.
Rev offers HIPAA-compliant transcription through the HIPAA subscription plan, which is available on the Unlimited plan/Enterprise accounts. A signed Business Associate Agreement (BAA) is required. HIPAA protections apply only to accounts with HIPAA enabled.
For details, see HIPAA Compliance. To get started, contact Rev Sales.
GDPR
(General Data Protection Regulation)
This is a European Union regulation that applies to any organization that processes the personal data of EU residents. It gives individuals greater control over their personal data and imposes strict obligations on organizations.
Key aspects of our GDPR compliance include:
- Data Minimization: Collecting only the necessary data.
- Purpose Limitation: Using data only for its intended purpose.
- Data Subject Rights: Providing individuals with rights like access, rectification, and deletion of their data.
- Data Protection Impact Assessments (DPIAs): Assessing and mitigating privacy risks.
Rev is GDPR compliant. Rev's Data Processing Addendum (DPA) and Privacy Policy explain how Rev handles personal data, including the subprocessors Rev uses. Even if you are not based in the EU, GDPR best practices are implemented company-wide.
PCI DSS and CJIS
Rev processes payments through PCI-compliant systems and maintains PCI compliance as a merchant. CJIS-compliant transcription is available on the Unlimited/Enterprise plan.
Practical Security Measures at Rev.com
Here's how these frameworks translate into concrete security measures:
Encryption
Rev encrypts your data in transit and at rest. Connections between you and Rev use HTTPS and Transport Layer Security (TLS) 1.2 or 1.3. Files are encrypted at rest using Amazon S3 server-side encryption (SSE) with AES, so the data would be unreadable even if a storage drive were physically stolen. Rev also supports TLS for email encryption.
Data Storage, Location, and Backups
Rev stores customer files and transcripts on Amazon Web Services (AWS) in the United States. Customer data is logically separated from other customers' data, and users can only access data within their own account or workspace. Rev backs up critical system data multiple times per day to prevent data loss or corruption.
Data Retention and Deletion
By default, Rev keeps your files and transcripts in your account until you delete them, so you can edit and use them whenever you need. You can delete your own files at any time, and Rev does not keep copies of a file after you delete it. You can also contact Support to request a custom retention schedule that automatically deletes files after a set number of days.
Access Controls
Rev limits who can access your data. Only authorized personnel with a legitimate business need can access customer information, and employees have access only to the data their job requires (the principle of least privilege).
Rev also offers account security features: Single Sign-On (SSO) using SAML 2.0, optional multi-factor authentication (MFA), and Domain Claiming. SSO and Domain Claiming are available on the Unlimited/Enterprise plan. To learn more, see SSO and Domain Claiming.
Who Can Access My Files and Transcripts
Access to customer data is limited to authorized personnel who need it to complete service requests. If you order human transcription, Rev's professional freelance transcribers (Revvers) can access your files while they work on them. Revvers go through ID verification and sign non-disclosure agreements (NDAs). Rev's support and engineering staff have limited visibility into files and transcripts to help with customer support and debugging. Most other Rev employees do not have access to your audio files or transcripts.
Security Assessments and Training
Rev regularly runs vulnerability scans, penetration tests, and security audits to find and fix potential weaknesses. Rev employees complete annual security awareness training.
Incident Response
We have a comprehensive incident response plan in place to handle any security incidents quickly and effectively.
This includes procedures for detecting, containing, and recovering from incidents. If you suspect a security breach on your account, contact support@rev.com immediately.
Data Center Security
Customer data is stored in secure data centers with physical security measures such as surveillance, access control, and environmental controls.
Vendor Management
Rev vets third-party vendors against its security standards. Rev requires each subprocessor to meet contractual obligations that are no less protective of personal data than Rev's own. Approved subprocessors are listed in Rev's Data Processing Addendum.
AI and Data Privacy FAQ
Rev understands that organizations such as law firms handle highly sensitive and confidential information. Rev is committed to the security, privacy, and integrity of your data. Below are answers to common questions about how Rev safeguards your information when you use its AI-powered transcription and captioning services.
How does Rev ensure data security and confidentiality?
Rev protects customer data with encryption in transit and at rest, secure storage on Amazon Web Services (AWS) in the United States, and access controls that limit who can see your files. Rev has a SOC 2 Type II report, maintains PCI compliance as a merchant, and regularly runs vulnerability scans, penetration tests, and security audits. For more detail, see the Rev Security page.
Is Rev HIPAA compliant?
Rev offers HIPAA-compliant transcription through the HIPAA subscription plan, which is available on the Unlimited (formerly Enterprise) plan. A signed Business Associate Agreement (BAA) is required for customers who share protected health information (PHI). HIPAA protections apply only to accounts with HIPAA enabled. Rev has administrative, physical, and technical safeguards in place to protect PHI. For details, see HIPAA Compliance. To get started, contact Rev Sales.
Does Rev use customer data to train AI models or large language models (LLMs)?
Rev does not train external large language models (LLMs) on customer data, and the third-party LLM providers Rev uses do not retain or train on customer data. Rev's own automatic speech recognition (ASR) models, which convert speech to text, may be trained on data from human transcription orders unless the customer has opted out. Rev uses this training to improve its own speech-to-text accuracy. To ask about opting out, contact your account manager or support@rev.com.
How does Rev handle customer data after a transcript is completed?
By default, Rev keeps your files and transcripts in your account until you delete them. You can delete your files at any time, and Rev does not keep copies of a file after you delete it. You can also contact Support to request deletion or to discuss a custom retention schedule that deletes files automatically after a set period. Availability of custom retention can depend on your account and order type, so confirm the details with Support.
Will Rev respond to subpoenas requesting access to customer data?
Rev reviews every request for customer data, including subpoenas, before providing any information. Requests are referred to Rev's Legal and Security teams, who determine what Rev is legally required to provide. Rev does not give third parties access to customer files, transcripts, or other confidential information without a legal requirement and due process. For questions about a legal request, contact legal@rev.com or security@rev.com.
Who has access to my data within Rev?
Access to customer data is limited to authorized personnel who need it to fulfill service requests. Rev uses role-based access controls (RBAC), multi-factor authentication, and logging to prevent unauthorized access. If you order human transcription, Rev's freelance transcribers (Revvers) can access your files while they work on them. Revvers go through ID verification and sign non-disclosure agreements (NDAs). Support and engineering staff have limited visibility into files and transcripts for customer support and debugging. Most other Rev employees do not have access.
Does Rev offer enterprise-level security features for law firms?
Yes. Rev offers security features for organizations with strict requirements, including:
- SOC 2 Type II compliance
- Single Sign-On (SSO) using SAML 2.0 and Domain Claiming on the Unlimited (formerly Enterprise) plan
- Optional multi-factor authentication (MFA)
- A Data Processing Addendum (DPA)
- CJIS-compliant transcription on the Unlimited plan
- HIPAA-compliant transcription with a signed BAA
- Custom retention schedules, which you request through Support
To learn more, see SSO and Domain Claiming, or contact Rev Sales.
Where does Rev store my data?
Rev stores customer files and transcripts on AWS in the United States. Customer data is logically separated between accounts, and users can access only data within their own account or workspace. Rev's approved subprocessors are listed in Rev's Data Processing Addendum.
How can I ensure my firm's data is handled securely when using Rev?
To help keep your firm's data secure in Rev, you can:
- Set up SSO and multi-factor authentication.
- Use Domain Claiming to manage accounts under your firm's email domain.
- Limit account access to people who need it.
- Delete files you no longer need, or ask Support about a custom retention schedule.
- Sign a BAA if your files contain PHI.
For specific security concerns, contact your account manager or security@rev.com.
General Security FAQ
Can I request a copy of your standard NDA?
Yes. Rev can provide a signed copy of its standard NDA. To request one, email support@rev.com.
Can Rev or its employees read my transcripts or access my audio files?
If you order human transcription, Rev's professional freelance transcribers (Revvers) can access your audio files and transcripts while they work on them. Revvers go through ID verification and sign NDAs. Support and engineering staff have limited visibility into your files and transcripts to help with customer support and debugging. Most other Rev employees do not have access to your audio files or transcripts.
Are audio files and transcripts stored on Rev's servers?
Yes. Rev stores audio files and transcripts on Amazon Web Services (AWS) in the United States. Files stay in your account until you delete them, unless you arrange a custom retention schedule with Support.
Are my data, audio files, and transcripts encrypted on Rev's servers and in transit?
Yes. Rev encrypts your data in transit and at rest. Connections to Rev use HTTPS and Transport Layer Security (TLS) 1.2 or 1.3. Stored files are encrypted at rest using Amazon S3 server-side encryption (SSE) with AES.
Can you explain the encryption workflow for every transcription, from upload to long-term storage?
When you upload a file, it travels to Rev over HTTPS using TLS 1.2 or 1.3. Rev stores the file on AWS in the United States, where it is encrypted at rest with Amazon S3 server-side encryption (SSE) with AES, so the data would be unreadable even if a storage drive were physically stolen. Rev backs up critical system data multiple times per day. Your files stay in your account until you delete them, and Rev does not keep copies of a file after you delete it.
Is my data shared with or sold to a third party?
Rev does not sell your data to any third party. Rev shares customer data only as needed to fulfill orders, and only with approved subprocessors listed in Rev's Data Processing Addendum (DPA).
What data is shared with third parties, and why?
Rev shares data tied to orders you place only with approved subprocessors that provide part of the service, such as human transcription or AI processing. Approved subprocessors are listed in Rev's DPA. Rev requires each subprocessor to meet contractual obligations that are no less protective of personal data than Rev's own. Third-party LLM providers that Rev uses do not retain or train on customer data.
How does Rev handle requests for my data, audio files, and transcripts from law enforcement or private investigators?
Rev's Legal and Security teams review every request from law enforcement, private investigators, or through a subpoena before any user data or files are provided. They determine what Rev is legally required to provide. Rev does not give third parties access to customer data without a legal requirement and due process. For questions about a legal request, contact legal@rev.com or security@rev.com.
What technology is used to train Rev's transcription service?
Rev's automatic speech recognition (ASR) models are trained on a large, diverse set of real voice recordings, including data from human transcription orders unless the customer has opted out. Rev also uses a continuous feedback loop in which its professional human transcribers (Revvers) review and correct transcripts, and that feedback helps improve the AI.
Do you use my audio and transcription files to train your service?
Rev's own ASR models may be trained on data from human transcription orders unless you have opted out. Rev does not train external LLMs on customer data, and third-party LLM providers that Rev uses do not retain or train on it. To ask about opting out of Rev’s ASR training, contact your account manager or support@rev.com.
Do you use artificial intelligence to transcribe audio files? If so, what kind?
Yes. Rev's AI transcripts are created by Rev's own automatic speech recognition (ASR) model, a single neural network trained end to end as one unit. Rev also offers human transcription by Revvers.
Who owns the intellectual property rights to my audio and transcription files?
You retain ownership of your content. For the specific rights that apply to your content and Rev's services, see the Terms of Service in Rev's Legal Center.
Does Rev have data usage explanations besides the Privacy Policy?
Yes. Rev's Data Processing Addendum explains how Rev processes customer data, including the approved subprocessors. Rev's Privacy Policy explains how Rev handles personal data.
For further questions, contact Rev's security and compliance team at security@rev.com.