Snapshot 249964

Document
Security page
URL
https://www.assemblyai.com/security
Fetched
HTTP status
200
Content type
text/html; charset=utf-8
Fetch mode
static
Size
185718 bytes
SHA-256 (raw)
503fa2ab8888586aacf358ad48c479a71d23bc01cad955824f2b109514f45524
SHA-256 (normalized text)
0419afdbfba39b9fe1c577d28fa8a7f7412791a34b4d3998c6b30191baae5061

Normalized text

Scripts and page chrome removed; this is what change detection compares.

New AssemblyAI-TTS-1: Text-to-speech for voice agents. Learn more
platform
Platform overview
Models, APIs, and infrastructure in one place. Build voice into any product, on any stack.
transcribe
Pre-recorded Speech-to-Text API Realtime Speech-to-Text API Sync Speech-to-Text API
understand
Speech Understanding API Guardrails and Safety LLM Gateway
interact
Dictation API Text-to-Speech API new
inference
Self Hosted Voice AI Cloud
use cases
Voice Agents AI Notetakers Call Analytics Healthcare Medical Transcription Dictation Agent Assist AI Scribes
languages
English Spanish Portuguese French German Russian Hindi Dutch Japanese Italian All 99 Languages
customers
All customer stories
Top Voice AI companies are building with Assembly.
See all stories
Zoom leverages AssemblyAI to help advance its AI research and development.
Read the story
Siro achieves a 90% reduction in customer complaints and support tickets.
Watch the video
resources
Documentation API Reference Cookbooks Support Changelog Status
Latest Release
Text-to-Speech API
Our first text-to-speech model, AssemblyAI-TTS-1, is built for voice agents, on live calls. It sounds natural, responds fast, and keeps callers on the line.
Learn more
resources
Blog Partners Research Benchmarks Security
Security
Protecting your data is our priority
AssemblyAI uses enterprise-grade security practices to keep your data safe. We approach security by design and default.
View trust center Talk to sales
Security
Your data stays yours
Every request follows the same path: audio in, transcript out, deleted on a documented schedule. How long anything is kept depends on the API, and you can shorten it.
Audio received
Sent over an encrypted TLS 1.2+ connection
Transcript delivered
Returned to you via API response or webhook
Deleted on schedule
Removed per its retention schedule, or on request via the API
Retention you control
Streaming keeps no audio or transcripts once you opt out of model training. For pre-recorded audio, set a time-to-live as low as one hour, or delete transcripts on demand.
Opt out of model training
Paid accounts can opt out from the Data Controls page. Data under a signed BAA or sent to our EU servers is never used for training.
Encrypted end to end
Data is encrypted in transit with TLS 1.2+ and at rest with AES.
Compliance
Independently verified
Our controls are audited by independent third parties. The latest evidence, reports, and updates always live in our trust center.
SOC 2 Type 2 report
We maintain a SOC 2 Type 2 report covering security, availability, and confidentiality, audited annually by an independent firm. Download the latest report anytime in our trust center.
Penetration tests and vulnerability scans
We conduct third-party penetration tests and run vulnerability scans on a regular cadence across our infrastructure and applications.
Practices
Defense in depth
Security is not one control, it is layers of them. From how engineers reach production to how we ship code and select vendors, each layer is built to hold on its own.
Access control
Role-based access, SSO, and least-privilege permissions govern access to production systems.
Infrastructure security
Hardened cloud infrastructure with network isolation and continuous configuration monitoring.
Monitoring and logging
Centralized logging and continuous monitoring detect and alert on anomalous activity.
Incident response
A documented incident response process with defined roles, escalation paths, and post-incident reviews.
Secure development
Code review, dependency scanning, and security checks are built into our development lifecycle.
Vendor management
Third-party vendors are reviewed for security posture before and throughout engagement.
Full details in our docs
Our documentation is the source of truth for how each API handles retention, encryption, model training, and compliance.
Browse the security FAQ
Deployment options
The same security, wherever you run
Run on our fully managed cloud or inside your own environment. The controls, defaults, and guarantees stay the same either way.
Managed
AssemblyAI Cloud
Fully managed infrastructure with encryption, access controls, and monitoring built in. Retention and model-training controls are managed self-serve from your dashboard, with per-API details in our docs.
Explore deployments
Self-hosted
Self-Hosted Voice AI
Run our models inside your own environment. Audio never leaves your network boundary, with the same controls enforced on your terms.
Explore deployments
Common questions