Wave is SOC 2 Type 1 compliant. Recordings, transcripts, and summaries are encrypted in transit and at rest, never used to train AI models, and can be permanently deleted at any time. Below is exactly how Wave handles your data — and what we will and won’t do with it.
Wave’s independent Type 1 report addresses its system description and the suitability of the design of controls relevant to the AICPA Security criteria as of March 1, 2025. As a Type 1 report, it did not test operating effectiveness over a period of time. The full report is openly downloadable — download the SOC 2 Type 1 report (PDF). Read more about what the audit covered in our SOC 2 announcement. For Wave’s current SOC 2, ISO 27001, GDPR, and HIPAA status, policies, and reports, visit the Wave Trust Center.
Your audio, transcripts, and summaries are not used to train speech-recognition or summarization models — and we do not authorize the third-party processors Wave relies on to use your content for training either. This applies on every plan, including the free tier. The one exception is the free web tools on wave.co, which need no account: files uploaded there, and their transcripts, may be used to improve Wave's speech recognition.
Recordings and transcripts are encrypted in transit with TLS 1.2+ and at rest with AES-256. Customer data lives in Google Cloud’s Firestore, inside Google’s data centers, under their physical, network, and operational controls. Authentication is industry-standard, with rate limits and audit logging on sensitive actions.
Every recording, transcript, and summary belongs to you. You can delete individual recordings at any time, or permanently delete your entire account and all data from Settings. Permanently deleted data is removed from Wave's live systems immediately; short-lived disaster-recovery copies of our databases and file storage expire automatically within 7 days, and we never use them to restore deleted content to the live service. Read the full privacy policy.
Wave is HIPAA compliant. Wave signs a Business Associate Agreement (BAA) with healthcare organizations on a Wave Teams plan. Providers, practices, and health systems need that BAA in place before any patient conversations or other protected health information go into Wave. Individuals may use Wave to record their own appointments for personal reference, subject to recording-consent laws. Recording laws vary by jurisdiction — see our guide to meeting recording laws before recording in regulated contexts.
Email security@wave.co with details. We aim to acknowledge reports within one business day and follow coordinated disclosure on legitimate findings.
Yes. Wave is SOC 2 Type 1 compliant. The independent report addresses Wave's system description and the suitability of the design of controls relevant to the Security criteria as of March 1, 2025. As a Type 1 report, it did not test operating effectiveness over a period of time.
No. Wave does not use your recordings, transcripts, or summaries to train AI models — on any plan, including the free tier. Your audio and content are not shared with third parties for training.
Recordings, transcripts, and summaries are encrypted in transit with TLS 1.2+ and at rest with AES-256 inside Google Cloud's Firestore. Authentication is industry-standard with rate limits and audit logging on sensitive actions.
Customer data — recordings, transcripts, summaries — is stored primarily in Google Cloud (Firebase / Firestore), inside Google's data centers, under their physical, network, and operational security controls. Limited data is also processed by the subprocessors listed in our DPA at wave.co/dpa — for example, session text is indexed for search.
Only you, and anyone you explicitly share a recording with. Wave employees do not access customer recordings except in narrow, audit-logged cases: support (with your explicit consent), investigating abuse or a security incident, or where the law requires it.
Yes. You can delete individual recordings from inside any Wave app, and you can permanently delete your entire account and all associated data from Settings. Permanently deleted data is removed from Wave's live systems immediately; short-lived disaster-recovery copies of our databases and file storage expire automatically within 7 days, and we never use them to restore deleted content to the live service.
Wave Teams includes centralized billing and an admin dashboard. Admins see usage only, never recordings. Every Wave user can also set an audio retention period in Settings, so that the audio of their recordings is deleted automatically after the period they choose while transcripts and summaries are kept. For enterprise security needs (SSO, admin-enforced retention policies, custom DPAs), contact support@wave.co.
Wave is HIPAA compliant. Wave signs a Business Associate Agreement (BAA) with healthcare organizations on a Wave Teams plan. Providers, practices, and health systems need that BAA in place before any patient conversations or other protected health information go into Wave. Individuals may use Wave to record their own appointments for personal reference, subject to recording-consent laws.
Yes. The SOC 2 Type 1 report is openly downloadable from the Wave security page — no NDA required. Wave's standard Data Processing Addendum is published at wave.co/dpa and applies automatically to business use; for a countersigned copy, email privacy@wave.co with your company details.
Email security@wave.co with details. We aim to acknowledge reports within one business day and follow coordinated disclosure on legitimate findings.
Product
Use Cases
Compare
All rights reserved
Made with love in New York City