Trust & Security

Where your data goes, who can see it, and what we will never do with it.

Audio, video and labels are the product, so how they are handled is the product too. This page lists the controls in plain terms. For the contractual version, the legal pages are one click away.

Send a security questionnaire
Data handling
  • Encrypted in transit and at rest.
  • Original device capture is kept alongside anything we resample; nothing is silently transformed.
  • No copies are made outside the collection's home region.
Access and isolation
  • Access is role-scoped and logged. A grader sees the clip they are grading and nothing else.
  • Graders stream a clip; they do not download it.
  • Bucket handovers use time-boxed credentials, in your bucket or ours.
Workforce
  • Nobody reaches production work before passing a calibration test on the guide.
  • Reviewers on customer data work under NDA.
  • Datasets carry contributor IDs, never names. Personal details stay out of the delivery.
Consent
  • Captured on the file, before the contributor speaks or films, naming what the data trains.
  • Withdrawable before payout — the session is deleted, not archived.
  • The consent reference ships in the manifest of every item.
Residency and deletion
  • A collection is pinned to one region at kickoff — EU (Frankfurt), US (N. Virginia) or India (Mumbai) — and stays there.
  • Deletion requests run in the home region and propagate to backups within 35 days.
  • Exports are delivered from the home region, in the agreed format.
Benchmark audio
  • Held-out benchmark sets are never delivered to any model provider.
  • A development split is open so nobody is scored on a format they have not seen; the scored set is not.
Where data lives
EU
Frankfurt — EU and UK collections, or any customer who asks
US
Northern Virginia — default for US collections
India
Mumbai — South Asian locales and local-storage requirements
Processing
Storage, transcription, labelling and scoring run inside the home region
Transfers
Only on written instruction, on Standard Contractual Clauses, with the route recorded
Certifications and compliance
SOC 2AICPAAICPA SOC 2ISO 27001CERTIFIEDISO 27001:2022ISO 27701CERTIFIEDISO 27701:2019TPNGOLDTPN GoldGDPRCOMPLIANTGDPRCCPACOMPLIANTCCPAHIPAACOMPLIANTHIPAA

SOC 2 attested by an independent auditor, with the report available under NDA. ISO 27001:2022 for information security, ISO 27701:2019 for privacy management and TPN Gold for content security — certificates on request. GDPR, CCPA and HIPAA compliant, with the controls for each on the compliance page. Enterprise engagements include an annual audit right over residency controls and access logs on request.

Request the reports and certificates
Questions

The ones a security review asks first.

Can we run the work in our own cloud?
Yes. Work can run in your bucket and your enclave, pinned to the region agreed at kickoff. We keep no copy you have not authorised.
Who can see our data inside Perit?
The graders assigned to it, one clip at a time, streamed not downloaded; the reviewers who sample it; and the engineers who operate the pipeline, under logged access. Nobody else.
What happens if a contributor withdraws consent?
Future use stops and the audio is removed from datasets we still control. Copies already delivered under licence cannot be recalled, which is why consent is taken before recording, not after.
How do we report a security concern?
Write to us. We acknowledge within two business days, we do not pursue good-faith research, and we tell you when it is fixed.
Which certifications do you hold?
SOC 2 (report under NDA), ISO 27001:2022, ISO 27701:2019 and TPN Gold — certificates on request. The control summary and the data processing agreement come with them.
Are you GDPR, CCPA and HIPAA compliant?
Yes. Consent as the lawful basis and 30-day data subject requests for GDPR; no sale of personal data and a working opt-out for CCPA; PHI handling with a Business Associate Agreement on request for HIPAA. The compliance page lists the controls behind each.

Report a concern.

Write to us. We acknowledge within two business days, we do not pursue good-faith research, and we tell you when it is fixed.

Report a security issue
PrivacyTermsData residencyAI Compliance