Security & privacy

Your files are handled only by the CadreScripts editors, transcribers, linguists or annotators assigned to your project, and the reviewers who check their work. Everyone signs a written confidentiality agreement before they touch client content, and we are happy to sign your own NDA as well.

• Files are uploaded, shared and delivered over encrypted connections (HTTPS/TLS 1.2 or 1.3).
• Files are stored with cloud providers that encrypt data at rest, behind access controls.
• Our website scores A+ on the SSL Labs test, with HSTS and modern security headers on every page.

• Access is granted per project, on a need-to-know basis, and removed when the work is delivered.
• Client files are not kept on shared or public computers, and our team follows written security rules, including for personal devices.

• Client files and deliverables are deleted 21 days after delivery, or sooner if you ask.
• Transcript Editor projects are deleted automatically after 14 days, and uploaded videos after 7.
• On request, we confirm deletion in writing.

• We never paste your content into public AI tools or use it to train AI models without your written consent.
• Automatic transcription in our Transcript Editor runs on Amazon Transcribe (AWS), only when you ask for it.
• Our current providers (sub-processors) are Google (file storage and email), Bluehost (website, forms and email delivery), Amazon Web Services (Transcript Editor) and Wise (payments). We give business clients notice before adding a new one.

• A web application firewall and malware scanning protect the site, with brute-force login protection.
• Daily database and weekly full backups are kept off-site.
• Software is updated promptly, and our forms collect only the details needed to reply to you.

If a security incident affects your data, we will tell you within 48 hours of becoming aware of it, explain what happened and what we are doing about it, and help you meet any duty to notify regulators or the people affected.

• For the files you send us, you are the controller and we are your processor: we act only on your instructions.
• Transfers outside the EEA and UK are covered by the EU Standard Contractual Clauses and the UK Addendum in our DPA.
• We comply with the Kenya Data Protection Act 2019, and act as a service provider under the California Consumer Privacy Act. We do not sell or share personal information.

For procurement and security reviews we can send:

• Data Processing Agreement (GDPR Art. 28, with the EU Standard Contractual Clauses and the UK Addendum)
• Mutual non-disclosure agreement, or we sign yours
• Client service agreement
• Sub-processor list and answers to your security questionnaire

Email info@support.cadrescripts.com and we will reply within one business day.

Security or privacy questions, or a suspected issue: info@support.cadrescripts.com. Post: CadreScripts, P.O. Box 35544-00100, Nairobi, Kenya. See also our Privacy Policy and Terms of Service.