What happens when you upload a recording to a transcription service

Uploading a recording feels like using a tool. In practice, you are giving a company a copy. That is often a fair trade. It should still be a decision you make on purpose.

Your audio takes a different route

A cloud service does the speech recognition on its own computers, so your file has to get there first. An on-device app does the same work on your phone. The result can look identical, but the two routes put different people in a position to reach your recording.

What a provider can usually do

The Freedom of the Press Foundation reviewed Descript, Otter, Rev and Trint, tools that journalists told them they use. Its conclusion about access was plain: “each of these companies has the technical ability to access the audio.” Encryption in transit and at rest doesn’t change that, because the service has to read the audio to transcribe it.

The policies on top of that ability vary. In the foundation’s review, some companies commit to accessing data only in limited cases, while Rev decides employee access case by case. It also found that Rev uses customer data to train its AI models by default, with an opt-out, and that none of the services it examined publishes a transparency report on legal requests.

None of this means these companies misuse recordings. It means you are relying on their policies, their staff, their vendors and their security, and those can all change after you upload.

Training is now part of the question

Speech models improve with real speech, which gives providers a reason to want your audio. Otter, for example, told the foundation that it trains on recordings and transcripts through an automated process, with the training data separated from account details.

Whether that is enough is being argued in court. A federal class action filed in California in 2025 alleges that Otter recorded private conversations without proper consent from everyone on the call, and used those recordings to train its models. These are allegations rather than findings, and we have not confirmed how the case has progressed. The lesson for everyone else is narrower: the people in a recording may not be the person who agreed to the terms.

Five questions before you upload

• Who can open it? Look for what the terms say about staff access and human review.
• How long is it kept? Check whether deleting a file also removes it from backups, and when.
• Does it train models? Search the terms and privacy policy for “train” and “improve”. Check whether the setting is on by default.
• Who else handles it? Most services use outside cloud and AI vendors. Look for a list of subprocessors.
• Did everyone in the recording agree? Your consent may not cover the other voices, and recording laws differ by place.

When the cloud is the right choice

On-device transcription has costs too. A phone has less memory than a data center, so the largest models won’t run on it. You also lose web-based team features, and there is no second copy if you lose the phone. If your audio is a public webinar and you want shared editing, a cloud service may well be the better tool.

The useful question isn’t which approach is better overall. It’s how much this particular recording could hurt someone if it ended up in the wrong place.

Where EchoLocal fits

We built EchoLocal for the recordings where that answer is “quite a lot”. Transcription runs on your phone, with no account and no upload, and your library is encrypted with AES-256. The app goes online only when you download a larger model, or buy or restore Pro. Our privacy policy sets out the details, including the limits.