Before You Upload That Deposition: 7 Data-Security Questions to Ask About AI Transcription

Imagine uploading a two-hour deposition to an AI transcription tool to save time, only to discover that you do not know how long the recording will be stored, who can access it, or whether it may be used to improve the AI system.

For attorneys, court reporters, paralegals, and legal support teams, this is an important consideration. Legal recordings can contain confidential client discussions, personal information, business secrets, witness statements, and details that could affect an ongoing case. Once this information is shared with an external service, protecting it requires more than simply trusting that the technology will handle it responsibly.

AI transcription can help legal professionals work more efficiently, but the choice of tool matters. Before uploading a deposition, client interview, hearing, or other sensitive recording, it is worth understanding how the service handles the information you provide.

Here are seven questions to ask before entrusting an AI transcription tool with confidential legal material.

1. Who Can Access My Recording and Transcript?

When you upload a recording, it may be processed by the transcription provider and, depending on the service, other companies that support its operations. The people and systems that can access your files will depend on the provider's security arrangements, account settings, and working procedures.

For legal professionals, this raises an important question: who can access the information beyond the person who uploaded it?

Some services may allow authorized staff to access files for support, troubleshooting, or quality checks. Others may rely primarily on automated processing. Neither arrangement should be assumed without checking the provider's policies.

Before uploading a recording, find out whether the provider limits access to authorized personnel, protects accounts against unauthorized entry, and keeps records of important access activities.

It is also worth checking whether files can be shared through public links or accessed by other members of a team. A secure transcription process should make it clear who is permitted to view, download, or manage the files.

What to ask: Who can access my audio and transcript, under what circumstances, and what controls prevent unauthorized access?

2. Will My Recording Be Used to Train or Improve AI Models?

One of the most important questions to ask is whether the provider uses uploaded recordings or transcripts to train or improve its AI models.

AI transcription services do not all handle customer information in the same way. Some may use submitted data for particular improvement purposes, while others may offer settings or contractual terms that restrict such use. The answer can also depend on the product, subscription, and account configuration.

It is important to understand the difference between processing a recording to generate a transcript and using that recording for a separate purpose, such as improving an AI model.

Do not assume that paying for a service automatically means your information will never be used for training. Equally, do not assume that every AI transcription service uses customer recordings for this purpose.

Read the provider's data-use policy and check the terms that apply to your specific account. If the information is unclear, ask for written clarification before uploading confidential material.

For legal professionals, this is especially important when recordings contain privileged communications, sensitive witness information, or details that could affect a client's position.

What to ask: Does the service use my recordings, transcripts, or related information to train or improve AI models, and can I restrict that use?

3. How Long Will My Audio and Transcript Be Stored?

Deleting a transcript from your computer does not necessarily delete the original recording from the transcription service. The provider may retain audio, generated transcripts, temporary files, or backups according to its own retention arrangements.

This matters because information that remains stored can continue to require protection, even after the transcription task has been completed.

Before using an AI transcription tool, check how long it keeps uploaded recordings and generated transcripts, whether you can delete them yourself, and what happens to copies held in backups or other systems.

It is also important to understand that deletion should not conflict with a legal hold, a client's retention instructions, or another applicable preservation obligation. The appropriate retention period depends on the circumstances and relevant requirements.

The UK's Information Commissioner's Office highlights the importance of limiting personal information to what is needed and considering how long it should be retained. These principles are useful when evaluating how AI services handle personal data, although the specific legal requirements depend on the applicable law.

What to ask: How long are my recordings and transcripts retained, and what happens when I request their deletion?

4. How Is My Information Protected During Upload and Storage?

Encryption is one of the security measures worth checking when evaluating a transcription provider. It helps protect information by making it unreadable to someone who does not have the necessary key to access it.

Two important questions concern how information is protected while being transferred between your device and the service, and how it is protected while stored on the provider's systems.

However, encryption alone does not guarantee that a service is secure. Access permissions, account protection, system management, and staff procedures also affect how well information is protected.

For example, a recording could be encrypted during transfer but still be exposed if someone gains unauthorized access to the account holding it. This is why security should be assessed as a whole rather than based on a single feature.

Ask the provider to explain its security measures in clear terms. Where appropriate, request supporting documentation and check whether its security claims have been independently assessed.

Your own working practices matter too. Use approved devices, protect your account credentials, and avoid uploading confidential recordings through accounts that your organization has not authorized.

What to ask: How is my information protected during upload and storage, and what other measures prevent unauthorized access?

5. Where Is My Data Processed, and Which Other Companies Handle It?

An AI transcription service may depend on several companies to deliver its service, including cloud hosting providers and other technology partners. These arrangements can affect where information is processed, who handles it, and which contractual protections apply.

For legal professionals working across borders, this deserves particular attention. A recording uploaded in one country may be processed or stored elsewhere, depending on the provider's arrangements.

The location of the data does not automatically determine whether the service is safe or unsafe. What matters is whether the provider understands and manages its responsibilities, including any applicable rules governing personal information and international transfers.

Ask whether the provider uses third-party services to process recordings, where the relevant information may be handled, and what protections govern those arrangements.

If your firm works with sensitive personal information or has specific client requirements, consult the appropriate legal or privacy professional before approving a service. Requirements can differ depending on the country, the type of information, and the nature of the legal work.

What to ask: Which third parties may process my information, where may it be handled, and what protections apply?

6. What Happens If There Is a Security Incident?

Even when a provider has security measures in place, it is important to understand how it would respond if something went wrong.

A security incident could involve unauthorized access, accidental disclosure, or the loss of information. For a law firm, the consequences may extend beyond the recording itself, particularly if the information concerns a client, witness, or ongoing dispute.

Before choosing a service, review whether the provider has a process for investigating incidents, limiting their impact, and notifying affected customers when required. Check the relevant contract for notification commitments and responsibilities.

Your organization should also know what to do if an employee accidentally uploads a deposition to an unapproved tool or shares a transcript with the wrong person. Staff should know whom to contact, how to report the incident promptly, and how to preserve relevant information for investigation.

The American Bar Association's Formal Opinion 512 reminds US lawyers that using generative AI does not remove their existing professional responsibilities, including duties concerning client confidentiality and supervision. Although its guidance is grounded in the US legal profession, the underlying lesson is relevant more broadly: technology choices need appropriate oversight.

What to ask: How will the provider respond to a security incident, and how and when will my organization be informed?

7. Can the Provider Prove Its Security Claims?

A transcription provider may describe its service as private, secure, or suitable for professional use. Those statements are a starting point, not a substitute for evidence.

Before uploading sensitive legal material, look for clear documentation explaining how the provider handles data, manages access, retains files, and responds to incidents.

Where relevant, ask whether it holds recognized security certifications or has undergone an independent security assessment. Check what the assessment covers and whether it applies to the particular service you intend to use. A certification can provide useful evidence, but it does not automatically establish that every aspect of a workflow meets your organization's requirements.

Review the provider's contractual terms as well. A privacy policy may explain general practices, while a contract or data-processing agreement may establish specific responsibilities and commitments.

Be cautious when a provider cannot explain its data-handling practices clearly, gives contradictory answers, or makes broad promises without supporting information.

The aim is not to find a provider that claims to eliminate every risk. It is to find one whose practices you can assess and whose commitments are appropriate for the information you need to process.

What to ask: What documentation, contractual commitments, or independent assessments can you provide to support your security claims?

A Practical Checklist Before Uploading a Legal Recording

Before submitting a deposition, interview, hearing, or client recording to an AI transcription service, use this checklist:

Confirm that the tool is approved for the intended legal work.

Understand who can access the recording and transcript.

Check whether the information may be used to train or improve AI models.

Verify the provider's retention and deletion arrangements.

Review its security measures and supporting documentation.

Establish whether third parties or overseas services may process the information.

Understand the provider's incident-response and notification procedures.

Check relevant client instructions, confidentiality obligations, and applicable legal requirements.

If you cannot answer these questions, pause before uploading the recording. Seek clarification from the provider or your organization's appropriate legal, privacy, or security contact.

Final Thoughts: Efficiency Should Not Come at the Expense of Confidentiality

AI transcription can be a useful part of a modern legal workflow, helping professionals turn recordings into searchable text and reducing the time spent on routine tasks. However, convenience should not be the only factor guiding the choice of a transcription tool.

The security of a legal recording depends on how it is collected, transferred, processed, stored, accessed, and eventually deleted. Understanding these stages helps legal professionals ask better questions and make more informed decisions about the tools they use.

At Verbalscripts, we understand that legal transcription requires careful attention to both the quality of the transcript and the responsible handling of sensitive information. When evaluating any transcription provider, ask clear questions about its actual practices, seek evidence for its claims, and make sure the service fits the needs of your work.

Before you upload that deposition, take a moment to check what happens to the information after you click submit. That small step can help you make a more informed decision and protect the trust your clients place in you.

This article is intended for general educational purposes and does not constitute legal or cybersecurity advice. Requirements vary by jurisdiction and matter. Consult the appropriate professional when assessing specific obligations.