Privacy and Security in Wave
Who can see your recordings, how they're stored and encrypted, whether they train AI, and the controls you have to delete them. Also covers SOC 2, HIPAA, and Wave's DPA.
Your recordings, transcripts, and summaries belong to you. This page covers what Wave AI does with them and what you can control. The full details, including the downloadable SOC 2 report, are on wave.co/security.
Who can see your recordings
Only you, plus anyone you choose to share a session with.
- Sharing is opt-in, one session at a time. You can remove a person or turn off a public link at any time. See managing who has access and public links.
- Wave Teams admins can't open your recordings. They see who is on the team and how much each person uses Wave. Recordings, summaries, and transcripts stay private to each member. See Wave Teams.
- Wave staff don't access customer recordings except in narrow, audit-logged cases: support with your explicit consent, investigating abuse or a security incident, or when the law requires it.
How your data is stored
- Encryption: recordings, transcripts, and summaries are encrypted in transit with TLS 1.2 or later, and at rest with AES-256.
- Where it lives: mainly in Google Cloud (Firebase and Firestore). Some data is also processed by the subprocessors listed in Wave's Data Processing Addendum. For example, the text of your sessions is indexed so you can search it.
- AI training: Wave doesn't use your recordings, transcripts, or summaries to train AI models, on any plan, including the free plan. Wave also doesn't allow the third-party processors it uses to train on your content. The only exception is the free tools on wave.co that you can use without an account: files uploaded there, and their transcripts, may be used to improve Wave's speech recognition.
Your controls
| You want to… | Use |
|---|---|
| Delete one recording | Delete it from the session. It sits in Recently Deleted for 30 days, then it's removed for good. Use Delete Forever to remove it sooner. See Recently Deleted. |
| Keep transcripts but not audio | Audio retention in Settings → Privacy & data deletes audio automatically after an age you choose, or you can delete one session's audio by hand. See automatically delete recordings. |
| Stop sharing a session | Remove people or turn off the public link. See managing who has access. |
| Remove a voice profile | Delete it in your Voice ID settings. See Voice ID. |
| Delete everything | Delete your account. See deleting your Wave account. |
Data you delete permanently is removed from Wave's live systems straight away. Short-lived disaster-recovery copies of Wave's databases and file storage expire on their own within 7 days, and Wave never uses them to put deleted content back.
Compliance
Wave has a SOC 2 Type 1 report covering the Security criteria. A Type 1 report checks how controls are designed at a point in time. It doesn't test how they operate over a period. You can download the full report from wave.co/security without an NDA.
No. Wave is not HIPAA compliant and doesn't sign Business Associate Agreements (BAAs). Don't use Wave for provider, clinical, or other HIPAA-regulated work. You can use it to record your own appointments for personal reference, as long as you follow the recording-consent laws where you are.
Wave's standard Data Processing Addendum is published at wave.co/dpa and applies automatically to business use. It lists Wave's subprocessors. For a countersigned copy, email privacy@wave.co with your company details. Wave's privacy policy, including your rights over your data, is at wave.co/privacy.
Recording-consent laws differ by country and state, and some require everyone in the conversation to agree. You're responsible for getting any consent your local law requires. Wave's guide to meeting recording laws is a good place to start.
Email support@wave.co with what your organization needs.
Email security@wave.co with the details.
Was this article helpful?
Still need help?