Everything we're held to, in one place.
Trust CentreOverview
Zone Scribe is a secure, certified AI scribe built for health and social care, where conversations are among the most sensitive there are. Recording, transcription and summarising are designed around privacy from the ground up: your data is never used to train AI, it lives on UK and EU infrastructure, and it stays yours to export or permanently delete.
Information governance, security and safety are embedded in every part of how we build and run Zone Scribe. Zone Scribe Pro and Enterprise are also registered as a Class I medical device with the MHRA, a documentation support tool for registered medical practitioners. Use this Trust Centre to review our security posture and how we keep your data safe.
Compliance
How Zone Scribe is protected, end to end.
Data privacy
- ✓GDPR-aligned by design
- ✓Never used to train AI, ours or anyone's
- ✓You remain the controller of your records
Data security
- ✓Encrypted in transit and at rest
- ✓UK & EU data residency
- ✓Export or permanently delete at any time
Access control
- ✓Role-based access to records
- ✓Audit trails on sensitive actions
- ✓Least-privilege access for our team
Application security
- ✓Secure development lifecycle
- ✓Independent penetration testing
- ✓Cyber Essentials Plus verified controls
Infrastructure
- ✓UK & EU cloud infrastructure
- ✓Business continuity & disaster recovery
- ✓Continuous monitoring & alerting
Information governance
- ✓Named Data Protection Officer
- ✓NHS DSP Toolkit assessed
- ✓NHS DTAC assessed for health & care
Policies
- ✓Information security policy
- ✓Data protection & retention policy
- ✓Incident response policy
Corporate security
- ✓Security awareness training for all staff
- ✓Confidentiality agreements
- ✓ISO 9001 quality management
Incident response
- ✓Defined incident response process
- ✓Data breach notification commitments
- ✓Clear route to report a concern
The questions IG teams ask first.
Is customer data used to train AI models?+
No. Recordings, documents and summaries are excluded from model training, ours and any third party's. This exclusion is a contractual commitment in our Data Processing Agreement, not just a policy position.
Where is data stored and processed?+
On UK and EU infrastructure only. Data is encrypted in transit (TLS) and at rest (AES-256). Residency details for each sub-processor are set out in the sub-processor list, available on request.
What are the controller and processor roles?+
Your organisation remains the data controller; Zone Scribe acts as processor under the DPA. Retention is controlled by you: any recording, document or summary can be exported or permanently deleted at any time.
How do I get a Data Processing Agreement?+
Request it by email. We'll provide the DPA, the current sub-processor list and any certificates or completed questionnaires your information-governance review requires.
How do I report a security concern?+
Email support@zonescribe.ai with the subject marked as a security concern. Reports are triaged under our documented incident response process, with breach notification commitments set out in the DPA.
Can you support a procurement or IG review?+
Yes. We regularly complete security questionnaires, DTAC evidence requests and DSP Toolkit checks for health and care organisations. Typical turnaround is a few working days.
Running a security review?
We'll support your procurement or information-governance process with certificates, our DSP Toolkit status, a data processing agreement and answers to your security questionnaire.