SOC 2 Type II
CertifiedAnnual examinations validate our security controls across Security, Availability and Confidentiality.
Build with confidence on secure AI
SOC 2 Type II certified, HIPAA and GDPR compliant. Zero data retention covers text to speech, speech to text, Inworld-hosted LLMs and speech to speech.
Certifications
Trust center ↗An independent auditor examines our security controls every year for SOC 2 Type II. The trust center at trust.inworld.ai has the full details.
HIPAA
CompliantWe meet HIPAA, the US rules for protecting health information.
GDPR
CompliantAn EU regional deployment also keeps processing and storage inside the EU.
Zero data retention
Docs ↗With zero data retention, requests stay in memory. Their content is redacted from our logs the moment processing ends.
ProductNot retainedStill kept
Text to speechText input and generated audio, including cloned voices. Async and batch jobs run under it when results go to your own storage.Usage metadata for billing; voice cloning samples and voice design prompts
Speech to textAudio input and transcripts, for file uploads and WebSocket streams.Usage metadata for billing
Inworld-hosted LLMsPrompts, system prompts, tool calls and completions.Usage metadata for billing
Speech to speechPrompts, instructions, transcripts and response text. Payloads are also left out of diagnostic traces.Usage metadata for billing and service monitoring
Who turns it on
Owners and Admins, on the Data Retention tab of the Team page. It is available on Enterprise plans, and as an add-on on the Growth plan.
Organization or workspace
Set it once for the whole organization, or per workspace where one team has stricter rules. A workspace setting wins over the organization default.
When it applies
From the next request. A speech to speech session takes the setting it had when it connected. Turning it on does not delete content collected before.
Access and data protection
Your data is encrypted, and every access to it is logged. Enterprise plans add SCIM provisioning and EU and India regions.
Encryption
Data is encrypted at rest with AES and in transit with TLS.
Access to your data
Access to user data is granted only when a job function requires it, and all access is logged and periodically reviewed.
SAML single sign-on
Members sign in through your identity provider with SAML single sign-on.
SCIM 2.0 provisioning
Assign, move or offboard people in Okta or Microsoft Entra ID, and their Inworld membership and role follow.
EU and India regions
Fully isolated regional deployments store and process inputs and outputs in-region, alongside the US.
Vulnerability reports
Report a security issue to our security team through the vulnerability form at inworld.ai/report-security-vulnerability.
Questions about our security? Talk to our team about audits, data handling or a security review.
Questions
How does Inworld protect my data?
All data you send to Inworld AI's voice and LLM APIs is encrypted at rest with AES and in transit with TLS. We maintain administrative, technical, physical and organizational security measures to protect it. Access to user data is restricted and only granted when required for job functions, with all access logged and periodically reviewed.
What compliance certifications does Inworld AI hold?
Inworld AI is SOC 2 Type II certified, with annual examinations that validate our security controls across Security, Availability and Confidentiality. We are also HIPAA and GDPR compliant, and a BAA for HIPAA is available on Enterprise plans or as an add-on on the Growth plan. Enterprise plans add EU and India data residency, an SLA and a DPA.
What does zero data retention cover?
Zero data retention at Inworld AI covers text input and audio for text to speech, audio and transcripts for speech to text, prompts and completions on Inworld-hosted LLMs, and prompts, transcripts and response text in speech to speech. Requests are processed in memory and redacted from our logs as soon as processing completes. Usage metadata such as model, character count and timestamps is kept for billing, and voice cloning samples and voice design prompts are not covered.
Who can turn on zero data retention?
On Inworld AI, Owners and Admins of an organization on an Enterprise plan turn on zero data retention in the Data Retention tab of the Team page. It can be set for the whole organization or per workspace, and it takes effect from the next request. A workspace setting overrides the organization default, and turning it on does not delete content from earlier requests. On the Growth plan, zero data retention is an add-on that you cannot switch on or off yourself.
Can my data stay in the EU or India?
Yes, on Inworld AI Enterprise plans your data can stay in the EU or India, because those regions are fully isolated deployments. Inputs and outputs are processed and stored in-region, and workspaces, API keys and voices do not carry over between regions. The EU deployment keeps processing and storage in the EU for GDPR.
How does Inworld AI handle personal information?
Depending on where you live, and subject to certain limitations, Inworld AI's privacy notice gives you the right to access your personal information in a portable format, to delete or correct it, and to learn which third parties received it. You can opt out of its sale or sharing for advertising with the Do Not Sell or Share My Personal Information setting on our website. Voice information extracted from your recordings is kept until its purpose is met or for up to three years after you accessed your account, whichever comes first.
Does Inworld AI support single sign-on?
Yes, SAML single sign-on and SCIM 2.0 provisioning with Okta or Microsoft Entra ID are available on Inworld AI Enterprise plans, and Owners configure them. SCIM keeps users and groups in step with your identity provider, so access is added and removed in one place. Owners and Admins manage roles for the organization.