Security starts with where you deploy

Security for transcription is not a badge or a vague promise. It starts with choosing whether a recording belongs in a hosted service or on infrastructure you control. For highly confidential material, self-hosting is the appropriate boundary.

Hosted service boundary

At tryscriptorium.com, recordings are transmitted over HTTPS to the Scriptorium server and processed there. Accounts are isolated so one account cannot list, read, search or export another account's transcripts. Read the privacy policy for retention and deletion details.

Self-hosted boundary

In a self-hosted deployment, the application, recordings, transcripts and search index run on hardware you administer. You are responsible for operating-system access, disk encryption, backups, network controls and the identity provider you choose. This is the right model when a third-party hosted boundary is unacceptable.

Application protections

• Passwords are stored as salted scrypt hashes; sessions use HttpOnly, SameSite cookies.
• State-changing requests are protected by same-origin checks.
• Production server mode disables host-path features for remote users.
• Account deletion removes owned recordings, transcripts, search entries and settings.
• Optional cloud AI features are off unless an administrator explicitly enables them.

Production checklist

Use HTTPS, persistent disk-encrypted storage, server mode, a retention policy and restricted administrator access. Close open registration once intended users are enrolled. Configure OpenID Connect where central identity management is required. The deployment guide explains these steps in context.

Reporting a security problem

If you think you have found a vulnerability, please tell us through the contact page and mark the message as a security report. Include what you saw and how to reproduce it, and please do not access other people's data while testing.

Limits

No automated transcript should be treated as perfect, and no web application can make an unprotected server safe. Review exports and access regularly, protect the host and choose self-hosting when the recording's sensitivity demands it.