Trust, Security and Compliance

Rime is committed to protecting the security and privacy of our users' data. Our voice AI platform serves enterprises in healthcare, financial services, and other regulated industries, so we've built our security program to meet that bar: independent compliance audits, minimal data collection by design, and deployment options that keep sensitive audio inside your own network. Millions of conversations run through Rime every month, many of them carrying information a regulator would care about. This page summarizes how we handle compliance, data, and deployment. If your security team needs more depth, we're glad to walk through the details on a call.

Compliance

Email us at info@rime.ai to request a compliance report.

As of May 2025, we are SOC 2 Type 2 compliant.
As of February 2024, we are HIPAA compliant. Our most recent audit was completed in March 2026.

Both certifications are maintained through recurring independent audits. Our SOC 2 Type 2 report covers the AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy, with controls observed in operation over the full audit window. The report is available under NDA for teams running vendor review. If you're in the middle of an evaluation, request it early, since security review is usually the longest step in procurement.

Data Practices

As a general practice, we don't collect customer data beyond character count unless requested. Character count is what we bill on, so character count is what we meter. We never use customer text or audio to train our models, and any retention beyond billing metadata happens only when a customer turns it on, for example keeping logs temporarily to troubleshoot an integration. If you have concerns, we are happy to sign an MSA or BAA to outline specific terms.

Rime is text in, audio out. We don't need to store conversation content to run the service, so by default we don't. Our Privacy Policy covers this in detail, including our zero data retention default and our commitment to never train models on customer data.

Agreements

If you'd like to discuss specific terms, please email us at sales@rime.ai.

We regularly complete security questionnaires and work through MSAs, BAAs, and data processing agreements as part of enterprise onboarding, and we can walk your team through our architecture and data flows on a call. Most reviews start with the SOC 2 report under NDA. From there, we answer questionnaire items directly rather than pointing your team at generic documentation, and we can loop our engineers in when a question goes deep on architecture.

Deployment Options

Different risk profiles call for different architectures. Alongside our standard cloud API, enterprise customers can run Rime in a dedicated VPC or fully on-premises, so audio and text stay inside your own network end to end. On-prem deployment supports the strictest requirements we see in healthcare and financial services, where conversation data may not be allowed to leave your environment at all. Cloud customers can choose regional endpoints to keep traffic close to their users and their infrastructure. On-premises deployments ship as standard container images and run with Docker Compose or Kubernetes, so they fit the orchestration tooling your platform team already operates.

Vulnerability Disclosure

We run a formal vulnerability disclosure program and welcome reports from security researchers. If you believe you've found a security issue in a Rime product or service, our Vulnerability Disclosure Policy explains how to report it and what to expect from us.

Subprocessors

We publish a current list of the subprocessors that support our service, so your security and compliance teams can see exactly which vendors touch our infrastructure and why.

More Details

For more details about our security practices, please see our Privacy Policy.