Security & Compliance
This page describes the security controls HeyDonna has in place today. We list only what we can verify, and we update it as controls change.
Infrastructure Security
Data Encryption
- In Transit: All traffic to HeyDonna is served over HTTPS (TLS)
Network Security
- Our website is served through Cloudflare
Access Control
- Sign-in is handled by Clerk, and multi-factor authentication is supported
- Workspaces have owner and member roles
- Administrative functions are restricted to authorized administrators
Application Security
Development Practices
- Code changes are reviewed before they are merged
- Automated tests run on every change in our CI pipeline
Data Isolation
Requests to our backend are authenticated, and access to projects and transcripts is checked against the signed-in account and its workspace.
Compliance
Beta Status: As an early-stage product, we're working towards formal compliance certifications.
- SOC 2: Audit in progress
- HIPAA: Not currently HIPAA compliant
Data Portability
You own your data. From the editor you can export transcripts as DOCX, TXT and RTF.
Third-Party Processors
We use the following providers to run HeyDonna:
-
Clerk
Authentication and user management
-
Convex
Application database
-
Cloudflare R2
Storage for uploaded audio and transcript files
-
Modal
Cloud compute for audio and document processing
-
AssemblyAI
Speech-to-text transcription
-
LLM providers
Google Gemini, Anthropic, OpenAI and OpenRouter, for AI proofreading, formatting, review and chat
-
LangSmith
Tracing of AI processing runs; traces are retained for 14 days
-
Axiom
Operational logs; logs are retained for 30 days
-
Stripe
Payment processing
-
Resend
Transactional email
Security Contact
Report Security Issues
- Email: security@heydonna.law
Your Security Checklist
To maximize security on your end:
- Enable two-factor authentication
- Use strong, unique passwords
- Keep your browser and OS updated
- Report suspicious activity immediately