> ## Documentation Index
> Fetch the complete documentation index at: https://docs.dovetail.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security and trust
Dovetail holds some of the most sensitive material your organization has: customer interviews, support conversations, recordings of real people. This page is a summary of how that data is protected — independent assurance, where it's stored, how sensitive content is masked and expired, who can get in, and how AI handles it — with links to the detail pages for each area.
Explore all security information, keep up-to-date with real-time monitoring, and request access to Dovetail's security documentation in our [Trust Center](https://trust.dovetail.com/).
***
## Independent assurance
* **SOC 2 Type II** — Dovetail has received a SOC 2 Type II report, audited by [BARR Advisory, P.A](https://www.barradvisory.com/) against the AICPA's Trust Service Criteria for Security, Availability, and Confidentiality. Dovetail is committed to an annual audit, and copies are available in the [Trust Center](https://trust.dovetail.com/).
* **Penetration testing** — [CyberCX](https://www.cybercx.com.au/) performs web application penetration testing on an ongoing basis, based on OWASP and CWE/SANS Top 25 methodologies.
* **PCI DSS** — All payments to Dovetail are processed via [Stripe](https://stripe.com/), a certified PCI Level 1 Service Provider.
* **Security alliances** — Dovetail participates in the Cloud Security Alliance STAR program, has completed the Vendor Security Alliance (VSA) Core self-assessment, and holds the McAfee Enterprise-Ready seal.
Pre-completed responses to the CSA CAIQ v4.0.2 and VSA-Core 2019 questionnaires are available to request in the [Trust Center](https://trust.dovetail.com/resources), so your vendor review team doesn't have to wait on us.
[Read the full security information page →](/help/security-information)
***
## Where your data is stored
Dovetail runs on Amazon Web Services. When you create a workspace, you choose whether its data is stored in the **United States**, **Europe**, or **Australia**. That choice is made once, at workspace creation, and can't be changed later.
Some categories of data — product analytics, billing and contact details, workspace URLs, access logs, and support data — are always stored in the United States, and sub-processors may process data outside your selected region.
[Data storage and regions →](/help/security-information)
***
## Protecting sensitive content
**Blur and redact.** Automatic redaction uses AI to find and mask sensitive information in videos, audio, and transcripts across projects and channels — blurring video, muting audio, and hiding transcript text. Admins choose the automation level (`Off`, `On`, or `Suggest`), edit the instruction prompt, and maintain explicit always-redact and never-redact term lists. Redactions carry through to highlights and their references elsewhere in the workspace, and downloads are blocked while redactions exist on the source media. Available on the Enterprise plan.
**Data retention.** Set a retention period — from 90 days up to 12 years, or indefinite — after which audio and video files are automatically deleted, at the workspace level or per project. Highlights, reels, and transcripts survive the deletion, and files can be restored within a 30-day recovery window. Available on the Enterprise plan.
**Virus scanning.** Dovetail scans files on download and blocks any file where a virus is detected. Virus definitions are updated daily.
Mask PII in video, audio, and transcripts.
Automatically expire recordings on a schedule.
***
## Access and authentication
Admins can require users to authenticate via OpenID Connect SSO or SAML 2.0, with setup guides for AD FS, Auth0, Microsoft Entra ID, Google Workspace, and Okta. See [Single sign-on (SSO)](/help/single-sign-on-sso) and [SAML SSO](/help/saml).
With SCIM 2.0 provisioning, users and groups are created, updated, and deactivated in Dovetail automatically from your identity provider. Okta and Entra ID are supported. Available on the Enterprise plan — see [SCIM API](/help/scim-overview).
Users who sign in with a password can add TOTP-based 2FA using an authenticator app. Available on all plans. If you sign in through SSO, Google, or Microsoft, your identity provider enforces MFA instead. See [Two-factor authentication](/help/two-factor-authentication).
Passwords are hashed and salted with Bcrypt, must meet a 12-character complexity standard, and accounts lock after 5 failed attempts. Users can review and end their active sessions, and admins can set a session age or log out every user in the workspace at once. See [Security information](/help/security-information) and [Security settings](/help/security-settings).
Admins can restrict who can invite users, who can assign paid seats, who can remove redactions, and whether web links can be created at all. Domain allow listing restricts sign-up to your approved email domains. See [Security settings](/help/security-settings).
Access levels control how people can view and interact with each project and doc. See [Access and permissions](/help/access-and-permissions).
***
## AI and your data
Dovetail's AI features run on tailored AI infrastructure on AWS, deployed alongside where your data already sits. **No customer data is used to train or improve models** — for Dovetail or for anyone else. Requests are sent to a model and the response is returned; the models don't learn from your content.
Admins can also set an **AI processing location** — Best available, United States, Europe, or Australia — to align AI processing with your data residency and governance requirements. This is configured separately from the transcription region.
Automatic redaction uses AI and may not be 100% accurate. Review redactions, particularly in `Suggest` mode, to confirm sensitive content is handled correctly.
[Dovetail AI overview →](/help/dovetail-ai/overview) · [AI settings →](/help/security-settings)
***
## HIPAA
Dovetail offers a HIPAA add-on for Enterprise customers, providing additional controls for handling protected health information. On HIPAA-enabled workspaces, CSV export, video downloads, transcript exports, and public doc sharing are disabled by default, authentication is enforced via SSO, and API key generation (and therefore MCP connectors) is disabled. Dovetail can enter into a Business Associate Agreement (BAA), and all sub-processors handling ePHI have signed a BAA with Dovetail.
[HIPAA details →](/help/security-information)
***
## Legal and privacy documentation
Dovetail publishes its [Privacy Policy](https://dovetail.com/privacy/privacy-policy/), [Data Processing Agreement](https://dovetail.com/privacy/data-processing-agreement/), [Compliance with Laws](https://dovetail.com/privacy/compliance-with-laws/) statement, and [Data Subject Access Request](https://dovetail.com/privacy/data-subject-access-request/) process, along with the current [sub-processor list](https://trust.dovetail.com/subprocessors).
If your organization has bespoke security questionnaires you'd like completed, this service is offered for Enterprise workspaces. See [Do you fill out security assessments?](/help/security-information)