Speko procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Speko is operated from the United States and may process information in the United States and other countries where we or our subprocessors operate. Those countries may have data protection laws different from the laws where you live.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain information for as long as needed to provide Speko, comply with legal obligations, resolve disputes, maintain security, and enforce agreements. Account, billing, audit, and security records may be retained longer than product content where necessary. You may request deletion of your account or certain data by contacting us.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Speko processes voice data so the service can create live voice sessions, transcribe speech, route model requests, synthesize responses, provide observability, and allow customers to inspect or debug their own sessions. Depending on your configuration, Speko may send audio, transcripts, prompts, and related request data to third-party speech, language model, and voice providers selected by the routing system or by your organization. Session recordings are generally retained for 30 days after a session ends, then deleted by lifecycle policy, unless a different product configuration or legal requirement applies. Customers should avoid sending sensitive information unless their workspace and providers are configured for that use case.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Speko may rely on third-party providers for speech recognition, language models, text to speech, telephony, media transport, authentication, analytics, billing, infrastructure, and connected integrations. Third-party services are governed by their own terms and policies. Speko is not responsible for third-party services outside our control. If you connect a third-party account, such as Google Calendar, you authorize Speko to access and use the connected data and tokens only as needed to provide the integration and actions you configure. You may disconnect integrations through the platform or the third-party service.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share information only as needed to operate Speko or as you direct, including with: cloud hosting, database, storage, analytics, security, observability, and support vendors; speech, language model, voice, telephony, and media transport providers used to fulfill requests; payment processors and billing vendors; third-party integrations you connect or instruct Speko to use; professional advisors, auditors, and legal authorities when required; and successors in a merger, acquisition, financing, or sale of assets. Customers are responsible for reviewing the third-party providers they configure, including any provider-specific privacy, security, retention, and compliance terms.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.