API stability and versioning
Breaking changes, additive releases, and deprecation procedures follow our API stability commitments. Any version retirement includes at least 12 months’ notice through the changelog and email, together with a Deprecation response header.
No API version is currently deprecated. Legacy unversioned routes remain available, and shipped changes are documented in the changelog.
Security
The security page documents API-key hashing, encryption in transit, data-retention practices, and the complete subprocessor list, including the speech-recognition provider used when captions are unavailable.
Vulnerability reports are accepted at the address published in /.well-known/security.txt. The policy includes a three-business-day response commitment and safe-harbor terms for good-faith security research.
TranscriptFetch is not currently certified under SOC 2 or ISO 27001. Organizations that require either certification should account for this during procurement.
Evidence policy
- Every positive claim links to a public authority or an independently observable endpoint.
- Missing certifications must remain explicit.
No self-published testimonials, invented customer logos, aggregate ratings, or deleted registry entries. Reviewed as of 2026-09-12.