AI Scribe Trust & Security: What Vets Need to Know

What a Trust Center Actually Is (and Why Most Vets Never Look at One)

Picture this: a sales rep demos an AI scribe tool, it looks impressive, and they offer you a free trial. You press record at the start of your next consult. A client shares their dog's weight, their own address, maybe a concern they haven't told their GP. Audio streams somewhere into the cloud. You get a SOAP note back in seconds. But where did that audio go?

A trust center is a vendor's public answer to that question. It is a dedicated page or portal where the company discloses its security certifications, data-handling policies, and compliance posture. Done properly, it tells you exactly who touches your data, where it lives, and what happens when something goes wrong.

Most vets never look at one. That is partly because they are not widely advertised, and partly because veterinary software has historically been on-premise, so the question rarely came up. Cloud-based AI tools change that completely. Every consultation you record captures sensitive client and patient data, and the moment it leaves your practice network, your responsibility to protect it follows it.

The phrase "we take security seriously" on a vendor's website is not a trust center. It is a marketing sentence. A real trust center links to actual documents: a privacy policy with version dates, a data processing agreement, audit reports you can read. If a vendor cannot point you to one, that absence tells you something worth knowing before you sign anything. You can read more about the broader evaluation process in our guide on what to ask before choosing an AI scribe.

The Core Documents You Should Be Able to Find

A vendor's trust center is only as useful as what it actually contains. These six documents are the baseline. If any are missing, ask why.

Document Name	What It Covers	Red Flag If Missing
Privacy Policy	How personal data is collected, used, and shared	No legal basis for processing client data
Data Processing Agreement (DPA)	Contractual obligations between you and the vendor	No GDPR or equivalent compliance backbone
Terms of Service	Ownership, liability, and acceptable use	Unclear who owns your clinical records
Subprocessor List	Third parties (cloud hosts, speech engines) with data access	Hidden data flows to unknown third parties
Incident Response / Breach Notification Policy	How and when you are notified of a breach	No guarantee of timely disclosure
Retention and Deletion Policy	How long data is kept and how it is destroyed	Your data may be kept indefinitely

The subprocessor list deserves special attention. Most AI scribe tools rely on third-party speech-to-text engines and cloud hosting providers. Those companies also touch your data. The DPA is the contractual backbone of that entire chain, and without it, your practice has no written guarantee of how data is handled once it leaves the vendor's own systems.

Security Certifications Worth Recognising

Certifications are not all equal, and vendors know that most buyers cannot tell the difference. Here is a quick reference.

Certification	What It Audits	Veterinary Relevance
SOC 2 Type I	Security controls at a single point in time	Weak baseline; a starting point only
SOC 2 Type II	Controls operating effectively over 6-12 months	Strongest common SaaS standard
ISO 27001	Information security management system	Relevant for EU and international practices
HIPAA Attestation (US)	Protected health information handling	Required for US practices handling PHI
Cyber Essentials (UK)	Basic cyber hygiene controls	Entry-level standard for UK practices

SOC 2 Type II is the one to look for in SaaS vendors. The difference between Type I and Type II matters: Type I is a snapshot taken on one day, while Type II covers an ongoing audit period, usually six to twelve months. A vendor can also claim "SOC 2 compliance" without holding a formal attestation. Ask to see the actual report or the attestation letter. If they cannot produce it, the claim is unverified.

How Your Consultation Audio and Text Are Handled

The moment you press record, a chain of events starts. Understanding that chain is the most practical thing a practice owner can do before adopting any AI scribe tool. For a fuller picture of the technology itself, see our article on how AI scribes work and what they get right.

Audio is captured on your device, then transmitted to the vendor's servers (or a third-party speech engine listed on that subprocessor list). The audio is transcribed into text. That text is processed by a large language model to generate a structured SOAP note. The finished note is returned to you. So far, so useful. But what happens next to the audio file and the raw transcript is where many vendors go quiet.

Some vendors delete audio immediately after transcription. Others store it for days, weeks, or indefinitely. A client who shared sensitive personal information during that consult has no idea their words are sitting on a cloud server in another country. Ask the vendor directly: does audio get deleted after transcription, and what is the confirmed timeline? Get the answer in writing.

Model training is the point that most practices never think to raise. Does the vendor use your consultation data to retrain or improve its AI models? Some do, and some bury the opt-out in a settings menu few users ever open. This is not a hypothetical concern. If a vendor is training on real consultation audio, your clients' words are becoming part of a commercial product. That is a conversation you need to have before the trial starts, not after.

Data residency matters too. Where are the servers physically located? For practices in the UK, EU, or Australia, data stored on servers in another jurisdiction may create compliance obligations under GDPR, the UK GDPR, or the Privacy Act respectively. A vendor with no clear answer on server location is a vendor that has not thought through regional compliance.

A Practical Security Checklist Before You Sign

Use this flow when evaluating any AI scribe vendor. If a vendor cannot answer at any stage, that branch leads to one place.

Print this checklist and keep it with your vendor evaluation notes. Any vendor worth working with will have clear answers at every step.

What VetStack Discloses and Why Transparency Is a Feature, Not a Formality

Vendors that invest in real security transparency tend to be the ones building for the long term. A trust center takes time and money to maintain. Putting one together signals that a company expects to be held accountable, not just during a sales call, but after you have signed and started relying on the tool every day.

At VetStack, we believe every practice deserves straight answers to security questions. If you want to know which subprocessors handle your data, where our servers are located, or how our model training policy works, ask us directly. We will point you to the documentation, not a vague assurance.

There is a clinical dimension to this too. A vet who trusts their software stack uses it more fully. That means better records, faster SOAP notes, and less cognitive load at the end of a full day of consults. Tools like our drug dosage calculator only deliver their real value when the practice has confidence in the platform behind them. Distrust creates workarounds, and workarounds create gaps.

Security transparency is not a compliance checkbox. It is part of what makes a tool worth using. If a vendor cannot show you their scribe trust center, that is not an administrative gap. It is a signal about how they think about your practice's data.