# Security (/docs/support/security/security)

Circleback is SOC 2 Type II and EU-U.S. Data Privacy Framework-certified and uses industry-leading practices to handle customer data, including encrypting data at rest and in transit.

We do not use customer data to train models. Our security portal at [security.circleback.ai](https://security.circleback.ai/) has more information, including a report of an external pentest done on our infrastructure.

Circleback is HIPAA-compliant. See [Enable HIPAA compliance](/docs/support/security/enable-hipaa-compliance) to turn it on for your workspace.

## GDPR

Circleback supports customers’ obligations under the GDPR (EU) 2016/679. When we process personal data on your behalf, we do so as a processor under our [Data Processing Agreement (DPA)](https://circleback.ai/dpa), and as described in our [Privacy Policy](https://circleback.ai/privacy).

Transfers of personal data from the EEA or the United Kingdom to Circleback in the United States can rely on Circleback’s EU-U.S. Data Privacy Framework certification, including the UK Extension to the EU-U.S. DPF for UK transfers. For unresolved complaints about personal data received under the UK Extension, Circleback cooperates with the UK Information Commissioner’s Office (ICO).

Workspace admins can also control how long meeting data is kept. See [Data retention settings](/docs/support/workspace-and-teams/data-retention-settings).

## Agreements

You can review Circleback’s security portal and legal agreements here:

- [Security portal](https://security.circleback.ai/)
- [Privacy Policy](https://circleback.ai/privacy)
- [Terms of Service](https://circleback.ai/terms)
- [Data Processing Agreement (DPA)](https://circleback.ai/dpa)
- [Business Associate Agreement (BAA)](https://circleback.ai/baa)