A recorded customer call is easy to turn into text and hard to take back once it has left the building. Transcription is now cheap enough that sales, support and operations teams ask for it routinely. The decision that belongs to a manager is not "which model is most accurate?" but "where does the audio go while it is being transcribed?"
This guide compares sending audio to a cloud transcription service with running an open model on hardware you control. Consent and retention rules for AI meeting assistants are covered in AI meeting notes: consent, accuracy and retention.
Start with what the recording contains
A recording of a person speaking is usually personal data once the person can be identified. The UK regulator defines personal data as information relating to an individual who is identified or identifiable, directly or indirectly (ICO, read 11 November 2026). A call where a customer gives a name and an order number meets that test. That is our reading, not legal advice.
Sort recordings into three groups: low sensitivity (public webinars), business-confidential (internal meetings, supplier calls) and personal or regulated (support calls, interviews, anything with health, money or employment detail). The cloud question gets harder with each step. Decide the group first, because it sets how much a wrong assumption can cost.
What cloud services promise, rule by rule
Each vendor rule has a condition. The same sentence reassures or misleads depending on whether you read the condition.
OpenAI API. The data controls page (read 11 November 2026) says data sent to the API has not been used to train or improve models since 1 March 2023, unless you explicitly opt in. That covers training only. Separately, abuse monitoring logs are generated for API usage and kept for up to 30 days by default, unless longer retention is required by law or reasonably necessary to prevent harm. Customer content is excluded from those logs only if OpenAI approves your organisation for Zero Data Retention or Modified Abuse Monitoring. The endpoint table on the same page lists the audio transcriptions endpoint with no abuse monitoring retention and as eligible for Zero Data Retention, which is narrower than the general sentence, so ask which applies to your account in writing.
Google Cloud Speech-to-Text. Its data logging page (updated 26 October 2026) says the service does not log customer audio or transcripts by default. If you opt in to data logging for a project, Google may use the logged data to improve its services and you get discounted pricing. The opt-in terms add that data logged before you disable the option stays retained, that Google may retain it indefinitely and that deletion requests go through a form. A team that enables logging for a lower price has made a data decision, not a billing one.
Model churn. OpenAI's file transcription guide (read 11 November 2026) lists whisper-1, gpt-4o-transcribe and gpt-4o-mini-transcribe as deprecated, with shutdown on 26 February 2027. A hosted model changes on the vendor's schedule, not yours.
Cloud is often right for group 1. For group 3, one missed condition is the part that does not scale. Put the questions in what to ask an AI vendor before signing in front of any provider before the first real recording goes in.
What running it yourself involves
The best-known open option is OpenAI's Whisper. The project README states that code and model weights are released under the MIT License. That holds for that repository; derived models and fine-tunes can carry different terms, so read the licence of the exact file you download.
The README lists approximate VRAM needs: about 1 GB for tiny and base, 2 GB for small, 5 GB for medium, 10 GB for large and 6 GB for turbo. Its relative speeds were measured on English speech on an A100 data-centre GPU, and the README warns that real speed varies with language, speaking speed and hardware. Use the table to rank models, not to forecast your laptop.
Two MIT-licensed implementations help on ordinary hardware. whisper.cpp lists Apple Silicon support and integer quantisation, and its example command-line tool takes only 16-bit WAV input, so budget for a conversion step. faster-whisper claims up to four times the speed of the original at the same accuracy; its benchmark used specific hardware and settings, so repeat it on yours.
Local running gives you a pinned version: the file you tested last quarter is the one you run next quarter. That only helps if someone owns patching and access control on the machine.
Reading accuracy numbers
A word error rate (WER) counts substituted, deleted and inserted words against a reference transcript. "5% WER" means nothing without the language, the audio set and the model size.
The Whisper README says performance varies widely by language and shows large-v3 and large-v2 on the Common Voice 15 and Fleurs datasets. Those are not your call centre with crosstalk and speakerphones. The Whisper paper (Radford et al., 2022) reports models trained on 680,000 hours of multilingual supervision that are competitive with prior supervised results without fine-tuning. It is older than 24 months and cited for how the models were trained and evaluated, not for current figures.
Use published numbers for a shortlist and decide on your own audio. Take 10 to 20 representative recordings, transcribe a few minutes of each by hand, and compute the error rate per candidate. That method is our recommendation, not a vendor figure.
Who checks the output
Treat every transcript as a draft. Names, product codes, numbers and negations such as "can" versus "can't" are the usual failures. Name one person accountable for any transcript that feeds a decision or a customer commitment, and delete audio and transcript under the same retention rule; the data retention schedule guide shows how.
A decision path
- Group 1, with a signed provider contract: use the cloud and record which endpoint and data rules you rely on.
- Group 2: cloud is acceptable if whoever owns data protection approves the terms and retention in writing and logging or training opt-ins are off.
- Group 3, or a client contract that forbids third-party processing: pilot locally first. If accuracy on your audio needs more correction than the checker can afford, the answer may be a cloud service with approved terms, not a bigger local model.
- Small, irregular volume: one GPU workstation or a recent Apple Silicon Mac usually covers a pilot. That is our judgement, not a vendor figure.
Local does not remove duties: you still own access control, storage and upkeep. For the wider picture, see running AI models on your own hardware.
What to do next
Vendor pages change, so re-read them on the day you sign. Hardware figures come from project READMEs, not our benchmarks, and none of this is legal advice. Pick one group 3 recording type, run a two-week local pilot against one cloud candidate on the same audio, and let the numbers decide. If you want help scoping the pilot and writing the data rules, talk to our AI consulting team.
Sources
- ICO, What is personal data?, UK GDPR guidance, read 11 November 2026.
- OpenAI, Data controls in the OpenAI platform, read 11 November 2026. Vendor statements about its own service.
- OpenAI, File transcription, read 11 November 2026. Deprecation dates are the vendor's.
- Google Cloud, Speech-to-Text data logging, updated 26 October 2026, and Terms for opt-in for data logging, read 11 November 2026. Vendor statements about its own service.
- OpenAI, Whisper README and licence, read 11 November 2026. Memory, speed and language figures are the project's own.
- Radford et al., Robust Speech Recognition via Large-Scale Weak Supervision, 2022. Older than 24 months; still the primary paper describing Whisper's training and evaluation.
- ggml-org, whisper.cpp, read 11 November 2026.
- SYSTRAN, faster-whisper, read 11 November 2026. Speed claim is the project's own.
