| Route | Where the audio goes | Speed | Cost | Easiest to justify to an REB? |
|---|---|---|---|---|
| Your university’s own service | Institutional systems already covered by your institution’s agreements | Varies | Often free or subsidised | Yes — start here |
| Local AI (e.g. Whisper on your machine) | Nowhere. It stays on your computer | Fast once set up | Free (MIT licence) | Yes |
| Transcribe it yourself | Nowhere | Very slow — hours per hour of audio | Free | Yes, and it doubles as familiarisation |
| Cloud AI transcription | The vendor’s servers, location per their terms | Minutes | Subscription | Only if the vendor’s terms are named in your application |
| Human transcription service | Vendor servers and a contracted human listener | Hours to days | Per audio minute | Only with explicit disclosure in your consent form |
Notice what the table does not rank on: accuracy. All five routes produce a usable transcript. The variable that decides the choice for a Canadian thesis is whether you can describe the route to your Research Ethics Board and to your participants without changing what you already promised them.
The rule that actually governs this
Two articles of TCPS 2 (2022) do the work, and neither is about software.
Article 5.1: “Researchers shall safeguard information entrusted to them and not misuse or wrongfully disclose it. Institutions shall support their researchers in maintaining promises of confidentiality.”
Article 5.3 is the operative one: “Researchers shall provide details to the REB regarding their proposed measures for safeguarding information, for the full life cycle of information: its collection, use, dissemination, retention and/or disposal.”
Read the phrase “full life cycle” slowly, because it is the whole answer. Uploading a recording to a transcription service is use. The vendor storing it is retention. Deleting it afterwards — or failing to — is disposal. All three are inside the article, which means they belong in the application rather than in a decision you make quietly in week eleven.
TCPS 2 also defines the categories you are being asked about: physical safeguards such as locked cabinets and computer placement, administrative safeguards such as organisational rules on who may access personal information, and technical safeguards. A transcription decision is an administrative and technical safeguard question at once.
Which privacy law even applies to you?
Students reach for PIPEDA, and PIPEDA is frequently the wrong statute.
The Office of the Privacy Commissioner’s guidelines on processing personal data across borders are clear that PIPEDA “does not prohibit organizations in Canada from transferring personal information to an organization in another jurisdiction for processing.” What it does instead is make the sender accountable. Principle 1 of Schedule 1 states: “An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.”
The OPC also notes that Canada “has, through PIPEDA, chosen an organization-to-organization approach that is not based on the concept of adequacy” — unlike the European model, there is no list of approved countries to consult.
Then comes the caveat that most students miss. The same guidelines state plainly that they “do not cover transfers of personal information for processing by federal, provincial or territorial public sector entities” and do not deal with rules “found in provincial private sector privacy laws.”
Most Canadian universities are public-sector bodies governed by provincial legislation. So a methods chapter that cites PIPEDA as the governing rule for a university-run study may be citing a statute that does not apply to it. TCPS 2 says the same thing from its own side: researchers “are responsible for compliance with all applicable legal and regulatory requirements,” which “may vary by jurisdiction” and “may include obligations under the Constitution… and federal or provincial privacy legislation.”
The one-email fix: ask your research ethics office or privacy office which statute governs research data at your institution, and whether a vendor is already approved. Institutions increasingly maintain a list, and TCPS 2 notes that “formal privacy impact assessments are required in some institutions and may also be required under legislation or policy in some jurisdictions.”
What the vendors actually publish — and what we could not read
We read these pages first-hand in August 2026. One of them could not be read at all, which is itself worth reporting.
Rev
Rev’s security page is detailed. It states that files are protected “by industry best-practice standards (like TLS and S3 SSE encryption), both during transmission and storage,” lists compliance with “CJIS, HIPAA*, SOC 2 Type II compliance,” offers a SOC 3 report for review, claims GDPR compliance and says it is “never training external LLMs on your data.” It reports being trusted by “1M+ Users and 125K+ Organizations.”
Two observations, neither of them an accusation.
First, the named frameworks are American and European. CJIS and HIPAA are US regimes; GDPR is European. No Canadian framework is named on that page. That does not make the service unsuitable — it means the “comparable level of protection” argument you owe your institution has to be made by you, using their contractual terms, rather than read off a compliance badge.
Second, and more consequentially for a thesis: a human hears the recording. Rev states that “our human transcriptionists undergo rigorous vetting, including ID verification and NDAs, to ensure the confidentiality of your content.” That is a real safeguard. It is also a person outside your research team listening to your participant, and if your consent form says the recordings will be heard only by the research team, that sentence is now inaccurate.
Worth noting as due diligence rather than as criticism: Rev now presents itself primarily as an “Investigative Intelligence Platform,” with its industries led by legal, criminal prosecution, criminal defence and law enforcement, and research listed under “also serving.” The service is the same; the market it is built around has moved. A reviewer who checks the vendor will see what you saw, so it is better to have addressed it.
Otter.ai
We could not verify anything. The security page returned HTTP 200 but under a thousand visible characters — an application shell that renders its content through JavaScript. Rather than reprint a summary from a third party, we are recording that we could not read the vendor’s own terms. If you intend to use it, get the terms in a form you can attach to your ethics application.
The local option
OpenAI’s Whisper speech-recognition model is released under an MIT licence and runs on your own machine. We confirmed the repository is active, with its most recent commit in July 2026. Because inference happens locally, no recording is transmitted anywhere, which turns the hardest paragraph of your ethics application into the easiest one: the audio never left the researcher’s encrypted device.
The trade-offs are real. You need a reasonably capable computer, a command line is involved, and accuracy on accented speech, overlapping talk and specialist vocabulary still requires you to correct the output by ear. For a twenty-interview thesis, that correction pass is time you were going to spend on familiarisation anyway.
The consent wording that keeps your options open
Most thesis consent forms are written before the student has thought about transcription, and then quietly contradicted three months later. Two sentences at the drafting stage prevent that.
If you may use a service:
Audio recordings may be transcribed using a secure third-party transcription service under a written confidentiality agreement. The service may store recordings on servers located outside Canada. Recordings will be deleted from the service once the transcript has been verified.
If you will not:
Audio recordings will be transcribed by the researcher on an encrypted device and will not be uploaded to any external service.
The second is stronger and simpler, and it is worth choosing deliberately rather than by default. Whichever you pick, add the disposal step — TCPS 2’s life cycle ends at disposal, and “we will delete the file from the vendor’s account within X days of verification” is the sentence that closes the loop.
One more thing to plan while you are here: transcription conventions. Decide before you start whether you are keeping filler words, pauses and false starts, because latent readings of an interview depend on material that a cleaned-up transcript deletes. Say which convention you used in your methods chapter.
How to choose, in order
- Ask your institution first. Many Canadian universities already provide or approve a transcription route. If one exists, the compliance question is answered for you.
- If your data are sensitive, keep them local. Health information, illegal activity, identifiable small communities, anything where re-identification would harm someone — transcribe yourself or run a local model. TCPS 2 notes that technological developments “may heighten risks of re-identification,” and small populations are its own named example.
- If you use a service, name it in the application. Not “a transcription service” — the vendor, the storage location if published, the confidentiality terms, and the deletion step.
- Match the consent form to the plan, not the plan to the consent form. Changing what you do after participants have signed is an amendment, and amendments go back to the board.
Whatever route you take, the transcript is the input to the analysis rather than the analysis itself — our step-by-step guide to doing a thematic analysis for your thesis picks up from there, and the same data-location questions arise again at the coding stage, which we work through in our comparison of NVivo, ATLAS.ti, MAXQDA and Taguette.
Before any of it, the board has to say yes — see our guide to REB approval and the TCPS 2 rules in Canada for what triggers review and who decides. The tiered logic here will also feel familiar if your project touches national statistical files, where access level dictates handling in much the same way; our guide to Statistics Canada microdata sets out that ladder.
Once the transcripts exist, the writing starts. Draft your methods and findings chapters in Tesify and keep structure and references consistent while every interpretation remains 100% written by you.
Frequently asked questions
Can I use Otter or Rev for my thesis interviews?
Often yes, but it is your REB’s decision. TCPS 2 Article 5.3 requires you to give the board your safeguarding measures across the full life cycle of the data, so the service belongs in the application rather than in an unrecorded choice.
Does my data have to be stored in Canada?
Not as a blanket rule. PIPEDA does not prohibit cross-border processing but holds the transferring organisation accountable and requires comparable protection by contractual or other means. Your institution’s own provincial obligations may be stricter, so ask.
Why might PIPEDA not apply to my study?
The OPC’s cross-border guidelines explicitly exclude processing by federal, provincial or territorial public sector entities. Most Canadian universities fall under provincial public-sector legislation instead.
Is there a free transcription option that keeps audio offline?
Yes. Whisper is MIT-licensed and runs locally, so nothing is uploaded. Manual transcription is the other fully offline route.
Do human transcriptionists sign confidentiality agreements?
Reputable services say so — Rev describes ID verification and NDAs for its transcriptionists. The point for your ethics application is that a person outside the research team hears the recording, which your consent form should say.
How long does manual transcription take?
Several hours per hour of audio for most people, longer for poor recordings or multiple speakers. Budget it as a real phase of the project rather than as an evening.
Should I keep the filler words?
Decide before you start and state the convention in your methods. A latent or discursive reading depends on hesitations and false starts that a cleaned transcript removes.
Do I need to delete the recording from the service?
Yes, and you should say when. Disposal is the last stage of the life cycle named in TCPS 2 Article 5.3, so a deletion step belongs in both your application and your consent form.
What if I already uploaded recordings before thinking about this?
Raise it with your supervisor and your ethics office now rather than at submission. A voluntary early disclosure is a very different conversation from one that starts at your defence.
Does anonymising the transcript solve the problem?
Not for the audio, which carries a recognisable voice. And TCPS 2 warns that re-identification risk persists even with coded or anonymised information, particularly in small populations or with unusual characteristics.
Can I use a bilingual transcription service for French interviews?
Yes, and the same questions apply. Confirm that quality assurance is done by a francophone transcriptionist, because an English-first workflow tends to mangle Québec French idiom in ways that are invisible until you code it.
Is a paid service more defensible than a free one?
No. What is defensible is a route you can describe accurately and that matches your consent form. A free local model is often the easiest of all to justify.