Security & Trust

Your meetings are private. Your data is secure. We take security seriously so you can focus on what matters.

End-to-End Encryption

All audio and data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption.

No Background Listening

Recording only happens when you explicitly press Start. No passive listening or data collection.

SOC 2 Type II Compliance

We're working towards SOC 2 Type II certification to ensure enterprise-grade security controls.

Secure Infrastructure

Hosted on AWS with regular security audits, DDoS protection, and 99.9% uptime SLA.

Data Processing Agreements

All third-party AI providers operate under strict data processing agreements (DPAs).

Access Controls

Role-based access control (RBAC) and multi-factor authentication (MFA) for team accounts.

Data Handling

Audio Processing: Audio is streamed directly to OpenAI's Realtime API using ephemeral tokens. We do not store raw audio unless you explicitly enable audio retention.

Transcripts: Transcripts are stored encrypted in our database. You control retention periods (30, 90, or 365 days) and can delete transcripts at any time.

Documents: Uploaded documents are processed, chunked, and embedded for retrieval. Original files are stored encrypted with access controls.

Third-Party Services

We use industry-leading providers with strong security track records:

  • OpenAI: AI processing with data processing agreements (no training on your data)
  • Supabase: Secure PostgreSQL database with row-level security
  • Stripe: PCI-compliant payment processing
  • AWS: Cloud infrastructure with SOC 2, ISO 27001 certifications

Compliance

GDPR: We comply with EU data protection regulations. Users have rights to access, export, and delete their data.

CCPA: California residents have additional privacy rights under CCPA.

Recording Laws: Users are responsible for obtaining proper consent. We provide tools (visible indicators, notifications) to help with compliance.

Incident Response

We have a security incident response plan in place. In the event of a data breach:

  • Affected users are notified within 72 hours
  • We work with security experts to contain and remediate
  • Post-incident reports are published transparently
  • We comply with all breach notification laws

Report a Security Issue

If you discover a security vulnerability, please report it responsibly:

Contact Support