Security

Data protection

• All traffic is encrypted with TLS. Integration tokens are encrypted at rest with AES-256-GCM.
• Recordings and transcripts are stored in access-controlled cloud storage and databases.
• Workspace data is isolated per company and filtered by meeting visibility on every request.

Access control

• Role-based access, API keys that can be revoked, and an audit log of key actions.
• Production access is limited to staff who need it.

Retention and deletion

Admins set retention policies; expired content is purged automatically. Meetings, and entire accounts and workspaces, can be deleted by customers. See the privacy policy.

Responsible disclosure

Report vulnerabilities to [email protected]. See security.txt. We acknowledge reports within 3 business days.

Incident response

We notify affected customers without undue delay, and within 72 hours where the law requires.