Your calls train your team. Never our models.
Your client recordings and transcripts are never used to train models — ours or any vendor's — and never sold or monetized as data. This is contractual, not a settings toggle. A DPA is available on request.
Four steps, every one under no-training terms.
AI providers in the production chain are Anthropic and OpenAI, both under enterprise no-training API terms. The sub-processor list below is the exhaustive source.
Encrypted ingestion
Calls arrive via Zoom OAuth, a signed partner API, or direct upload — encrypted in transit.
Stored in the US
Recordings and transcripts live in the United States (Supabase on AWS, us-west-2), encrypted at rest and isolated per organization.
Transcribed & audited
Vetted processors under enterprise no-training terms: Deepgram for transcription, Anthropic and OpenAI for the audit.
Delivered to your team
Results reach the right roles. Magic-link reports are read-only and expire in 30 days.
Who touches your data, and where.
Each provider processes only the minimum required for its function. We update this page before adding a processor.
The table above is the complete list. Our Privacy Policy covers the terms under which each one processes data.
Isolation enforced at the database, not the UI.
- Organization-scoped row-level security — no cross-tenant access, enforced at the database, not just the UI.
- Role-based dashboards: admins, supervisors, and agents each see only what their role permits.
- Caller-identity sanitization for managed engagements — voices are separated without exposing PII.
- Audit log on every administrative action.
- Magic-link reports are read-only and expire after 30 days.
Your plan sets how long we keep your data — and you can delete it anytime.
The periods below are what your plan guarantees we retain while you are a customer. Deletion runs on request, and on termination within the window stated in our Terms; either way it is verified: we re-count every table and your recording storage afterwards, and the job reports itself as unclean if anything survives. Scheduled expiry at the end of each period is on our roadmap — we would rather tell you that than imply it already runs. Life-insurance workflows involve PII, not PHI; if your use case touches health data, talk to us first.
90 days
13 months
10 years
Custom
Found something? Tell us — we would rather hear it from you.
We do not run a paid bug bounty, and we would rather say that plainly than imply one exists. What we do offer: we read every report, we reply, and we will credit you publicly if you want the credit.
Safe harbour. If you follow this policy in good faith, we will not pursue legal action against you, and we will work with you if a third party does. Machine-readable contact details: /.well-known/security.txt.
We verify tenancy isolation against production, and we publish the date. An automated scan signs in as an administrator of one organisation and tries to reach a second organisation’s data across 43 probes covering 34 administrative routes — every request must be refused. It runs after every production deployment and once a day. Last verified against production: 2026-10-15. That date is written by the scan itself, not by a person. If the scan stops running, the date stops moving and you will watch it go stale on this page. The scan carries a positive control — one request that must succeed — so that “everything was refused” can never be mistaken for “we never got in at all”. A run that cannot measure is reported as indeterminate, not as a pass.
Every change is gated before it ships. Each pull request must pass a type check, the full automated test suite, a production build, a dependency audit that fails on any high-severity CVE, a secret scan of the whole repository, and equivalent cross-organisation checks run in process against that pull request’s own code before it can merge.
Internal reviews, described accurately. We no longer publish a fixed review cadence: we would rather tell you what a review actually covered than promise an interval we cannot prove. The most recent, on 7 September 2026, was the full nine-layer sweep: access control across all 127 API routes, tenancy isolation, the age and history of every secret, dependency and prompt-injection surfaces, response headers measured against the live deployment rather than the config file, webhook and cron authentication, and audit logging. It did not cover object-storage policies, an active penetration test, or an audit of our subprocessors. Ask us for the write-up and we will send it — findings included.
What we do not have. No SOC 2 report, no ISO 27001, no third-party penetration test, no paid bug bounty. Backups run daily; we have not yet rehearsed a restore, so we do not claim a recovery time. We are a small team and we would rather show you the controls we actually run than a badge we have not earned. Ask us for anything specific and we will answer it straight.