Every connection to the service is secured with tls 1.2/1.3, preventing eavesdropping or tampering as data moves between users and the platform.

Each customer’s transcripts, audio and metadata are fully segregated from other tenants, preventing cross-tenant access and strengthening confidentiality.

Customers retain full legal ownership of their content and can require its removal at any time, reinforcing control and compliance with contractual obligations.

Internal staff may view customer data only when explicitly authorised by the client, with all access logged for accountability.

All stored customer data is protected using aes-256 encryption, reducing the risk of unauthorized disclosure if physical media are compromised.

Enterprise administrators can set retention from 1 day to 3 years, aligning storage practices with internal policies and regulations.

When a meeting is deleted, all copies in production and backups are irreversibly erased in under 24 hours, minimising residual risk.

Free plans automatically archive content after 30 days, ensuring data is not kept longer than necessary.

Upon contract end, all customer data is purged unless otherwise agreed, preventing unnecessary retention.

No cold storage or delayed deletion is performed once data is removed, eliminating lingering copies.

Owner, admin and member roles provide least-privilege permissions that match job responsibilities across the organisation.

Enterprise customers can connect corporate identity providers for centralised user authentication and streamlined off-boarding.

Each user’s recordings remain private unless they choose to share, protecting confidentiality out of the box.

Users or admins can disable the service for specific meetings, preventing accidental capture of sensitive conversations.

Support or devops staff may only access content when clients share a secret identifier, ensuring oversight of privileged actions.

The platform meets eu data protection obligations, including eu-only hosting, lawful processing and support for all data-subject rights.

A designated dpo oversees privacy governance and serves as a point of contact for regulators and customers.

DPIAs are conducted for sensitive use cases, ensuring risks are identified and mitigated before processing begins.

Requests for access, deletion, portability or objection are honoured in no more than 30 days, helping customers meet legal timelines.

Transcripts, audio and metadata are never fed into internal models, preventing unintended reuse of personal information.

European user data is stored exclusively in belgian and dutch data centres, supporting regional sovereignty requirements.

The service can deploy data locally to satisfy regulations such as ccpa, offering flexible residency choices.

Production runs on a cloud platform that maintains iso 27001 and soc 2 attestations, adding independent validation of foundational controls.

Backups are held in physically and logically distinct locations from production systems, reducing correlated failure risk.

Clear procedures guide investigation, containment and remediation activities to minimise business impact.

Affected customers are informed in accordance with laws such as GDPR, supporting transparency and legal compliance.

Every incident is audited and lessons learned are fed back into controls, driving continuous improvement.

Metadata is backed up every four hours, limiting potential data loss in the event of system failure.

All backup files are encrypted and isolated, preventing compromise if backup repositories are accessed.

Backed-up metadata is retained for up to a year, balancing recovery needs with privacy obligations.

Audio and transcript files are excluded from routine snapshots unless contractually agreed, reducing exposure of sensitive material.

All subprocessors operate under strict dpas that define security and privacy obligations, extending protections beyond the core platform.

Third-party services are contractually barred from storing customer data longer than necessary, lowering residual exposure.

Access by processors is logged and reviewed every quarter, ensuring continued compliance with contractual terms.

Comprehensive internal reviews are performed every six months to evaluate control effectiveness.

External specialists test the platform each year, identifying vulnerabilities before they can be exploited.

Formal certification efforts are underway, signalling commitment to widely recognised security standards.

All user and administrator actions are captured for forensic analysis and compliance reporting.

Participants are automatically informed that a session is being recorded, supporting transparency and consent requirements.

Administrators can disable sentiment analysis across all workspaces, limiting processing of potentially sensitive insights.

Users may request anonymised versions of transcripts, enabling safer information sharing with broader audiences.