We prioritize system security and customer privacy at every stage of the engineering process. Noota runs on enterprise-grade infrastructure with security, performance, and reliability at its core. We apply a security-by-design approach and encrypt all customer data — recordings, transcripts, emails, and metadata — at rest and in transit. Our systems are continuously monitored and updated to ensure full data protection.
Powered by Wolfia. Review compliance certifications, security policies, subprocessors, and request access to detailed documentation.
We prioritize system security and customer privacy at every stage of the engineering process.
Noota runs on enterprise-grade infrastructure with security, performance, and reliability at its core.
We apply a security-by-design approach and encrypt all customer data — recordings, transcripts, emails, and metadata — at rest and in transit.
Our systems are continuously monitored and updated to ensure full data protection.
Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers
Protects customer information through strong encryption and logical separation measures.
Gives customers granular control over how long data is kept and how it is permanently removed.
Ensures only authorised users and organisations can reach sensitive resources.
Noota operates this public trust center. It publishes 6 independent compliance certifications, security documentation available on request, and a published list of its subprocessors.
Yes. Noota maintains SOC 2 Type II compliance. You can review this in the compliance section of this trust center.
Yes. Noota is ISO 27001 certified. You can review this certification in the compliance section of this trust center.
Yes. Noota maintains GDPR compliance. See the compliance section of this trust center for details.
Noota discloses its subprocessors in this trust center, including Bastion Technologies, Brevo, and Gladia. See the subprocessors section for the complete list.
You can request access to Noota's security documentation directly through this trust center. Submit an access request and the Noota team reviews and grants access.
Does your team answer security questionnaires too? Wolfia answers them for you and runs trust centers
Protects customer information through strong encryption and logical separation measures.
Every connection to the service is secured with tls 1.2/1.3, preventing eavesdropping or tampering as data moves between users and the platform.
Each customer’s transcripts, audio and metadata are fully segregated from other tenants, preventing cross-tenant access and strengthening confidentiality.
Customers retain full legal ownership of their content and can require its removal at any time, reinforcing control and compliance with contractual obligations.
Internal staff may view customer data only when explicitly authorised by the client, with all access logged for accountability.
All stored customer data is protected using aes-256 encryption, reducing the risk of unauthorized disclosure if physical media are compromised.
Gives customers granular control over how long data is kept and how it is permanently removed.
Enterprise administrators can set retention from 1 day to 3 years, aligning storage practices with internal policies and regulations.
When a meeting is deleted, all copies in production and backups are irreversibly erased in under 24 hours, minimising residual risk.
Free plans automatically archive content after 30 days, ensuring data is not kept longer than necessary.
Upon contract end, all customer data is purged unless otherwise agreed, preventing unnecessary retention.
No cold storage or delayed deletion is performed once data is removed, eliminating lingering copies.
Ensures only authorised users and organisations can reach sensitive resources.
Owner, admin and member roles provide least-privilege permissions that match job responsibilities across the organisation.
Enterprise customers can connect corporate identity providers for centralised user authentication and streamlined off-boarding.
Each user’s recordings remain private unless they choose to share, protecting confidentiality out of the box.
Users or admins can disable the service for specific meetings, preventing accidental capture of sensitive conversations.
Support or devops staff may only access content when clients share a secret identifier, ensuring oversight of privileged actions.
Demonstrates alignment with european privacy law and transparent personal-data handling.
The platform meets eu data protection obligations, including eu-only hosting, lawful processing and support for all data-subject rights.
A designated dpo oversees privacy governance and serves as a point of contact for regulators and customers.
DPIAs are conducted for sensitive use cases, ensuring risks are identified and mitigated before processing begins.
Requests for access, deletion, portability or objection are honoured in no more than 30 days, helping customers meet legal timelines.
Transcripts, audio and metadata are never fed into internal models, preventing unintended reuse of personal information.
Leverages certified cloud environments and strict geographic controls to safeguard operations.
European user data is stored exclusively in belgian and dutch data centres, supporting regional sovereignty requirements.
Production runs on a cloud platform that maintains iso 27001 and soc 2 attestations, adding independent validation of foundational controls.
Backups are held in physically and logically distinct locations from production systems, reducing correlated failure risk.
Provides a structured approach to detect, contain and communicate security events.
Clear procedures guide investigation, containment and remediation activities to minimise business impact.
Affected customers are informed in accordance with laws such as GDPR, supporting transparency and legal compliance.
Every incident is audited and lessons learned are fed back into controls, driving continuous improvement.
Maintains resilient copies of critical metadata while limiting unnecessary replication of sensitive content.
Metadata is backed up every four hours, limiting potential data loss in the event of system failure.
All backup files are encrypted and isolated, preventing compromise if backup repositories are accessed.
Backed-up metadata is retained for up to a year, balancing recovery needs with privacy obligations.
Audio and transcript files are excluded from routine snapshots unless contractually agreed, reducing exposure of sensitive material.
Controls how service providers handle customer information and limits downstream risk.
All subprocessors operate under strict dpas that define security and privacy obligations, extending protections beyond the core platform.
Third-party services are contractually barred from storing customer data longer than necessary, lowering residual exposure.
Access by processors is logged and reviewed every quarter, ensuring continued compliance with contractual terms.
Provides independent verification and continuous oversight of the security programme.
Comprehensive internal reviews are performed every six months to evaluate control effectiveness.
External specialists test the platform each year, identifying vulnerabilities before they can be exploited.
All user and administrator actions are captured for forensic analysis and compliance reporting.
Empowers customers to tailor privacy-sensitive features to their organisational policies.
Participants are automatically informed that a session is being recorded, supporting transparency and consent requirements.
Administrators can disable sentiment analysis across all workspaces, limiting processing of potentially sensitive insights.
Users may request anonymised versions of transcripts, enabling safer information sharing with broader audiences.
