Built to be trusted with what you say.

How we encrypt your data.

• In transit: TLS 1.3 everywhere. HSTS preload. No HTTP fallback.
• At rest: AES-256 across all stored objects via Supabase Storage.
• Audio envelope: each recording is wrapped with a per-recording data encryption key (DEK). The DEK is stored encrypted by a per-workspace key encryption key (KEK) held in Supabase Vault. KEK rotation is supported.
• Enterprise BYOK: on the roadmap — a customer-supplied AWS KMS key will wrap the KEK so you hold the root of trust.

Retention controls.

Pick the retention window that matches the workflow. A scheduled Postgres job enforces deletion hourly; an audit log entry is written for every automatic and manual delete.

Your conversations never train anyone’s model.

Every upstream provider contract — Anthropic, Google, Deepgram, Cohere, Pinecone, Supadata — includes a no-training clause and zero-retention processing for the data we send. These clauses are re-signed annually and documented in our subprocessor list below.

Outbound API calls carry the do-not-train and equivalent headers wherever upstream providers support them.

One tap, everyone’s on the same page.

• Pre-recording consent notice: a one-tap action that sends a templated “this conversation will be recorded” message to the people you choose, before you hit record.
• Audible chime (optional): a short tone at recording start, off by default, on by region where required.
• Persistent indicator: the PWA shows a visible recording state the entire time capture is active. No silent recording, ever.

Every state-changing action is logged.

We write an append-only audit log entry for every meaningful action: uploads, exports, deletions, permission changes, retention-policy changes, API key creation, billing changes.

The audit_log table is append-only at the database level — UPDATE and DELETE are revoked from all roles except a compliance-only purge role. Workspace admins can export their full audit log via the dashboard or the API.

The vendors we rely on, and what they do.

Every change to this list triggers a notification to enterprise customers and is recorded in the changelog.

Found something? We want to hear about it.

• Report to: security@actascribe.ai (PGP key published shortly).
• Disclosure window: 90 days from triage. Researchers are credited unless they prefer not to be.
• Machine-readable contact: /.well-known/security.txt is published per RFC 9116.

Where we are, where we’re going.

• SOC 2 Type II: in progress. Targeting an external auditor engagement before scaling enterprise sales.
• GDPR: aligned. Data export and erasure available from the workspace settings panel.
• CCPA: compliant. We do not sell personal information, full stop.