By default we do not store raw audio or full transcripts. Audio is streamed for real‑time guidance, processed ephemerally, and discarded once the session ends. Transient buffers exist only in memory for the duration of processing.

• No PII required to use the app; user identity is abstracted behind org SSO where configured.
• No logs of verbatim content; we only keep optional, de‑identified aggregates if your org enables Analytics.
• Recording is user‑initiated; the microphone is never “always on.” A visible in‑app status pill shows capture state in real time.

We follow strict data‑minimization. We collect only what is necessary to authenticate users and deliver sessions.

• Required: org identifier, user identifier (pseudonymous or via SSO), device metadata (non‑PII).
• Optional: team/segment labels for admin analytics, set by your org — never inferred.
• No biometric storage, no health data, and no open microphone telemetry outside active sessions.

• In transit: TLS 1.2+ with modern ciphers; SRTP for audio streaming where applicable.
• At rest: AES‑256 encryption for configuration and analytic aggregates.
• Keys: Managed via cloud KMS; Enterprise can opt for customer‑managed keys (BYOK/CMK).
• Secrets: Rotated regularly; access is scoped by least privilege and audited.

No. We do not use customer data (audio, transcripts, or metadata) to train foundation models. For optional org‑specific tuning of prompts/flows, we use synthetic and admin‑provided examples only. Third‑party models are called with strict data‑processing terms and no data is retained for training by default.

• Default: no human access to customer content; we do not store transcripts.
• Support access to configuration/metadata is role‑based, time‑bound, and requires multi‑party approval.
• All access is logged and reviewed; production access is segregated and protected by hardware security keys.

Admins see only de‑identified, org‑level aggregates when enabled: usage counts, protocol popularity, and outcome trends. No individual transcripts, audio, or identifiers are exposed.

• Minimum cohort thresholds prevent re‑identification.
• Admins can disable Analytics entirely or set strict retention windows.

We offer regional hosting options for eligible plans (e.g., US, EU). Analytics—if enabled—remain within your selected region. Enterprise customers can opt for single‑tenant or VPC‑isolated deployments.

• Independent security assessments and continuous vulnerability scanning.
• DPA, SCCs, and subprocessor disclosures available on request.
• We align controls to industry best practices and continually improve our posture.

• SSO (SAML/OIDC) and SCIM provisioning for user lifecycle management.
• Granular role‑based access controls and audit trails for admin actions.
• BYOK/CMK and regional residency available on Growth & Enterprise plans.

• Audio: ephemeral; discarded after session. No transcripts stored by default.
• Aggregates: configurable retention (e.g., 30/90/180 days) or disabled entirely.
• User deletion: admins can request deletion; we propagate across systems and confirm once complete.
• Incidents: documented IR plan, rapid triage, customer notification per applicable regulations and contracts.

• Clear in‑app indicators for session start/stop and microphone status.
• Users can delete local session artifacts on device; servers hold no transcripts by default.
• Org admins control whether Analytics is enabled and set retention policies.

We use vetted infrastructure and, where applicable, model providers under strict DPAs and no‑training terms. Subprocessors are documented and monitored; we notify customers of material changes per contract.