Audio handling
- By default, transcription is a cloud service. The app ships with live streaming transcription selected because it is the only engine that can tell a speaker has finished in time to answer. On that setting the audio lanes you enable are streamed over an authenticated, TLS 1.3 relay we operate and forwarded to Deepgram. The audio is transcribed in transit and is not recorded or stored by us.
- You can make it fully on-device. Settings → Speech Recognition offers a local Whisper model and macOS dictation. With either selected, audio frames are processed in memory on your own hardware and nothing is transmitted. The picker labels each engine with whether audio leaves your machine.
- The relay exists so the provider credential never reaches your computer. It passes audio through; it does not archive it. Lanes nobody is speaking into disconnect on their own, so silence is not transmitted.
- Generating an answer sends transcript text and your context profile to the answer model. Audio is never part of that request.
Overlay isolation
The response overlay sets the platform’s screen-capture exclusion flag, so it is omitted from screen shares, recordings and screenshots taken by conferencing software. This is a window-level property, not a visual trick — the compositor never hands the overlay to the capture stream.
Data isolation
- Every table holding account data has row-level security enabled, with policies scoped to
auth.uid(). A user’s token can only ever read that user’s rows. - Staff access is a separate, explicit role stored in its own table. Nobody can grant themselves that role through the public API.
- Administrative queries run through
SECURITY DEFINERfunctions that re-check the caller’s role in their own body, so being able to call one is not the same as being allowed to use it. - Data is encrypted in transit (TLS) and at rest by the database provider.
Authentication
- Sessions use short-lived JWTs with refresh tokens held in
HttpOnlycookies, refreshed server-side on each request. - Passwords are hashed by the auth provider; we never see them.
- Password resets are one-time links sent to the address on the account.
Payments
Stripe handles checkout, cards and invoices. Card numbers never reach our servers, and subscription state is reconciled from signed Stripe webhooks rather than from anything the browser reports.
Reporting a vulnerability
If you find a security issue, tell us before telling anyone else. Send the details through the contact page with “Security” as the subject and enough information to reproduce it. We aim to acknowledge within two business days and will keep you updated until it is resolved. Please do not run automated scans against production or access data that is not yours.