Meeting recordings and transcripts can contain business plans, personal information and confidential discussions. Before introducing a meeting assistant, identify the data you will process and the controls your organization requires.
Model training and provider retention
We do not use your meetings, audio, transcripts or documents to train, fine-tune or improve AI models, whether our own or anyone else's. Provider-specific terms, model-improvement settings and retention need separate verification. A provider's available zero-retention option does not establish that every ReVoice request uses it.
Meeting capture runs in Recall.ai's EU region in Frankfurt. Transcription through Recall uses Deepgram's EU endpoint. Some optional features and administrative services process data outside the EU/EEA.
Review the sub-processor information and DPA, and request evidence for the services used in your workflow. Include recording providers, speech recognition, AI analysis and any connected integrations.
Authentication and access
ReVoice includes password requirements, two-factor authentication, sign-in lockout controls and Cloudflare Turnstile for registration protection. Check which controls are enabled for your users and how account recovery and administrator access work.
Access controls and audit events should be assessed against the specific action and account role. An audit event does not, by itself, prove that every possible access is recorded. Agree which records you need for investigation and follow-up.
Encryption and processing regions
Traffic between your browser and re-voice.io uses TLS. Stored integration credentials are encrypted with AES-256-GCM. Assess meeting-content and storage protection per service and data type, including recordings, database records, object storage and backups. Request current evidence of encryption settings and key access where those controls are part of your requirements.
Processing, storage and provider access depend on the service and configuration. An EU storage location does not establish that all processing or access remains within the EU/EEA. Review applicable transfer mechanisms and accepted provider terms.
Retention and deletion
Distinguish the live database, provider recordings and backups when setting retention and handling deletion. Check the actual deletion process, retry handling and any legal retention requirements. Product controls support this work; they do not establish complete legal compliance for every use.
Use the security and trust information and privacy policy as a starting point and request dated operational evidence for controls that are decisive for your organization.