Security and Compliance

Compliance status

• SOC 2: we are preparing for a SOC 2 audit of our security controls. Until our report is available, we answer security questionnaires and walk through our controls with your team.
• GDPR and privacy laws: customers can download and delete their data from the app, our retention periods are written down and enforced automatically, and we sign data processing agreements with business customers on request.
• Google API data: our use of Google user data follows the Google API Services User Data Policy, including its Limited Use requirements.

Your data stays on your device first

• Notes, transcripts and the email index live in an encrypted database on the user's computer, with the key in the system keychain. That copy is the source of truth.
• Meeting audio is not kept by default. If a user turns on keeping it, it is encrypted (AES-256-GCM) on their computer and deleted after 7 days.
• Transcription can run entirely on the computer, and local-only mode sends nothing to the Centri service or our providers.
• Email, calendar and meeting-tool connections are read-only, and are read from the user's computer.

On the Centri service

• Data is encrypted in transit (TLS) and at rest.
• Row-level security in the database means each account can only reach its own records.
• Teams and workspaces have owner, admin and member roles. Admins can require recording notice, turn off public links and transcript sharing, and see an audit log of membership and policy changes.
• The app never contains our providers' keys: it gets short-lived tokens for each session.
• Logs never contain note, transcript or email text.
• Share links use unguessable tokens, can expire, and can be revoked at any time.

Retention and deletion

Users can download everything the service holds for their account, or delete it, from the app. Ended share links, invites and deleted teams are purged automatically after 30 days, and audit logs after a year. The details are in our Privacy Policy.

Subprocessors

Supabase (database and sign-in), Deepgram (transcription), Anthropic (AI notes and answers) and Stripe (payments). Our AI provider does not train its models on customer data. See the Privacy Policy for what each one receives.

Reporting a vulnerability

If you find a security issue, write to paul@centriai.com with the details. Please give us reasonable time to fix it before sharing it, and do not access other people's data or disrupt the service while testing. We will reply and keep you updated.