Security

What leaves,
and what stays.

This page is written for whoever has to sign off before a team installs this. It says what the product does today, and it says plainly what it does not do — because a security page that only lists strengths is not a security page.

Not a substitute for a DPA or a lawyer-drafted policy; those replace this before enterprise sales. The privacy note is the shorter version of the same facts.

The shape of it

Local-first, not local-only — and we say which is which.

Stays on the machine: Meeting audio. Transcripts. Notes. The memory of facts, people and vocabulary. Screen readings. All of it lives in one encrypted database on the user's own disk.
Leaves the machine: Audio for transcription, transiently, to Groq. Transcript text for extraction, transiently, to Anthropic. Agent tasks to Claude Code under the user's own subscription. An email address and workspace membership to Supabase for sign-in. Nothing else.
Never leaves: Screen images. OCR runs on-device; what crosses the wire is at most a short list of rare terms so a name is spelled correctly, never a picture of the screen.

At rest

One encrypted file, and machinery that can tell when it is wrong.

Encryption and key custody

The store is SQLCipher — encrypted SQLite — with full-text search over it. The key lives in the Windows Credential Manager, not in a file, not in the binary, and not in a log. The app shows only whether a secret is present, never its value.

A deliberate consequence worth stating: because we hold no copy of that key, we cannot recover a user's data for them, and neither can anyone who compels us. A user-held recovery key is the next piece of work here, and until it ships the Credential Manager entry is a single point of loss.

Backups that are verified, not assumed

A backup nobody has opened is a rumour. Each one is written encrypted, then reopened, integrity-checked, row-counted against the source, and its search index rebuilt and queried before it is allowed to replace the previous generation. Three generations are kept, plus one copy in a second directory.

One rule is written into the code: a backup that has rows is never overwritten by a source that has none. Without it, a single bad launch turns a recoverable problem into a permanent one.

It can tell "new" from "everything is gone"

Startup distinguishes a genuine first run from a truncated file, a foreign file, a database written by a newer version, and a wrong key — as separate, typed conditions. Only actual corruption is allowed near a recovery path, because a wrong key and a corrupt file look identical to the encryption layer and treating one as the other destroys data.

Retention that cannot eat the product

An earlier version of the cleanup routine would delete meetings past a cap — with their transcripts and notes — and trim the memory oldest-first. Meetings and durable facts are now never deleted by retention. Only regenerable machine state is capped, per identity, and every run writes an audit record.

Recordings

The plainest paragraph on this site.

A .wav of the meeting stays on your disk. We do not upload it, and we do not delete it for you. Transcription is a cloud call to Groq Whisper; that audio is transient. The file on your machine is yours to keep or delete.

That sentence appears word-for-word on the landing page, in the FAQ, on the privacy note and here — deliberately, because the previous version of this site said "we never store recordings" on one page while another said a copy is kept forever. There is no automatic retention policy for those files yet, and an explicit setting is planned.

Consent is your responsibility, not ours to assume: recording other people has legal requirements that differ by jurisdiction, and the product does not and cannot check them for you.

The agent

Nothing irreversible happens without a human.

This is the property most worth auditing, so here is how it is enforced rather than promised.

Where it runs: In Claude Code, sandboxed, under the user's own subscription and identity. We do not build pixel-clicking computer use — there is no code path that moves the mouse or guesses at a UI.
What it may do alone: Produce text and place it in the field the user was already typing in. That is reversible by pressing delete, which is why it needs no gate.
What it may never do alone: Send, commit, publish, or otherwise take an irreversible action. Those stop at an approval step by construction, not by configuration — there is no setting that turns the gate off, because it is where the tiers are joined.
Why you can check its output: Every commitment extracted from a meeting carries the transcript line it came from and a playable timestamp. An item with nothing to point at is dropped rather than shown.

Not built

The list a security review actually needs.

Absent controls are more useful to you than present ones. These are ours.

Does not exist today

No third-party connectors. Notion, Slack, Teams and calendar are not built, so no workspace is connected and nothing is pushed anywhere.
No cloud copy of your content. The encrypted mirror is in development and not shipped; today a lost machine is lost history.
No user-held recovery key. If the credential store entry is lost, the database cannot be opened by anyone, including us.
No SSO, SCIM, audit-log export, or admin console. There is no team tier yet to attach them to.
No automatic retention for meeting audio. The .wav files persist until deleted by hand.
No penetration test and no SOC 2. One person, one month — claiming either would be worse than admitting neither.
No macOS or Linux build.

Subprocessors

Three, and what each one sees.

Supabase: Account, sign-in and workspace membership. No meeting content, no transcripts, no memory.
Groq: Speech-to-text, and a small model for deterministic text cleanup. Transient.
Anthropic: Meeting extraction, and the delegated agent via Claude Code. Transient.

Questions a review needs answered: emin@navrick.ai. One person reads that inbox, and it is the person who wrote the code.

What leaves,and what stays.