How Whisperer handles your data

How your data moves

Five stages between your microphone and an answer. Open any one to see what it carries.

1. 01 Your device

   Carries: Microphone and system audio, screenshots you take, files you upload.

   Why: Capture has to happen where the call happens. The desktop overlay is excluded from screen capture, so it does not appear when you share your screen, and access tokens are kept in the operating system's own secret store — Keychain on macOS, DPAPI on Windows — rather than in a readable file.

2. 02 The connection

   Carries: Everything between your client and Whisperer.

   Why: HTTPS with TLS 1.2 or newer. The session token travels in the Authorization header rather than in the URL, so it does not end up in server or proxy logs. The edge sends HSTS, a no-sniff policy, a frame-deny policy and a strict referrer policy.

3. 03 Whisperer API

   Carries: Requests, after authentication, rate limiting and an ownership check.

   Why: Authorization is fail-closed: when a right is not confirmed, the request is refused rather than allowed just in case. Rate limits are keyed per token rather than per address, so people behind one shared connection do not share a bucket.

4. 04 Storage

   Carries: Meetings, transcripts, notes, tasks and calendar in a managed database; files and recordings in object storage; short-lived state in a managed cache; search vectors in a vector database.

   Why: The application reaches the database with full certificate verification against a pinned root, so a substituted endpoint fails instead of connecting. Data is stored on servers in Russia and/or the EU, as stated in the privacy policy.

5. 05 AI providers and connected services

   Carries: For a feature that needs a model — an answer, a transcript, a translation, an embedding — the content that feature works on. For a service you connected yourself, the data that integration covers.

   Why: We do not run our own speech and language models. This is the boundary where data leaves our infrastructure, so it is named explicitly rather than left implied. The table below lists every provider and links to its terms.

• Stays on your device or inside Whisperer
• In transit between them
• Leaves to a third party

Encryption

In transit. Connections between clients, the API and infrastructure run over HTTPS with TLS 1.2 or newer; the production edge currently negotiates TLS 1.3. Strict transport security is sent with a one-year lifetime, so a browser that has seen the site once will not fall back to plain HTTP.

At rest. The database, object storage and cache are managed services, and encryption at rest is a property of those platforms rather than something we implement. We are not going to name a cipher for storage we do not operate — that would be a guess dressed up as a guarantee.

Secrets. Credentials for services you connect — refresh tokens, integration keys, bearer tokens for your own tools — are encrypted before they are written to the database, with a key ring that allows the key to be rotated without downtime or re-encrypting everything at once. A missing or invalid key fails closed: nothing is written rather than written in the clear.

Account security

Passwords. are stored as bcrypt hashes at twelve rounds and never in plain text. Registration requires confirming your email with a six-digit code that expires in minutes, and both sign-in and registration are behind a bot check.

Sessions. An access token is valid for 30 minutes. The refresh token lives for 7 days in a cookie that JavaScript cannot read, is restricted to the authentication path and is protected against cross-site use by a double-submit token. Changing your password or signing out everywhere raises a version counter that invalidates every token already issued.

Desktop and external clients. Linking a desktop client uses a one-time code, so your password never goes into the app. External AI clients authenticate through OAuth 2.1 with mandatory PKCE; implicit and password grants do not exist. Those tokens are stored as hashes and compared in constant time, and a refresh token is accepted only at the token endpoint, never in place of an access token.

Your workspace is yours

Every meeting, transcript, note, file, task, calendar event and memory belongs to the account that created it. Scoping by owner happens in the data layer, so a request naming someone else's identifier is refused — the guarantee does not depend on each endpoint remembering to check.

Two architecture tests hold this in place instead of a convention. One fails if any versioned API route is neither authenticated nor on an explicit public allowlist; the other fails if that allowlist still names routes that no longer exist. Sharing is per object and opt-in: nothing becomes visible to anyone else by default.

Meetings, recordings and screenshots

During a call. Microphone and system audio are streamed for recognition while the conversation runs. The overlay is invisible in screen sharing — but the other side's audible audio is still recognized, which is worth remembering on a group call.

After a call. The transcript, notes, action items and the map of decisions are stored in your workspace, where you can edit, export or delete them. A recording made in a Whisperer video room is written to object storage and comes back as a meeting with its transcript. Screenshots you capture are attached to the session and go to a vision model when you ask a question about what is on screen.

No-logs sessions. A session can run in a mode where the transcript and the answers are never written to the database, and the associated data is removed when the session ends. Minutes still count against your quota: you save storage, not time. Turn it on beforehand — not recording something is easier than erasing it afterwards.

Files and knowledge

Documents you upload are indexed so that answers can draw on them. Retrieval is scoped by owner: the search that assembles context for your question only ever looks at vectors belonging to your account, so a document in one workspace cannot surface in another workspace's answer.

Deleting a document removes it from the search index as well as from storage, so it stops appearing in retrieved context rather than lingering there invisibly. Uploads are capped per file, and if object storage is not configured the section is unavailable rather than half-working.

Memory and personal context

Leo keeps two kinds of context: a profile you write yourself, and durable facts it records from your work so that a recurring thing does not have to be explained twice. Both live in your account, both are visible in the Leo section, and both can be edited or deleted there. Nothing is remembered that you cannot see.

Context you supply is passed to the model as reference material and cannot override system-level instructions. Because it becomes part of a prompt, do not put passwords or tokens into your profile, your notes or your knowledge base.

AI processing

Whisperer does not train or run its own speech and language models. A feature that needs one — an answer during a call, a transcript, a translation, a summary, an embedding for search — sends the content it works on to a third-party provider and uses what comes back.

What is sent depends on the feature. An answer carries the running transcript, the parts of your knowledge base retrieved for that particular question, and your profile context. Transcription carries audio. For a feature you do not use, nothing is sent at all.

How each provider handles what it receives is governed by that provider's own terms and privacy policy, linked above. We do not restate those policies here and we will not promise on a provider's behalf that your content is never used for training — that is their commitment to make, not ours. Which model handles which role is a setting in your account, so you can see and change where your requests go.

Connected tools and MCP

Connecting a service — a calendar, a notes app, a CRM, an issue tracker — gives Whisperer access to what that service exposes, under the permissions you approve on its own consent screen. You can disconnect it in your account at any time, and you can revoke access from the provider's side as well.

MCP runs in both directions. Whisperer offers an MCP server so outside AI tools can read your data, and an MCP client so Leo can use tools you connect. A meeting is visible to an external client only if you marked that meeting shared; the archive as a whole never is, and no-logs sessions are excluded unconditionally. Access you granted Whisperer to your other services is never passed onward through the MCP server.

Actions that cannot be undone. require a human confirmation with a server-rendered preview of exactly what would be affected, and they are not available to external clients at all. Tools that accept a credential are never exposed externally, since that would be a channel for injecting a secret into someone else's integration. An MCP server you supply that runs as a process is launched on your own machine, not on ours. Outbound addresses are checked against private, loopback, link-local and carrier-grade ranges before any request is made.

Infrastructure

The application runs in containers behind a single edge that terminates TLS. Database, cache and object storage are managed services reached over authenticated, encrypted connections — the database with full certificate verification against a pinned root.

Releases go out without taking the service down: a new container joins the load balancer before the old one leaves, and every release tags the image it replaced so a rollback is one command. Schema changes are applied before new code starts, and the application refuses to start against a schema it does not expect rather than running against the wrong one.

Configuration and credentials come from the environment and are never committed to the repository. We are not going to publish hostnames, bucket names, ports or cluster identifiers on this page: being transparent about the security model is useful, handing over a map is not.

Logging and monitoring

Application and error logs, request metrics and service health are collected so the product can be operated, with alerting when something fails. Passwords, tokens and API keys are not written to logs — the session token travels in a header rather than a URL precisely so that it cannot end up in one.

To be accurate about the limits: there is no round-the-clock security operations centre and no third-party managed detection service. The monitoring here is operational. It tells us when something is broken; it is not an intrusion detection programme, and calling it one would be a claim you could not check.

Deleting your data

Three separate things, all available from your account rather than by writing to support: export everything associated with you as a file, erase all content while keeping the account and its subscription, or delete the account entirely.

Deleting the account erases your content and service records and anonymizes the account row itself. The row cannot be removed outright: payment records reference it and accounting law requires those to be kept for five years. That is the only exception, and it is stated in the consent you accept when you sign up. The list of tables a deletion must clear is a single registry in the code, and a test fails if a table referencing accounts is added without being included — forgetting one would mean leaving personal data behind after a deletion request.

Stored objects are removed as part of the request rather than on a schedule. Backups and disaster-recovery copies are a function of the managed platforms we use, so a deleted record may persist in their snapshots for as long as those snapshots are kept; we do not control that window and will not invent a number for it. For a request under GDPR or 152-FZ, write to support — we answer within 30 days.

Security is a process

Whisperer is a growing product. We hold no SOC 2, no ISO 27001 and no other independent certification, we have not commissioned an external penetration test, and we are not going to describe our own review as if it were one. Saying that plainly is part of the model: a claim you cannot verify is worth less than an architecture you can read.

Some controls here are deliberately described as partial. A content security policy is deployed in report-only mode while it is tuned, which means it reports violations rather than blocking them. Two-factor authentication does not exist yet. Where this page says where the platform supports it, it means exactly that and nothing more.

Where we're going

We are evaluating further security and compliance measures as Whisperer grows. Without dates: a date we cannot keep would be one more claim you could not check.

• Enforcing the content security policy instead of only reporting on it
• Two-factor authentication for accounts
• Independent security review and penetration testing
• Formal security policies and a compliance programme

Related documents