Security is built into everything we do

Account security

Every password is hashed with bcrypt before storage — your plaintext password is never saved anywhere on our systems. New accounts require email verification before access is granted, so no one can sign in on your behalf with a freshly created email. We also support Google OAuth 2.0 so you can avoid passwords entirely.

• Passwords hashed with industry-standard bcrypt — never stored in plaintext
• Email verification required before first login
• Google OAuth 2.0 as a password-free alternative
• Accounts flagged as blocked or deleted are immediately refused authentication
• Login and password-reset endpoints are rate-limited per IP to prevent brute-force attacks

Data in transit

All communication between your browser and our servers happens over HTTPS/TLS. We enforce HTTP security headers via Helmet — including X-Frame-Options, X-Content-Type-Options, and a Content Security Policy. Our CORS policy is an explicit allowlist; wildcard origins are not permitted. WebSocket connections used for live transcription are encrypted the same way.

Data at rest

Meeting transcripts are stored in AWS S3 with server-side encryption. User account data lives in MongoDB. Passwords are never stored in plaintext. Session tokens written to Redis carry a time-to-live so stale credentials expire automatically.

• Transcripts stored in AWS S3 — encrypted at rest
• User passwords never stored in plaintext
• Redis session tokens are short-lived with automatic TTL expiry
• Password reset and email verification tokens expire after 2 hours

API and infrastructure protection

Every API endpoint validates its inputs through strict schemas before any business logic runs. A global rate limit per IP protects against abuse and automated scanning. Third-party webhook callbacks from Recall.ai are verified with HMAC signatures so spoofed events are rejected at the door.