Security and sensitive data

Who sees the case

Each case is isolated from the others in the database itself: PostgreSQL enforces Row Level Security on every case table, and the application connects with a role that cannot bypass that rule. Only the people invited to the case, in the Case team, open the material.

• Two-step verification, with an authenticator app and a six-digit code, for any account.
• Seven-day sessions; changing the password ends the other sessions.
• No third-party script inside the case area: no Google and no pixel.

Where the material lives and who processes it

The server and the database are in the United States (DigitalOcean), and the AI runs in the United States and Europe. The material of the cases never trains an AI model, by contract with the providers. Transfers follow article 33 of the LGPD, the Brazilian data protection law, with contractual clauses with each provider, and the Privacy Policy says where each step happens.

• Anthropic: the text of messages and passages, images, video frames and chat questions.
• OpenAI: audio, for transcription (Whisper), and the text of passages and questions, for meaning-based search.
• Mistral: reading PDFs, which are deleted there afterwards.
• Microsoft: only when you connect a OneDrive folder, always with read-only permission.
• Processing in Brazil is not available today.

How the material is protected

In transit, everything is encrypted: HTTPS with a one-year HSTS, and the connection from the application to the database is encrypted and authenticated. At rest, the database and the storage use the encryption of the provider, and OneDrive access tokens are encrypted (AES-256-GCM) before they reach the database.

• A SHA-256 hash of every file on arrival, the same one the evidence report shows.
• Daily backups, encrypted before they leave the server, in two clouds, with hash checks: 30 daily and 12 monthly.
• Documents open in the browser without running scripts: only PDF, photos, audio, video and plain text open on screen; everything else downloads as a file.

The record of what happens in the case

Uploads, analyses, searches, chat questions, exports, deletions and legal holds are recorded per case, with the date, IP and browser of whoever acted. The record lives on the server; there is no screen to view it yet.

Deleting and taking your data

Deleting a source, a case or the account deletes the database rows, the files in storage and the file as it arrived. An active legal hold blocks the deletion, and every deletion is recorded.

• The account has 30 days to change your mind after the request: signing in again restores everything as it was.
• Backup copies expire on their own under the retention policy: 30 daily and 12 monthly.
• "Download my data", on the account page, delivers a ZIP with the profile, the consents, the account events and the person's actions in the cases (LGPD, article 18). The content of each case has its own export.

Security as a process

TranscriptMe runs an information security management system along the lines of ISO 27001, with a policy, a risk register and an incident procedure. There is no certification yet: it is in progress.

For your firm's review

Before putting a client's material into any tool, it is worth having in writing where the data lives, who processes it, whether the material trains a model, who can see the case, how it is deleted and whether there is a record of what was done. This page answers each of those questions for TranscriptMe.