What Unifies touches, and what it keeps. Unifies joins conversations and writes into the tools your team already runs. These are the facts a security reviewer asks for first, stated plainly.
What joins your meetings
A Unifies bot joins meetings you connect, as a participant everyone in the call can see in the participant list. It joins nothing your workspace has not connected, and a meeting already in progress is not cut off by a billing change: a pool that runs out mid-meeting finishes capturing. The bot appears as the meeting’s title, the name the organizer typed, followed by “— Unifies”, and on Google Meet, Zoom and Microsoft Teams it posts a chat message on joining saying it is transcribing, so the meeting itself says who is listening. Providing participants any legally required recording notice remains your responsibility.
Where meeting data goes
Meeting capture and transcription run through Recall.ai; the analysis passes that turn a transcript into commitments run through OpenAI. Every processor we use, and what each receives, is listed on the subprocessors page. No audio or video of a meeting is stored: the bot transcribes as the meeting runs and requests no recording from our capture provider. Transcripts and receipts belong to your workspace, and we do not use them to train models of our own.
Who sees what
You always see your own record in full. Workspace owners and admins see standing per person; there is no default leaderboard, and no standing is shown below a minimum evidence sample. A published receipt is deliberate: the receipt’s owner creates the snapshot, the same owner can revoke it, and the record counts each view. Every request for private workspace data is authenticated and workspace-scoped on the server, covered by structural and behavioral tenant-isolation tests; the only unauthenticated routes are public share links, which hold no workspace data.
Access to your workspace
Sign-in is passwordless: Google, or a one-time code by email. Sign-in codes are stored keyed-hashed with strict attempt limits; sessions are short-lived, rotate, and can be revoked server-side. Connecting a project tracker uses that tool’s own OAuth and requires someone with admin rights there to authorize it. Stored OAuth tokens are encrypted at the application layer, and disconnecting an account deletes our stored tokens and requests revocation where the provider supports it.
How the service is built to protect data
- TLS for all traffic, with HSTS; security headers and a content-security policy on both the app and the API.
- Databases run on a private network with no public address, with daily automated backups and point-in-time recovery.
- Inbound webhooks are signature-verified; outbound webhooks are signed and restricted to public HTTPS endpoints.
- Content extracted from meetings is fenced and bounded before AI calls, and everything written into your tracker is allow-listed and length-capped.
- Administrative and security-relevant actions are recorded in a tamper-evident, hash-chained audit log verified daily.
- Deleting an account erases its transcripts and identifiers through a multi-phase, tested deletion process; closed workspaces are purged after a 30-day window; transcripts expire on your workspace’s retention window.
- Secrets live in a managed secret store; sensitive fields are scrubbed from telemetry before it leaves our systems.
What we do not claim
We hold no compliance certifications today. There is no SOC 2 report of our own, no ISO certification, and no penetration-test letter to send you. We do not yet have: formal 24×7 monitoring and alerting; enforced multi-factor authentication; cross-region backup replication; verified restore drills; an EU data region (all processing is in the United States); or an uptime SLA. When any of that changes, it will be stated here with its date and scope, and not before. For the infrastructure layer, our cloud provider's own compliance reports (Google Cloud SOC 2/ISO) are available. Those are Google's certifications, not ours.
Reporting vulnerabilities
Report security issues to security@unifies.ai (see unifies.ai/.well-known/security.txt). Safe harbor: we will not pursue legal action over good-faith security research that respects user privacy and data, avoids service disruption and data destruction, does not access more than needed to demonstrate an issue, and gives us a reasonable time to fix before disclosure. This is the authorization referenced in our Terms of Service, Section 5(d).