Security

1. Data in Transit

All traffic between your browser and our servers is encrypted with TLS 1.2 or higher. Audio uploads and transcript fetches use the same encryption. HSTS is enforced with max-age=31536000; includeSubDomains; preload.

2. Data at Rest

Production data is stored on Neon PostgreSQL (US East) with encryption at rest. API keys for the public REST API are stored as SHA-256 hashes; the raw key is shown to the user exactly once at creation time. We do not log or store raw API keys server-side after the user has seen them.

3. Authentication

User authentication is delegated to Clerk. We do not store user passwords. Session management and CSRF protection are handled at the framework level. The public REST API supports scoped API keys with separate read / read_write scopes. Rate limits are enforced per key per scope. Team access uses Admin / Member roles.

4. Content Security Policy

Authenticated app and API responses carry a Content Security Policy that locks script-src, connect-src, and frame-ancestorsto a known allowlist. frame-ancestors 'none' blocks clickjacking. X-Content-Type-Options: nosniff and X-Frame-Options: DENYare set on every response.

6. AI Provider Data Handling

Audio is transcribed with Groq (whisper-large-v3) by default, with OpenAI (Whisper) as fallback. Summaries and competitive intelligence are generated using OpenAI (with Groq fallback). Both providers process the data under their standard data-processing terms; OpenAI does not train on API data, and we never train on your call data ourselves.

7. Sub-processors

We only use sub-processors to run the product you asked for. The full inventory of sub-processors currently in use is below, and we notify you 30 days before any new sub-processor touches your personal data — via in-app banner and email — with the right to object.

Compliance attestations per vendor are tracked in our vendor register and DPA and available on request.

8. Enterprise security checklist

This is the security checklist enterprise buyers run when evaluating a conversation-intelligence tool. Every item below has an honest status — we don't present aspiration as fact.

• Encryption at rest and in transitLive

  TLS 1.2+ with HSTS preload in transit; data at rest encrypted on Neon PostgreSQL (US East).

• SOC 2 Type IIRoadmap

  Our readiness program is in progress. We will not claim certification until it is real.

• GDPR compliance + DPA (Art. 28)Live

  EU data-export right, data-processor terms under Art. 28. DPA available on request via security@usegauge.com.

• HIPAA BAAN/A

  We are not a healthcare service and do not support PHI workflows.

• Data never used for AI trainingLive

  Included in our DPA (available on request). See the no-training clause above.

• Role-based access controlLive

  Admin / Member roles with granular team permissions.

• Configurable data retentionRoadmap

  Account deletion is available today (two-step confirm, immediate anonymization and hard purge — irreversible); retention controls are planned.

• SSO via SAML 2.0Roadmap

  Planned for our enterprise tier (Clerk Enterprise).

• Sub-processor transparencyLive

  Full inventory below, plus 30-day notice before any new sub-processor touches your data.

• Data residency controlPartial

  US East today; regional residency is planned.

• Data portability + deletion confirmationLive

  Full GDPR export of every call, transcript, action item, decision, next step, and comment; deletion requires explicit double confirmation.

• Meeting-type exclusionN/A

  We never auto-join meetings and never record on your behalf. Capture comes from recordings you upload, or from live captions our Chrome extension reads only while you actively run it — there is no bot to exclude from HR or legal calls.

• Consent for all participantsN/A

  When you upload a recording, consent obligations stay with you as the account holder — Gauge never initiates capture. With the Chrome extension, the meeting's own consent applies to the captions it reads.

• Never "use your data to improve our models"Live

  We do not train or fine-tune any model on your call data — that is our policy and our contract.

9. GDPR & Data Export

Users in the EU can request a full export of their account data, including every call, transcript, action item, decision, next step, and comment. Exports are protected by a token that expires 7 days after it is issued, and the download link is sent only to the requesting account. Account deletion is a two-step confirm, followed by immediate anonymization and hard purge of your data (calls, blobs, integrations, API keys). This is irreversible.

10. Reporting a Vulnerability

If you have found a security issue, please email security@usegauge.com. We aim to acknowledge reports within 48 hours and run a coordinated disclosure process.