Security at MrMeetNote

Built like a security product — because your meetings are the most sensitive data you have.

Private AI processing

Every transcription and every note is generated on private, dedicated infrastructure that we operate and control. Your meeting content is never sent to OpenAI, Google, or any other third-party AI service — by architecture, not by policy. Nothing you record is ever used to train models.

Encryption

• At rest: every meeting is encrypted with AES-256 using its own unique data key. Each data key is wrapped by a master key held separately from the data.
• In transit: all traffic is encrypted with TLS. HTTPS is enforced in production with HSTS.
• Provable deletion: deleting a meeting or account destroys its wrapped keys — crypto-shredding. Without the key, the ciphertext is permanently unrecoverable.

Ephemeral audio

Raw meeting audio exists only for the duration of processing, decrypted in memory. It is permanently deleted the moment your notes are ready — and also when processing fails. We do not keep a copy, ever.

Automatic retention limits

Transcripts and notes are automatically destroyed at the end of your plan's history window (Free: 14 days, Pro: 6 months, Team: 12 months) using the same crypto-shredding mechanism. Data you no longer see is not sitting in a backup — it is unrecoverable.

Account security

• Passwords hashed with Argon2id — the current best-practice, memory-hard algorithm.
• Login, signup, and password-reset endpoints are rate-limited against brute force.
• Email verification on signup; time-limited, single-use reset tokens.
• Every active session is listed in your account with device info — revoke any of them, or all others, in one click.
• Session cookies are HttpOnly, Secure, and SameSite.

Application hardening

• Strict CORS — an explicit origin allow-list, never a wildcard.
• Security headers on every response: CSP, X-Frame-Options DENY, nosniff, strict referrer policy.
• Per-user data isolation enforced on every API route — a user can only ever read their own meetings.
• Uploads are size-capped and streamed to isolated temporary storage that is destroyed after processing.

What we never do

• Never send your content to third-party AI APIs.
• Never train on your data.
• Never sell data or run advertising trackers.
• Never store your card details — payments are handled entirely by our payment processor.

Responsible disclosure

Found a vulnerability? Please report it to security@mrmeetnote.com. We commit to acknowledging reports within 72 hours and will credit researchers who report in good faith.