How EchoBrief protects your calls.
Sales calls carry prices, names and plans. This page sets out where yours go, who can see them, how long we keep them and how you delete them, including what we have not built yet. Questions or a security review: admin@oltaflock.ai.
The short version
- Your meetings are private by default. Nobody else, including people in your workspace, sees a meeting until you share it.
- Each account is walled off in the database. Every table checks who is asking, and a test suite tries to read, change and delete one account's data from another's before changes ship.
- Internal talk stays internal. What's said before your guest joins and after they leave is kept out of notes, emails, CRM notes and share links.
- We don't train AI models on your calls. Anthropic and OpenAI process transcripts under their business API terms, which exclude using that data to train their models.
- You can delete everything yourself, one meeting or the whole account, from Settings.
Where your data goes
The database is in Mumbai and Indian-language transcription runs on Sarvam in India. Recording runs in Japan (our recording vendor's Tokyo region); AI summaries, email and hosting run on the US vendors below. Your data does leave India; if that rules us out, tell us before you sign up.
| Vendor | What it does | What it sees | Where |
|---|---|---|---|
| Supabase | Database, authentication and file storage | Account details, transcripts, summaries, a short-lived working copy of meeting audio | India (Mumbai) |
| Recall.ai | The meeting bot that joins and records your call | Meeting audio and video, participant names | Japan (Tokyo) |
| Sarvam AI | Speech-to-text across 22 Indian languages | Meeting audio | India |
| Anthropic | Summaries, deal cards, action items and coaching | Transcript text | United States |
| OpenAI | Fallback for summaries and coaching; fallback transcription | Transcript text; meeting audio when the fallback transcribes | United States |
| Cloudflare | Storage of the archived audio copy used for playback (R2) | Meeting audio | Chosen by Cloudflare (not pinned to a country) |
| Resend | Summary and account email | Email address, meeting summary content | United States |
| Vercel | Web app hosting and audio processing | Meeting audio in transit, request logs | United States |
| Dodo Payments | Subscription billing (merchant of record) | Name, email, billing details | United States |
| Google Analytics | Website traffic measurement | Page path (identifiers removed), device, approximate location | United States |
| Microsoft Clarity | How visitors use our public web pages (session replay, public pages only) | Clicks and scrolling on public pages, device, approximate location — never the app or your meetings | United States |
| Sentry | Error monitoring | Technical error reports, user ID | United States |
| Google · only if you connect it | Calendar sync and sign-in | Calendar event titles, times and attendee emails | United States |
| Microsoft · only if you connect it | Outlook calendar sync | Calendar event titles, times and attendee emails | United States |
| Zoho · only if you connect it | A note on the matching CRM contact or lead | Attendee email, meeting summary, decisions and action items | Your Zoho data centre (India by default) |
| Slack, ClickUp and Notion · only if you connect it | Posting the summary to the channel or database you pick | Meeting summary, decisions, action items and next steps | United States |
Who can see a meeting
| Who | What they can see |
|---|---|
| You, the owner | Everything: recording, transcript, notes, deal card, coaching. |
| Your workspace colleagues | Nothing, unless you share the meeting with the workspace or turn on automatic sharing. Even then, only the part of the transcript after the guest joined. |
| Someone with a share link | The summary and notes, plus the transcript and recording if that link includes them (the share dialog shows exactly what it carries). The transcript leaves out the internal talk before the guest joined and after they left, and the player stays inside that window (the underlying recording file is the whole call). Links can be revoked at any time. |
| EchoBrief staff | No routine access. Production is reached only by the founders, for support you ask for or to fix a failed meeting. |
How it's built
- Account isolation: row-level security on every table, checked by an automated suite that also proves it can detect a leak.
- Encryption: all traffic over HTTPS; data encrypted at rest by our database host; calendar and CRM access tokens additionally sealed with AES-256-GCM before they are stored.
- Sign-in: email with confirmation, or Google. Two-factor authentication (authenticator app) is available in Settings → Security.
- Webhooks and payments: every incoming callback is signature-checked; card details never touch our servers (Dodo Payments is the merchant of record).
- Backups: nightly encrypted backups, with regular restore tests.
- Abuse limits: rate limits on sign-in and on every AI feature.
How long we keep it
| Plan | Transcripts, notes and audio kept for |
|---|---|
| Free trial | 30 days |
| Starter | 30 days |
| Pro | 90 days |
| Sales Team | 365 days |
| No active plan | 14 days |
After that it is deleted automatically. Video playback is held by our recording vendor for up to 30 days. Deleting a meeting or your account removes its data, its archived audio and the recording vendor's copy straight away. The full detail is in the privacy policy.
What we don't have yet
We'd rather tell you than have you find out in a questionnaire.
- SOC 2 or ISO 27001. Not yet. We will start a SOC 2 audit when a customer contract needs it, and we're happy to fill in your security questionnaire meanwhile.
- All-India processing. Recording runs in Japan and AI summaries in the US (see the table above).
- Field-level encryption of transcripts. They are protected by account isolation and at-rest encryption, not encrypted per field.
- A signed DPA by default. If your organisation needs one, email us and we'll send it.
Your rights, and reporting a problem
You can export or delete your data at any time, and exercise your rights under India's Digital Personal Data Protection Act and, for EU and UK users, the GDPR. To report a security issue, email admin@oltaflock.ai with "Security" in the subject. We aim to reply within one working day.
Try it on your own calls.
EchoBrief is in invite-only beta. Request access and we'll set up your account; then connect your calendar and the notetaker joins your next call.