Security Overview

All Note AI is built on enterprise-grade cloud infrastructure designed for reliability, scalability, and security:

• Cloud Provider: Hosted on industry-leading cloud infrastructure with SOC 2 Type II and ISO 27001 certifications
• Data Centers: Physically secured data centers with 24/7 monitoring, access controls, and redundant power and connectivity
• Network Isolation: Virtual private clouds (VPCs), firewalls, and network segmentation to isolate production environments
• DDoS Protection: Built-in distributed denial-of-service protection at the network and application layers
• High Availability: Multi-region redundancy with automatic failover to ensure 99.9% uptime

Your data is protected with strong encryption both in transit and at rest:

• In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS)
• At Rest: All stored data — including meeting recordings, transcriptions, and personal information — is encrypted using AES-256
• Database Encryption: Database-level encryption with key management services (KMS) for all sensitive data stores
• Backups: All backups are encrypted using the same AES-256 standard and stored in geographically separate locations
• API Keys: API keys and secrets are stored as hashed values and never logged or exposed in plaintext

We enforce strict access control policies to limit who can access your data:

• Principle of Least Privilege: Employees are granted only the minimum access necessary to perform their role
• Multi-Factor Authentication (MFA): Required for all internal systems, admin consoles, and cloud provider access
• Role-Based Access Control (RBAC): Granular permissions ensure teams only access the systems relevant to their work
• Access Reviews: Quarterly access reviews to revoke unnecessary permissions and remove inactive accounts
• Audit Logs: All access to customer data is logged, monitored, and retained for security review
• Zero-Trust Architecture: Internal services authenticate each other; no implicit trust based on network location

Security is integrated into every stage of our development process:

• Secure Development Lifecycle (SDLC): Security requirements and reviews are part of every feature development cycle
• Code Reviews: All code changes undergo peer review with security considerations as part of the checklist
• Dependency Scanning: Automated scanning of third-party dependencies for known vulnerabilities (CVEs)
• Static Analysis: Automated static code analysis tools run on every pull request to detect security issues early
• OWASP Top 10: Development teams are trained on OWASP Top 10 vulnerabilities and mitigation techniques
• Security Headers: HTTP security headers including CSP, HSTS, X-Frame-Options, and others are enforced

We regularly validate our security posture through independent testing and audits:

• Annual Penetration Tests: Third-party security firms conduct comprehensive penetration tests of our application and infrastructure at least annually
• Vulnerability Scanning: Automated vulnerability scanning runs continuously across all production systems
• Security Audits: Internal and external audits of our security controls, policies, and procedures
• Bug Bounty Program: We welcome responsible disclosure of security vulnerabilities from the security research community

To report a security vulnerability, please email security@allnote.ai. We commit to acknowledging reports within 48 hours.

We have a documented incident response plan to handle security events quickly and transparently:

• 24/7 Monitoring: Continuous monitoring of systems, logs, and alerts for anomalous activity
• Incident Classification: Security events are classified by severity with defined escalation paths
• Rapid Response: On-call security team with defined SLAs for response and containment
• Customer Notification: In the event of a data breach affecting your data, we will notify you within 72 hours as required by GDPR and other applicable regulations
• Post-Incident Review: All significant incidents undergo root cause analysis and remediation follow-up

All Note AI is committed to meeting industry standards and regulatory requirements:

• GDPR: Compliant with the EU General Data Protection Regulation for users in the European Economic Area
• CCPA: Compliant with the California Consumer Privacy Act for users in California
• Data Processing Agreements: We provide DPAs for enterprise customers as required by GDPR
• Sub-Processors: We maintain a list of sub-processors and notify customers of any changes
• Privacy by Design: Data minimization and privacy principles are embedded in our product architecture

Our team undergoes rigorous security training and vetting:

• Background Checks: All employees undergo background verification before joining
• Security Awareness Training: Mandatory security training for all employees upon onboarding and annually thereafter
• Phishing Simulations: Regular phishing simulation exercises to keep the team vigilant
• Confidentiality Agreements: All employees sign NDAs and data handling agreements
• Device Management: Company devices are managed with MDM, full-disk encryption, and remote wipe capabilities
• Password Policies: Enforced use of password managers and strong, unique passwords for all accounts

Meeting recordings and transcriptions are among the most sensitive data we handle. Here is how we protect them:

• Isolated Processing: Meeting audio is processed in isolated, ephemeral environments with no cross-customer data access
• No Model Training: Your meeting data is never used to train AI models — neither ours nor any third party's
• Minimal Retention: Audio files are deleted after transcription is complete unless you explicitly choose to retain them
• Customer-Controlled Deletion: You can delete any recording, transcription, or summary at any time from your dashboard
• Access Logs: All access to meeting data is logged and auditable