We run the database, the video servers and the speech-to-text ourselves, and name every provider we use for the rest. What the product can't do honestly, it doesn't claim.
The database, sign-in, real-time messaging, video server and caption speech-to-text run on servers we operate. Files and recordings sit in private Cloudflare R2 storage, and every provider we use is named in the privacy policy.
Healthcare-mode meetings are end-to-end encrypted and keep nothing — no recording, transcript or summary. The key is generated in your browser and never reaches our servers.
Chat and standard meetings are encrypted in transit with TLS and DTLS-SRTP. The video server decrypts to route and record, which is why only Healthcare mode is end-to-end.
An append-only audit log, retention policies and role-based, org-scoped access — enforced in the application on every request, not only at the edge.
What we don't claim. SOC 2 is not certified and we do not claim it, and there is no audit report to send you. Chat is encrypted in transit, not end-to-end — only Healthcare-mode meetings are E2EE. HIPAA compliance depends on your own policies and a signed Business Associate Agreement, and we do not offer a BAA yet. There is no uptime SLA. The Trust Centre says all of this too, and is where a security questionnaire starts.
“Encrypted” is the easy half. These are the decisions that determine who can actually read what, and each one is a mechanism rather than a policy — the difference being that a mechanism cannot be forgotten on one route out of eleven.
Every table carries an organisation id, and every route re-checks membership in code rather than trusting a connection-level filter. That check IS the access boundary, so there is no configuration in which it is accidentally off.
A transcript, recording, file or whiteboard is authorised against the meeting it came from, not against the workspace. A colleague who was never admitted cannot read it, and neither can somebody who was removed. This closed a real hole found in our own review.
It records that an AI run happened, which model answered and how many tokens it cost — never the prompt and never the output. A remote-assist session records that it started and ended, never a keystroke, because a keystroke log would be a keylogger writing patient data into an append-only table.
A push notification passes through Apple, Google or Mozilla, and we have no agreement with any of them. So the payload carries a category and an id and cannot carry a message body — not by policy, but because the function that builds it has no parameter that could hold one.
On a clinical board a patient's name, contact and date of birth are their own fields, so a deletion request can name them. Free text cannot be redacted reliably, and the card's own title is a token the server refuses to let anybody rename to a person.
Content tables carry a deletion timestamp and a retention clock. What outlives them is deliberately kept free of the things you would be asked to delete — the history of a patient card records that details changed, never what they were.
Healthcare mode is the strictest setting and the one with the fewest features on purpose: it is end-to-end encrypted, it persists nothing, and it refuses recording, broadcasting and captions outright rather than degrading them quietly. A room labelled end-to-end encrypted whose encryption nobody performed would be worse than a refusal. The healthcare page describes what that mode is for, and the privacy policy sets out what is stored and for how long.