• Encryption in transit: all traffic is TLS 1.2+ enforced. HSTS preload eligible.
• Encryption at rest: recordings and uploads are stored on encrypted volumes (AES-256). OAuth refresh tokens are sealed with AES-256-GCM at rest, never written in plaintext.
• Access controls: role-based access (RBAC) for admin, agent, and user roles. Two-factor authentication (2FA) available for every account.
• Audit logging: security-sensitive actions (auth, role changes, OAuth grants/revokes, key admin actions) are logged with paginated history visible to the user.
• Rate limiting: auth endpoints, OAuth callbacks, and abuse channels are rate-limited to mitigate brute-force and abuse.
• Content Security Policy: strict CSP across all surfaces; CSRF tokens on state-changing requests.
• Backups: nightly full and continuous database backups (write-ahead log archived every minute), kept 30 days and encrypted at rest, plus off-site copies.
• Vendor list: our own dedicated application server, Neon PostgreSQL and Upstash Redis in Germany (Frankfurt, EU), Cloudflare (CDN, R2 storage, Stream video — US / global), Groq / Anthropic / Google Gemini (AI; OpenAI only as an optional fallback), a PCI DSS–certified payment processor (card details are entered on its secure page and never stored by us), EZcount (invoices), Resend (email) and Sentry (error monitoring, EU — Germany). The full list is on our Subprocessors page.

• Pre-record consent prompt: before any recording starts, you confirm you have informed and obtained consent from every participant. Required for two-party-consent jurisdictions (CA, FL, IL, PA, MA, MD, MT, NH, WA, EU).
• Private by default: your recordings are visible only to you until you explicitly publish or share them.
• Silence & level monitoring: live VU meter + automatic alerts if the recording is silent or the mic drops mid-session — so you don't lose hours of work.
• Server-side sanity check: after every finalize, we verify the file has audio, video, and a valid duration before reporting success.
• Recovery: chunks are mirrored to secondary storage. If finalize fails, we can recover the recording from chunks for up to 7 days.
• Deletion: deleting a recording removes it from our active systems; backups are purged within 30 days.

StreamLive Pro uses AI for transcription, translation, captioning, smart-clip selection, and summarization. We are transparent about where AI is used:

• What models: Whisper (run on Groq), Claude (Anthropic) and Gemini (Google); OpenAI only as an optional fallback. Specific model used is disclosed in the relevant feature.
• What data is sent: only the content you process (audio for transcription, text for translation). We do not send your account metadata, payment info, or other recordings.
• Training opt-out: our API contracts with OpenAI and Anthropic exclude your content from being used to train their models.
• Output disclosure: AI-generated captions, translations, and summaries are labeled as such in the editor and on exports (when feasible).
• Errors are possible: AI output can contain mistakes or hallucinations. Always review before publishing — especially for legal, medical, or otherwise sensitive content.
• You own the output: per our Terms, you retain ownership of content you process. Generated text/translations belong to you.