Compliance status
Recordable is a European company and operates under the GDPR by default. We have not yet completed a SOC 2 audit, and we do not claim to be SOC 2 certified.
Built EU-first. Data Processing Addendum and EU Standard Contractual Clauses available to every customer.
SOC 2 Type II is on our roadmap. We are not sharing a target date until an audit is scheduled. Enterprise customers can request our current security questionnaire in the meantime.
On the roadmap after SOC 2. Talk to us if it is a procurement requirement so we can plan accordingly.
Recordable is not currently designed for PHI workflows. Do not use the Service to capture protected health information.
Encryption
In transit
All traffic between your browser, the desktop app, the browser extension, and our infrastructure is encrypted with TLS 1.2 or higher. HSTS is enforced on every domain we control and certificates are managed by Cloudflare.
At rest
Recordings, redacted screenshots, and exports live in Cloudflare R2 with AES-256 server-side encryption. Workspace metadata and account data live in Neon’s managed PostgreSQL with disk-level encryption. Encryption keys are managed by the storage provider and rotated according to its published schedule.
Infrastructure and hosting
EU-first hosting
Primary database lives in Neon’s Frankfurt region. Object storage defaults to the EU. Cloudflare’s global edge serves static and cached content from the closest PoP. EEA-only data residency commitments are available on Enterprise contracts.
Tenant isolation
Every API request resolves to exactly one workspace, and that scope is enforced on every query in the application layer. Tables that cannot carry a workspace identifier of their own are covered by Postgres row-level security policies as well, so a missed filter fails closed instead of returning another workspace’s rows.
Backups and recovery
Database backups run continuously with point-in-time recovery for the last 7 days. Object storage is replicated across at least two availability zones within its region.
Change management
Every production change ships from a peer-reviewed pull request, runs through automated tests, and is deployed by CI. Production access is limited to a small on-call rotation with mandatory MFA.
Access controls
- 01Production access for Recordable personnel requires SSO + hardware-key MFA, and is granted on a need-to-know basis with quarterly access reviews.
- 02Enterprise workspaces can sign in with SSO (SAML or OIDC), require SSO for every member, synchronize accounts with SCIM, and enforce session length.
- 03Enterprise audit logs record sharing, exports, member, billing, and admin actions. Logs cover the last 90 days and can be exported.
- 04We never access customer workflow content unless the workspace owner has explicitly enabled support access in workspace settings. When enabled, access is read-only, time-limited, used only to resolve a support request, and recorded in the workspace’s own audit log. Owners can revoke it at any time.
AI processing
Workflow analysis and translation use Google Cloud Gemini (default) and, at our discretion, Anthropic Claude or OpenAI. All providers are bound by terms that disable use of your content for foundation-model training. Agent runs run on your desktop and stream screenshots only to the provider you selected. Detailed routing is documented in the Privacy Policy and the Subprocessors page.
The in-app redaction step is the only point at which sensitive content can be removed before it leaves your device. We do not retain Customer prompts or model output beyond what is required to power the in-product step you triggered.
Data export and deletion
- 01Self-service export of every workflow you own is available from the Settings page (JSON + media assets).
- 02Account deletion is self-service from the Settings page. All Customer Personal Data is purged from primary storage within 30 days, and from encrypted backup media within 90 days.
- 03Workspace owners can delete an individual workflow at any time. Public-share links are revoked immediately.
Responsible disclosure
If you believe you have found a security vulnerability in Recordable, please report it before disclosing publicly. We commit to acknowledging your report within two business days, keeping you informed of remediation progress, and crediting you (if you wish) in our advisories.
Send vulnerability reports to security@recordable.ai. For sensitive issues, request our PGP key in the first message. A machine-readable security.txt is published at /.well-known/security.txt.
- recordable.ai and all subdomains (including app.recordable.ai)
- The Recordable desktop application
- The Recordable browser extension
- Findings that depend on physical access or social engineering of our staff
- Denial-of-service testing against production
- Reports from automated scanners with no demonstrated impact
- Vulnerabilities in third-party services we use (please report those to the provider)
- Test only against accounts you own. Do not access Customer data that is not yours.
- Do not exfiltrate data, modify other users' accounts, or degrade the Service for others.
- Give us a reasonable window (typically 90 days) to remediate before public disclosure.