Resources / Data storage
Where your data lives, who touches it, and how long it stays.
Last verified against our product: October 4, 2026
| What | Where | Provider |
|---|---|---|
| Primary database: all employee profile, org, transcript, comment and engagement data, and text embeddings used for matching | Frankfurt, Germany (EU) | Neon (Postgres) |
| Application servers (API and web app) | Ohio, USA | Render |
| Cache, rate limiting, background job queue (transient identifiers and cached feed and status data) | N. Virginia, USA | Redis Cloud |
| Video upload, storage, transcoding, captions and playback | USA, with global CDN delivery | Mux |
| Sign-in and identity | USA | Clerk |
Employee personal data at rest therefore sits in the EU, while processing happens in the US. Transfers of EU personal data to the US are covered by the EU Standard Contractual Clauses in our Data Processing Addendum, available on request from our security page. Hosting region is not currently selectable per customer.
Every organization shares one database but is separated inside it by Postgres Row Level Security. Each tenant-scoped table has row-level security forced on, with a policy that admits only rows matching the caller's own organization. Postgres enforces it on every query, so isolation does not depend on application code remembering a filter. API routes that take an organization id also check that it is the caller's own organization.
Text embeddings used for feed and profile matching live in the same database, not in a separate vector store.
Encryption at rest is provided by our providers' platform defaults. We have not separately audited it, and we point you to their published materials if your review needs a primary source.
Transcripts and bio text are sent to Anthropic (summaries, topics, language detection and writing assistance) and to Voyage AI (text embeddings for matching). Video, audio and automatic captions are handled by Mux. See the subprocessor table below for what each receives. These are the only places customer content leaves our core hosting for AI features.
| Data | Retention |
|---|---|
| Account, profile, videos, transcripts and derived data | Kept while the account is active, until a user or admin deletes it or the customer terminates. |
| A member deletes their own account | Hidden immediately; permanently erased within 30 days. Once no organization profile remains, the sign-in login at Clerk is deleted in the same daily job (retried if Clerk is unavailable). |
| Account deactivated through SCIM | Same as above: hidden immediately, erased within 30 days. |
| An admin removes a member | Account and videos deleted immediately. The person's sign-in login at Clerk is not deleted, since it may belong to other organizations. |
| A video is deleted | Hidden immediately; permanently deleted, including the stored video file, 30 days later. |
| Comments | Hidden immediately when deleted. No separate permanent-erasure schedule is published for individual comments. |
| Anonymous try-it videos never claimed | Deleted within 48 hours. |
| Customer organization on termination | All organization data deleted within 30 days of termination or written request; written confirmation on request. This is an operator-run procedure today, not self-service. |
| Privileged-action audit log | Kept for the life of the organization, append-only. |
| Database backups | Point-in-time recovery over a rolling window of at least 7 days, then they expire. |
| Billing records (Stripe) | As required by tax and accounting law. |
Retention periods are not configurable per customer today. Customers delete data themselves in the product, or by request. A legal hold, if one applies, is isolated and deleted when the obligation ends.
Last updated October 21, 2026. We give at least 30 days' notice of a new or replacement subprocessor.
| Subprocessor | Purpose | Data handled | Location |
|---|---|---|---|
| Neon | Primary database hosting (Postgres) | All customer data: profiles, org data, transcripts, comments, engagement, audit log | Frankfurt, Germany (EU) |
| Render | Application hosting (backend API and web app) | All customer data in transit | Ohio, USA |
| Redis Cloud | Cache, rate limiting, background job queue | Transient identifiers and cached feed and status data | N. Virginia, USA |
| Mux | Video upload, storage, transcoding, captions and playback | Video, audio and transcripts | USA; global CDN delivery |
| Clerk | Authentication and identity | Name, email, sign-in and session data | USA |
| Anthropic | Video summaries and topics, language detection, profile-writing assistance, assistant features | Transcript and bio text | USA |
| Voyage AI | Text embeddings for recommendations and matching | Transcript and bio text | USA |
| Stripe | Billing and payment processing (card-paid plans) | Billing contact and payment details (card data goes to Stripe directly) | USA |
| Apple | Push notifications (APNs) for iOS | Device tokens, notification text | USA |
| Resend | Transactional email (invitations and notices) | Recipient name and email address | USA |
| Cloudflare | Bot protection (Turnstile) on the anonymous demo page only | Visitor IP address | Global |
| PostHog | Product analytics: explicit events only (no session replay, no autocapture), including the marketing-site homepage experiment | Pseudonymous identifier and event properties; visitor IP address | USA |
The maintained list is on the Subprocessors page. Slack, Google, Microsoft and HR-system integrations your organization connects are covered on their own pages under Integrations.
Questions or a correction? [email protected]. See also: Security, Subprocessors, Privacy, Terms.