Trust Center

Trust & Security at TimeCompass.ai

Full transparency into how we handle, process, and protect your information. TimeCompass is operated by Great View Labs.

99.9%

Uptime Target

TLS 1.3

Encryption

GDPR-Ready

Compliance

None — your data isn't used for training.

AI Training

How transcripts are processed

TimeCompass doesn't persist your transcripts. When you forward, paste, or sync a meeting, the raw text is held in memory only long enough to extract tasks and generate a short metadata-only summary. After that the raw text is dropped from our process and never reaches our database.

The summary format is locked at the database boundary

Every meeting summary we ever store matches one of 7 shapes — the duration in minutes, the speaker count, and (when the AI is confident) a single label drawn from a fixed vocabulary of 6. The list below is rendered straight from the source code that runs in production. There is no path by which a name, quote, project, or any other transcript-derived content can reach the column.

"23-minute meeting with 3 speakers. Decisions made."concrete decision was finalized
"47-minute meeting with 4 speakers. Follow-ups assigned."tasks with owners assigned for later
"30-minute meeting with 5 speakers. Decision deferred."topic discussed but decision postponed
"15-minute meeting with 6 speakers. Status update."one-way briefing or status share
"60-minute meeting with 2 speakers. Working session."hands-on collaborative work
"12-minute meeting with 4 speakers. No action items."discussion with no decisions or assignments
"8-minute meeting with 2 speakers."fallback — AI couldn't confidently pick a label
The full 6-label vocabulary
  • Decisions made
  • Follow-ups assigned
  • Decision deferred
  • Status update
  • Working session
  • No action items
The regex that enforces the format at write time
^(\d+-minute meeting with \d+ speakers?\. (?:Decisions made|Follow-ups assigned|Decision deferred|Status update|Working session|No action items)\.|\d+-minute meeting with \d+ speakers?\.)$

Any candidate summary that fails this regex throws SummaryFormatViolationError before the database write — the row is never updated with the bad string. Separately, if any raw-transcript column is ever found populated after a write, RawTranscriptPersistedError force-NULLs the column and Sentry-alerts FATAL. A runtime invariant scans the database hourly and alerts on any row whose ai_summary doesn't match.

Honesty caveat: the label is AI-chosen and may be wrong (a "Working session" may get marked "Status update", etc.). What we guarantee is the format, not the AI's accuracy at picking the label. The format guarantee is what makes the privacy claim enforceable.

Where AI fits in. Task extraction and summarization run on Anthropic Claude. While Claude processes the transcript, Anthropic may retain the request data for up to 30 days for abuse monitoring under their standard API terms. The retained data is not used to train models. After 30 days it is deleted by Anthropic.

What's next. We are pursuing zero-data-retention with Anthropic, which removes the 30-day window entirely. We will update this page the day it's in place. (Last updated: 2026-04-24.)

Security

Access Controls

  • Google OAuth 2.0 and Microsoft OAuth — no password storage
  • Role-based access control with scoped permissions per user
  • All API endpoints protected by authentication middleware
  • Session-based auth with secure HTTP-only cookies

Encryption

  • TLS 1.3 encryption for all data in transit
  • Neon-managed PostgreSQL with encryption at rest
  • OAuth access & refresh tokens encrypted at the application layer (AES-256-GCM)
  • Tokens never exposed to the frontend; per-user isolation enforced server-side

Monitoring & Logging

  • Server-side request logging with timestamp and response tracking
  • AI usage logging for all transcript and task processing operations
  • Error reporting system with automatic capture and categorization
  • Quarterly vulnerability assessment (roadmap)

Infrastructure

  • Hosted on Replit's managed infrastructure with automatic scaling
  • No shared infrastructure — isolated application environment
  • Secrets managed through Replit's encrypted secrets system
  • Annual third-party penetration testing (roadmap)

Privacy & Data Protection

Data Minimization

We only process data necessary for the Service: transcripts, tasks, and calendar events from sources you explicitly connect. No browsing data, location tracking, or advertising profiles are collected.

Data Retention

Most source data (transcripts, briefings, analytics) is auto-purged on a short schedule. See the full retention table below for specifics. You can delete any individual transcript or task at any time.

AI & Your Data

AI processing uses Anthropic's Claude via their commercial API. Your data is never used to train AI models. Data is processed to generate responses and is not retained by Anthropic.

Your Rights

GDPR and CCPA rights supported: access, correction, deletion, portability, and objection. Contact privacy@timecompass.ai to exercise any right.

Compliance & Certifications

GDPR-Ready

Active

Data subject rights, privacy by design, lawful processing bases

PCI-DSS Level 1

Via Stripe

All payment processing handled by Stripe — we never store card data

SOC 2 Type 1

Roadmap — Q3 2026

Pursuing SOC 2 certification for enterprise readiness

Uptime & Reliability

Target SLA

99.9%

Monthly uptime commitment

Infrastructure

Replit Cloud

Auto-scaling with managed deployments

Last Known Incident

None

No reported service disruptions

Subprocessors

ProviderPurposeWhat we shareSecurityLocation
ReplitApplication hosting (compute, deployments)Application code & runtime data
SOC 2
US
NeonManaged PostgreSQL databaseAll application data (encrypted at rest)
SOC 2
US
Anthropic (Claude)AI task extraction, summarization, schedulingTranscript text per request (in-flight only — never persisted on our side); not used for training
SOC 2
US
GoogleOAuth sign-in, Calendar API, Drive API, Meet transcriptsOAuth tokens; calendar & transcript metadata
SOC 2 / ISO 27001
US
MicrosoftOAuth sign-in, Outlook Calendar, Teams transcriptsOAuth tokens; calendar & transcript metadata
SOC 2 / ISO 27001
US
AppleSign in with Apple, iOS in-app purchase receiptsApple ID identifier, IAP receipts
SOC 2
US
StripeSubscription billing and payment processingEmail, customer ID, subscription state (no card data)
PCI-DSS Level 1
US
ResendTransactional email deliveryEmail address, message content
SOC 2
US
Postmark (ActiveCampaign)Inbound email forwarding for pasted-meeting workflowForwarded email subject + body (in memory only — never persisted to our DB)
SOC 2
US
SentryError monitoring (frontend + backend)Error stack traces, user ID, request metadata (PII scrubbed)
SOC 2 / ISO 27001
US
ExpoPush notification delivery (mobile app)Device push token, notification payload
SOC 2
US
HeyPocketPocket recording transcript syncPocket API key (encrypted), recording metadata
Vendor-managed
US
ZoomCloud recording transcript sync (Server-to-Server OAuth)OAuth tokens, recording metadata
SOC 2
US
Atlassian (Jira)Task import from Jira issues (opt-in)OAuth tokens, issue metadata
SOC 2 / ISO 27001
US/EU
AsanaTask import from Asana workspaces (opt-in)OAuth tokens, task metadata
SOC 2
US
Monday.comTask import from Monday boards (opt-in)OAuth tokens, item metadata
SOC 2 / ISO 27001
US/EU

We commit to giving at least 14 days' notice before adding a new sub-processor. Material changes are announced via email to active customers and on this page.

Data Retention

Data typeRetentionNotes
Transcripts (Meet, Teams, Zoom, Pocket)AI summary + metadata onlyTimeCompass doesn't persist transcript content. Every ingest path funnels through a single process flow that holds raw text in function-local memory only, generates a constrained-format summary, and persists nothing else. A runtime invariant scans the database hourly and alerts on any leak. The metadata row (title, date, duration, AI summary) is retained indefinitely for deduplication so we never re-process the same meeting twice; in your Meetings list it remains visible for 14 days (Pocket) or 30 days (Meet/Teams) and is hidden after that. You can permanently delete any meeting via 'Forget this meeting'. (Claude processes the text in-flight; Anthropic may retain request data up to 30 days for abuse monitoring — see the top-of-page section.)
Pasted & emailed transcriptsAI summary + metadata onlyRaw pasted/forwarded text never persists — same single process flow, same guarantee
Transcript modificationsPre-ingest onlyAll transcript edits (trimming, splitting) must happen in your source tool BEFORE forwarding to TimeCompass. We removed the in-app split tool because it required reading stored raw text — incompatible with the no-storage policy.
AI-extracted task suggestionsUntil reviewed or transcript purgedCascade-deleted when source transcript is deleted
Tasks, habits, time entriesUntil you delete them or close your accountSoft-deleted with 30-day account purge on close
Daily briefings7 daysRemoved after end-of-day review
Analytics events (product usage)90 daysAuto-cleanup; aggregated only, no third-party trackers
Push notification tokens30 days inactiveStale tokens purged automatically
Demo accounts7 days inactive (48h sessions)Full purge including OAuth tokens
OAuth tokensUntil you disconnect or close accountAES-256-GCM encrypted at application layer
Account deletionWithin 30 daysAll personal data removed; backups expire on rolling basis

Common questions

Can I delete a single meeting?

Yes. Open the Transcripts page, hover the meeting, and click the trash icon. We'll show you exactly what gets removed (transcript, AI summary, unreviewed task suggestions, calendar links) and what stays (tasks you've already accepted). Every deletion is recorded in your account audit log.

What happens when I paste a transcript?

The raw text you paste is never written to our database. We extract action items and a short AI summary in memory at submit time, then save only the summary plus metadata you provided (title, date, participants). The original text is discarded the moment the request finishes. Calendar matching is opt-in — we suggest candidates but never link without your click.

How does email forwarding work, and what happens to the email body?

Each account gets a private forwarding address (find it under Settings → Email forwarding, or the "Forward by Email" button on the Transcripts page). When you forward a meeting recap there, our inbound webhook receives it over TLS, runs AI extraction in memory, and saves only the title, date, sender, and AI summary. The raw email body is never written to our database. You can lock the address to a trusted-sender allowlist; either way, it's rate-limited to 50 messages per day.

What exactly does TimeCompass keep from each meeting?

One short summary sentence — nothing more. For example: "23-minute meeting with 3 speakers. Decisions made.". The format is locked by a regex validator that runs at the database write boundary. No names, quotes, topics, or decisions can reach the column. See all 7 shapes and the full vocabulary →

Is my data used to train AI?

No. Anthropic's commercial API does not retain or train on customer data. We do not sell, share, or syndicate your data with any third party for advertising or model training.

How are OAuth tokens stored?

OAuth access and refresh tokens are encrypted at the application layer using AES-256-GCM with a server-managed key, on top of database encryption at rest. Tokens are never returned to the browser.

How do I close my account?

Email privacy@timecompass.ai from the address on your account. We confirm within 5 business days and complete full deletion within 30 days.

Incident Response

Detection

Continuous server monitoring with automated error tracking and alerting. Application health checks run on every deployment.

Notification

Affected users notified via email within 24 hours of confirmed incident. GDPR-compliant breach notification within 72 hours to supervisory authorities.

Post-Mortem

Public incident summaries published after resolution with root cause analysis, impact scope, and preventive measures taken.

Data Flow

User

Connects accounts via OAuth

Transcript Sources

Google Meet · Teams · Zoom · Pocket

TimeCompass Server

Express.js with TLS — data never leaves server unencrypted

Claude AI (Anthropic API)

Task extraction & summarization via single process flow — raw text in memory only, never written to our DB. Anthropic may retain the request data for up to 30 days for abuse monitoring (not used for training).

PostgreSQL Database

Tasks, habits, time entries stored with encryption at rest

Calendar Sync

Scheduled work blocks & breaks pushed to Google/Outlook

Last updated: April 23, 2026 — every transcript ingest path now funnels through a single process flow. Raw text lives only in function-local memory, never crosses a database write, and an hourly runtime invariant guards the contract. The in-app transcript split/edit tool was removed because it required reading stored raw text. Sub-processor disclosure: Anthropic may retain Claude API request data for up to 30 days for abuse monitoring under their standard terms; we are pursuing zero-data-retention.

Report a security concern: security@timecompass.ai