Security & Data Handling

This page explains, in plain language, where your data actually goes when you use Pitara. It is written to be checked rather than admired. If something here is unclear or looks wrong, tell us and we will fix the page or the product.

The formal document is our Privacy Policy. Where the two differ, the Privacy Policy governs.

1. Where your data lives

What	Where it lives	Notes
Meeting audio (desktop & mobile apps)	Your device Your account, if you allow it	Stored on the device that recorded it. Uploaded to your account only so your other devices can play it, and only if you leave that setting on. Never sent to a transcription vendor.
Meeting audio (recorded in a web browser)	Your account AssemblyAI	The browser version has no on-device transcription. Audio is uploaded and transcribed by AssemblyAI.
Transcripts, notes, summaries	Your device Your account	Synced so the same meeting is readable on every device you sign in to.
Memory (what powers Ask and search)	Your account	Built server-side from your transcript and note text. You control which documents join memory.
Text sent to AI features	Model providers	Summaries, Ask and related features send the relevant text to the providers listed in our Privacy Policy. Your audio is not sent.
Account details	Your account	Email, name and profile picture from the identity provider you signed in with. Billing is handled by Stripe; we never see your card number.

2. On-device transcription

In the desktop and mobile apps, speech recognition and speaker separation run on your own machine using models that ship with the app. Your audio is not sent to a transcription service. This is true on every plan, including the free one.

No bot joins your meeting. Pitara captures from your own machine, so nothing appears in the participant list and no other attendee is asked to accept a vendor they have not heard of. That also means announcing the recording is your responsibility, not ours. See section 7.

3. Your audio, and the choice you get

The apps ask, during setup, where your recordings should live. You can change the answer at any time in Settings.

• On this device only - the recording is never uploaded. We hold no copy. It will not play on your other devices, and if the device is lost, wiped, or the app is uninstalled, the recording is gone and we cannot recover it.
• On all my devices - the recording is stored in your Pitara account, encrypted in transit and at rest, so the same meeting plays anywhere you sign in.

Two things we would rather say than have you discover. Turning the setting on stops future uploads; recordings already in your account stay there until you delete them. And whichever you pick, your transcript and notes still sync, so this setting is about the audio file and not about everything.

4. Encryption

• In transit - all traffic between the apps, the website and our servers uses TLS.
• At rest, on our servers - stored content and uploaded media are encrypted at rest.
• At rest, on your device - the desktop app keeps your documents, settings and a local copy of your synced data in a per-user encrypted database. The encryption key is held by your operating system's secure keystore (Windows DPAPI, macOS Keychain, Linux libsecret). Your session tokens are protected the same way.

We do not describe Pitara as end-to-end encrypted, because it is not. We can read content stored in your account in order to provide the service. What limits that is access control and logging, described next, not cryptography.

5. Access, logging and training

• Staff access to customer content is limited to what is needed to operate the service and investigate problems you report.
• Security-relevant events, including access denials and permission changes, are logged.
• We do not use your recordings, transcripts or notes to train models.
• Data is not sold, and it is not shared with advertisers. Advertising pixels run on our public marketing pages only, never inside the app or on shared content pages.

6. Retention and deletion

Deleting a document moves it to Trash, where you can restore it for 30 days, after which it is purged. Deleting your account removes your content from our systems on the schedule described in the Privacy Policy.

Recordings kept on your device are not in your account, so deleting your account does not delete them. They are removed by deleting them in the app or uninstalling it.

7. What is your responsibility, not ours

You are also responsible for who you invite into a shared document or a shared memory, and for the accounts and devices you sign in on.

8. Sub-processors

The full list of third-party services, what each one is used for, and exactly what data reaches it, is maintained in section 3 of our Privacy Policy. That table is the authoritative version and is updated when a provider changes.

9. Compliance

We maintain an internal control set aligned to the SOC 2 Trust Services Criteria covering security, availability, processing integrity, confidentiality and privacy, and we develop against it. For customers with health-related obligations we support a separate processing path under a Business Associate Agreement.

For current audit status, a Business Associate Agreement, a Data Processing Agreement, or to complete a security questionnaire, contact us and we will send what we have, including where we fall short.

10. Reporting a vulnerability

If you believe you have found a security issue, please get in touch with enough detail to reproduce it, and give us a reasonable window to fix it before disclosing it publicly. We will confirm receipt, keep you updated, and credit you if you would like to be credited.