How LASK protects your data

By default, the entire processing of your meetings — transcribing the audio and drafting the recap — is done by Mistral AI, a French company whose servers are located in France. Audio and transcripts stay on EU-hosted infrastructure for the whole pipeline.

Anthropic (Claude) and OpenAI (Whisper), both US-based, are used only if your organization explicitly selects one of them as the transcription or drafting provider in settings. Nothing is sent to them without that deliberate choice.

Our application servers and database are hosted with OVH (France). Transactional email (invites, verification codes, notifications) is sent through IONOS (European Union).

At rest. Recordings, transcripts, recaps and action items are encrypted in storage (Fernet: AES-128 in CBC mode with HMAC authentication). Integration OAuth tokens and Slack webhook URLs are encrypted the same way. Passwords are never stored in the clear — they are hashed with bcrypt.

In transit. All traffic is over HTTPS. Outbound email uses STARTTLS. Calls to the transcription and AI providers are over HTTPS.

When your organization enables consent requests, a meeting cannot be recorded until every invited attendee has consented. This is enforced by the API itself — there is no button that overrides it.

Each attendee’s consent or objection is recorded with a timestamp and kept as evidence. If your organization chooses not to send these requests, it is then responsible for obtaining consent another way — and the product says so explicitly to the organizer.

The raw audio of a recording is permanently deleted 30 days after the meeting, by an automatic daily purge. This is not a manual task — the deletion is done by the system.

The transcript and recap (encrypted) are kept until you delete the meeting or project. Deleting an organization removes all of its data.

Every sensitive or destructive action — deleting an organization or a user, exporting data, changing plan, an automatic recording purge — is recorded with the actor, the action type, the target and a timestamp. Admins can review this log.

It is kept indefinitely, for accountability (GDPR Art. 5(2)): it deliberately survives the deletion of the organization or user it describes.

Export. An organization admin can request, from the admin panel, a full export of everything the organization has stored. It is delivered by email as an archive and never includes credentials or raw audio.

Erasure. Any user can delete their own account at any time (right to erasure). Deleting an organization removes all of its data.

For your meeting content, LASK acts as a processor on behalf of your organization, which is the controller. A Data Processing Agreement (DPA) governs that relationship.

The DPA is available online, and a signed copy is available on request.

Read the DPAarrow_outward

We maintain a Record of Processing Activities under GDPR Article 30: purpose, legal basis, data categories, recipients, retention periods and security measures for each of the service’s thirteen processing activities.

A summary is available on request as part of a compliance review.

We follow a documented runbook aligned with GDPR Articles 33 and 34: immediate containment, severity assessment, notification of the competent supervisory authority within 72 hours where required, notification of affected individuals where the risk is high, and an entry in an internal register for every incident — including those that do not meet the notification threshold.

Point of contact for any security incident: dev@trackap.com.