Security

This is the engineering summary. The security questionnaire, DPA, subprocessor list and pentest summary are available on request during a pilot; see the trust center.

Desktop app

• Capture uses documented OS APIs only: Core Audio / ScreenCaptureKit on macOS, WASAPI loopback on Windows. No kernel extensions, no virtual drivers.
• Screen-share exclusion uses NSWindow.sharingType = .none (macOS) and SetWindowDisplayAffinity(WDA_EXCLUDEFROMCAPTURE) (Windows), the same mechanism password managers use so their windows don't appear in shared screens. Framing matters: the rep's private notes aren't broadcast during a demo. It is not concealment from the customer's own recording, and an org policy can disable it.
• Tokens live in the OS keychain (macOS Keychain, Windows DPAPI). The renderer is sandboxed with context isolation; audio, crypto and networking run in the main process.
• Audio frames are streamed over TLS to the gateway and never written locally. A three-second in-memory ring buffer exists only to survive reconnects.
• Builds are signed and notarised (macOS) and Authenticode-signed (Windows). Updates are served over HTTPS and signature-checked.

Live plane

• The gateway authenticates every WebSocket with a short-lived JWT and forwards the same identity to the orchestrator, which verifies it again.
• Resume tokens are HMAC-bound to org, call and device, so a dropped connection can't be re-attached to another tenant's call.
• ASR and LLM providers receive audio/text under terms that prohibit training on customer data. Providers are swappable behind internal interfaces; the org can request a specific provider or region.

Control plane

• Every organisation-scoped table carries org_id with Postgres row-level security; application code runs inside a per-request transaction that sets the tenant. There is no cross-tenant query path.
• AES-256 at rest (database, object storage, OAuth token vault with AES-256-GCM). TLS 1.2+ in transit.
• Role hierarchy admin > manager > rep; service-to-service calls use short-lived signed service tokens accepted only on specific endpoints.
• Read scoping separates people, not just tenants. Row-level security keeps organisations apart; a second layer keeps individuals apart inside one organisation. A rep's requests are forced to their own records regardless of what the client asks for, and a manager is bounded by the teams they manage. Out-of-scope single records answer 404 rather than 403, so a response can never confirm that a colleague's call exists. See Roles & permissions.
• Every mutation appends to an append-only audit log (actor, action, before/after, IP). Admins can view and export it; see Public API & webhooks for programmatic access.
• Impersonation is read-only and always attributed. An admin can view the product as another user for support, but the session lasts 15 minutes, refuses every non-GET request at the authentication layer, and audits each request under both identities. There is no way to act as someone else without a record naming you.
• Outbound webhooks and URL imports go through an SSRF guard (no private ranges, no redirects to them).
• Rate limits on every public endpoint; tighter limits on auth, signup and export.

Identity

Magic-link email by default; SSO (SAML/OIDC via WorkOS) and SCIM provisioning on Enterprise; see SSO & SCIM.

Data lifecycle

Retention windows per org, hourly sweep, per-call deletion, org export (JSON) and org erasure. Assist-only mode stores no audio and no transcript. See Consent & recording.

Compliance status

SOC 2 Type I in progress; Type II to follow. GDPR: DPA and SCCs available; EU data residency on the Enterprise roadmap. We publish status changes on the changelog and the trust center.

Reporting a vulnerability

Email security@repcue.io. We acknowledge within two business days and run a private bug bounty for pilot customers.