Trust
Security and trust
A plain description of what TalkPilot does with your data, who processes it and what you control. We list only what we actually do, no certifications we do not hold.
Last updated: October 16, 2026
Recording posture
- We don't record or store audio. Transcripts stay in your account until you delete them.
- No bot joins your call. TalkPilot listens on your own device, and it shows on screen shares unless you turn on Undetectable (Pro and Teams, Mac and Windows).
- Every session is started explicitly by the user, from the app, and can be stopped at any time.
- Obtaining consent from the other participants is the user's responsibility, according to the laws of their jurisdiction. TalkPilot does not provide legal advice on recording or notice requirements.
Processing
Speech-to-text and AI suggestions use the cloud providers listed below. They receive only the content needed to produce the result.
- In transit: TLS 1.2 or higher.
- At rest: AES-256, managed by our hosting provider.
- Tenant isolation is enforced at the database level with row-level security on every table, not only in the application.
- All processing today takes place in the United States. There is no EU data residency option.
Data retention
- Transcript bodies are retained for 365 days by default and can be configured per organization.
- Scorecards and scores are retained until deleted and contain no raw conversation content.
- Completed purges are recorded for operational verification.
Deletion controls: you can request deletion of your account or of specific conversation data at any time from /delete-account, or by writing to alexis@talkpilot.co. Organization owners and admins can export their data as JSON.
Subprocessors
Providers that can process conversation content
| Provider | Purpose | Data received | Region |
|---|---|---|---|
| Supabase (AWS) | Database, auth, storage, backend functions | Transcripts, notes, account records | US |
| Anthropic, OpenAI | AI processing: live coaching, summaries and scoring | Conversation text, and the playbook and documents you add | US |
| Deepgram | Speech-to-text | Session audio | US |
| ElevenLabs | Practice voices, and the spoken earbud whisper (Pro) | Practice audio, and the short coaching line to be spoken in your earbuds. Never call audio. | US |
Providers that receive account data only
| Provider | Purpose | Data received |
|---|---|---|
| Stripe | Billing | Email, organization name, payment details (we never store card data) |
| Resend | Transactional email | Email address, message content |
| Vercel | Web hosting | Request metadata |
| Apple / Google | App distribution, in-app purchases, push | Device tokens, purchase receipts |
| PostHog | Product analytics | Usage events, user identifiers |
| Sentry | Crash reporting | Stack traces, device metadata |
| HubSpot / Salesforce | CRM logging, only if you or your organization connect it | Call notes, action items and the contact or deal details you choose to send |
| Slack, Asana, Jira, Monday.com | Recaps and tasks, only if you connect them | The recap or action items you review and choose to send |
| Google / Microsoft | Calendar and email, only if you connect them | Your upcoming meetings, and the follow-up email you choose to send |
This list may change as the product evolves. Write to alexis@talkpilot.co to be notified of changes affecting providers with access to conversation content.
DPA and documentation
A Data Processing Agreement is available on request. Write to alexis@talkpilot.co and we will send the current version, along with answers to security questionnaires.
See also: Privacy Policy · Terms of Service
Have a security question this page does not answer? Write to alexis@talkpilot.co and you will get a direct answer, not a form letter.