Security and privacy for Cedarloop

Your meeting data is serious business. Here's how we protect it.

The lowdown

Cedar connects to your calendar, and joins meetings when you ask it to.
Cedarloop joins the call and is transparent to meeting attendees – no surreptitious recorders working in the background.
We use leading providers like Anthropic and Deepgram for real-time transcription, and for generating notes and action items.
Meeting audio is streamed and processed in real time, but not stored.
You control your meeting's notes: they're private to meeting attendees, unless you choose to share them.

No secret recordings

Cedarloop is visible to all meeting attendees. No surreptitious recorders working in the background. No five divergent copies of notes on 5 attendees' devices.

No stored recordings

Cedar streams audio from Zoom or Google Meet to our transcription provider, and is then discarded. Nobody can listen to it. Only the transcript and the notes Cedar generates are stored – and you can delete those too.

Your data, your control

Notes are private by default, visible only to you and meeting attendees. You can delete your account and all associated data at any time. We don't sell your data, or allow AI providers to train on it. We're here to make an excellent product.

Infrastructure

US-hosted on DigitalOcean.
Databases hosted on Supabase with row-level security.
All traffic encrypted in transit (TLS).
Auth tokens encrypted at rest (AES-256-GCM).
Application logs retained for 90 days max.

Third-party providers

Purpose	Provider	Location
Real-time transcription	Deepgram	US
AI notes and summaries	Anthropic, OpenAI	US
Meeting audio relay	Recall	US
Database and auth	Supabase	US
Cloud hosting	DigitalOcean	US
Product analytics	PostHog	US
Error monitoring	Sentry	US
Transactional email	Resend	US

We don't allow third parties to use your data to train AI models.

Access controls

Users sign in through Google Auth, facilitated by Supabase. All meeting data is protected by row-level security policies that ensure only the meeting owner, members of the same organization, and meeting attendees can access it as appropriate. Internal access to production systems is limited to key personnel.

Compliance

We're early-stage, so we don't hold SOC 2 or GDPR certification yet, but we build with their principles in mind. If your organization requires specific compliance documentation, contact us at [email protected] – we'd love to work with you on getting what you need.

Vulnerability disclosure

If you discover a security vulnerability, contact [email protected]. We take all reports seriously and will respond promptly.

FAQ

Does Cedar record my meetings?

No. Audio is streamed to our transcription provider in real time and then discarded. Nobody can listen to your meetings.

Who can see meeting notes and transcripts?

Only you, attendees of the meeting, and people you explicitly share them with.

Can I delete my data?

Yes. Go to Settings in the app and delete your account. Your account and all associated data are removed.

Do you train AI models on my data?

No. We do use signals from customer data to improve our products. If you flag a note as incorrect, for example, we'll use that data to make future notes better, but not by training a new model on it.

Do you support SSO?

We support Google Workspace auth – so partially. If your organization requires SSO or other enterprise authentication, contact us and we'll work with you.