What we do with your meeting data, and how we enforce it.

No hidden or silent recording. Capture starts only from an explicit action you take — there is no "record everything automatically" mode.

A persistent recording indicator is shown in the app window and the system tray for the whole time capture is active.

A link you share shows the meeting summary and action items only — never the transcript or the recording — unless you explicitly widen what it includes.

Marking a meeting "Sensitive" removes it, fail-closed, from AI memory, cross-meeting search, and the AI/MCP connector, and blocks new shares of it.

AI-inferred speaker names and client-name guesses are visibly labeled "AI guess" until you confirm them — never shown as fact.

Every account's data is isolated with Postgres Row-Level Security — one customer can never read another customer's meetings, transcripts, clients, or settings.

Deleting your account removes every row you own — meetings, transcripts, clients, forms, audit history — plus the recording files in storage, then your login itself.

Deleting a single meeting removes it from your workspace and switches off every Protokol link to it straight away, including any public recap page, and cancels any delivery still queued for it. You can restore it for 30 days. Permanent deletion of the underlying recording and transcript is built and tested but is not yet switched on in production, so a soft-deleted meeting has no automatic purge date today.

Outbound webhook deliveries to your own systems (Zapier, Make, n8n, a generic endpoint) are HMAC-SHA256 signed once you set a webhook secret, with a timestamp that blocks replay.

Data is encrypted in transit (TLS) and at rest; Protokol's primary database and recording storage are hosted in the EU.