In short: your data is encrypted on its way to us and while it’s stored, every account can use two-step verification or sign in with Google or Microsoft, and access is limited by folder and by role. Below is what’s in place today and what’s coming before our paid launch.
Encryption
- In transit. Every connection to Amity Results, its API and our providers uses HTTPS (TLS).
- At rest. Recordings and exports are stored in Cloudflare R2, which encrypts stored files confirm: AES-256. Our database runs on confirm: encrypted disks at Hetzner.
- Passwords are stored only as one-way hashes.
- Secrets such as two-step verification keys and the access keys connected services give us are encrypted in our database with a separate key that we can rotate, so a copy of the database alone doesn’t reveal them.
- Links that grant access, such as folder invitations, are stored only as a one-way hash, like passwords. A copy of our database can’t be used to open them.
Signing in
- Sign in with Google or Microsoft, so your organisation’s own sign-in rules and two-step checks apply.
- Two-step verification with an authenticator app, plus single-use recovery codes. Staff accounts must use it.
- We email you whenever a sign-in method is added or removed, or two-step verification is turned on or off.
- Every sign-in is recorded with its IP address, device and approximate location.
- Signed-in devices. Your profile lists every device you’re signed in on, and you can sign out any of them. We email you when you sign in from a new device.
Who can see what
- Your recordings are private to you until you invite someone to a folder.
- Each folder member has a role: Owner, Contributor or Visitor. Visitors can read but can’t change or delete anything.
- Invitations go to one email address and only work for the account with that address. They expire after 14 days, and sending one again makes the earlier link stop working.
- API keys belong to a single folder, come in separate test and live versions, and can be limited to what an integration needs.
- Our staff can reach customer data only when needed to support you or keep the service running, using accounts protected by two-step verification.
Activity history
Every folder keeps an activity log: uploads, downloads, exports, deletions, sharing changes and API key use. Folder owners see everyone’s activity and can download it as a CSV file. Other members see their own.
Backups and recovery
Coming soon. We’re setting up encrypted daily database backups and a copy of every stored file at a second provider, with a restore drill we repeat every quarter. Our targets:
- Recovery point objective (RPO): at most 24 hours of data lost in a disaster.
- Recovery time objective (RTO): back up within 4 hours.
Deleting and exporting your data
- Trash. Deleted recordings stay in the trash for 30 days, so you can restore them. After that they’re erased from our storage and from our transcription provider.
- Retention rules. Folder owners can have recordings deleted automatically after a set number of days, or delete only the original audio and video and keep the transcripts. Owners get an email a week before anything is removed.
- Coming soon: account deletion that removes everything in the account, and an export of all your data as one download.
AI providers
Recordings and transcripts are processed by AssemblyAI and by AI models we reach through it. Our subprocessors page shows what each provider is allowed to do with them and when we last checked.
Infrastructure and monitoring
- Our servers run at Hetzner in data centre location, managed with Ploi. Cloudflare sits in front of them.
- Software updates and security patches are applied how often.
- We’re alerted by email and in our team chat when processing fails, the queue backs up, an AI provider has an outage, customer webhooks keep failing or costs jump. Errors in the app are tracked with Sentry, with personal details removed before they leave our servers.
- Coming soon: a public status page.
Testing and reviews
- Amity Results has an automated test suite that covers sign-in, sharing permissions, billing and the API.
- Coming soon: those tests and a check for vulnerable dependencies running automatically on every change, a review against the OWASP API Security Top 10, stricter security headers, and an external penetration test before our paid launch.
We don’t hold SOC 2 or ISO 27001 certification. If your organisation needs a security questionnaire filled in, email security@amityresults.com.
Reporting a security issue
If you think you’ve found a vulnerability in Amity Results, email security@amityresults.com. Please include what you found, how to reproduce it and what an attacker could do with it.
- We’ll reply within 3 business days and keep you updated until it’s fixed.
- Please don’t access, change or delete other people’s data, run tests that slow the service down, or tell anyone else about the issue until we’ve fixed it.
- If you follow these rules in good faith, we won’t take legal action against you.
- We don’t run a paid bug bounty yet, but we’re glad to credit you.
Our security.txt file has the same contact details in a standard format.