Corteza
Security
Last updated: October 13, 2026
Corteza reads your team’s Google Meet meetings and keeps the outcomes in them. This page explains how we protect that data: what we keep and what we don’t, how it’s encrypted, who can see it, and how to report a problem. For the full detail of what data we use and why, see the Privacy Policy.
In short: we never store transcripts, only the outcomes found in them. Meeting content is encrypted with a key unique to your workspace. Colleagues can’t see each other’s personal space, not even admins. Your data is never used to train AI models.
What we keep, and what we don’t
- Kept: the outcomes of a meeting (decisions, action items, open questions, risks), with their owner, due date, reasoning, a short quote as evidence, and the meeting’s title and date.
- Not kept: transcripts and meeting notes. They’re read, sent to our AI provider to find the outcomes, and discarded. We keep only a fingerprint (hash) so the same meeting isn’t processed twice.
- Not kept: calendar events. They’re read to prepare your day and held in memory for at most 10 minutes.
- Corteza only reads Google data after you connect it, and only the permissions listed in the Privacy Policy. It doesn’t browse your Drive or your email.
Encryption
- In transit: all traffic uses HTTPS (TLS), with HSTS.
- At rest, per workspace: meeting content (outcome text, reasoning, quotes, titles, AI context and documents) is encrypted in the application with AES-256-GCM before it reaches the database, using a key unique to each workspace. Workspace keys are themselves encrypted with a master key kept outside the database. The database provider sees only ciphertext for those fields.
- Credentials: Google access tokens and other integration credentials are encrypted.
- Deletion by key: when a workspace is deleted, its key is destroyed, which makes any remaining copy of its content unreadable, backups included.
Who can see what
- Sign-in is Google only. Corteza has no passwords. Your company’s Google Workspace policies (2-step verification, session length, device rules) apply to Corteza too. A workspace is tied to your Google domain, verified by Google.
- Personal by default: what Corteza captures from your meetings goes to your personal space, which only you can open. Workspace admins can’t open it either.
- Sensitive topics (people leaving, performance, pay, health, legal matters about a person) are detected automatically or marked by you, and stay visible only to you.
- Checked on every request: each request is checked against the signed-in person and their workspace, and data is always filtered to what they’re allowed to see.
- Corteza staff don’t read customer content, except when you ask us to for support and give permission, for a security investigation, or when the law requires it.
AI
- Meeting text is processed by Anthropic (Claude) to find outcomes and answer searches, and outcome text by OpenAI for search embeddings, through their business APIs.
- Neither provider trains its models on data sent through these APIs, and we don’t use your data to train any model. Outcomes you confirm or dismiss improve results only inside your own workspace.
Infrastructure and providers
| Provider | What for |
|---|---|
| Railway | Application hosting |
| MongoDB Atlas | Database, in the EU (AWS, Paris), with meeting content encrypted by Corteza as above |
| Anthropic | AI that finds outcomes and writes search answers |
| OpenAI | Embeddings for semantic search |
| Resend | Sending email |
| PostHog | Product analytics (counts and ids, no meeting content) |
| Sentry (EU) | Error monitoring (error type and stack trace, no meeting content) |
| GitHub | Source code, automated checks and encrypted nightly backups |
| Sign-in and the integrations you connect |
The full list, with the data each one receives, is in the Privacy Policy.
Application security
- Strict Content-Security-Policy, no third-party scripts, and protection against framing and content sniffing.
- Session cookies are HTTP-only, secure and SameSite, and expire after 7 days.
- Rate limits on sign-in, the API and AI features.
- Requests that try to inject database operators are refused, and all content shown in the browser is escaped.
- Every change goes through automated checks before release: tests, linting, type checks and a scan of dependencies for known vulnerabilities.
Monitoring, backups and availability
- Errors are reported to Sentry with no meeting content, and we get alerts when captures fail, when background jobs stop or when a Google connection is lost.
- Logs and analytics carry counts and ids only: never transcripts, outcome text or search questions.
- The database is backed up every night, encrypted with a key held only by Corteza, and kept for 30 days.
Your control
- Disconnect Google at any time from Settings → Google Meet; Corteza’s access is revoked and the stored tokens deleted.
- Delete outcomes and action items at any time. To delete an account or a whole workspace, write to us and we do it within 30 days.
Compliance
Corteza follows the Google API Services User Data Policy, including its Limited Use requirements, and handles personal data in line with the GDPR. We don’t hold a SOC 2 or ISO 27001 certification yet; they’re on our roadmap. We’re happy to fill in your security questionnaire or sign a data processing agreement.
Report a security issue
If you think you’ve found a vulnerability, write to cristian@corteza.app with the details. We answer within 2 business days and ask that you give us reasonable time to fix it before making it public. Please don’t access other people’s data or disrupt the service while testing.