What we hold, where it sits, who can reach it.

The ten questions people actually ask.

In the order they usually arrive, answered without hedging. Everything here is expanded in the sections that follow.

What happens to a recording, step by step.

Five steps, in order, from the microphone to the note on your screen. This is the whole journey.

1. Captured on your device and written to local disk first, so a crash or a flat battery cannot lose the conversation.
2. Uploaded over TLS into a folder that belongs to your account. No other account can list it, read it or write into it.
3. Read by a server function holding a service credential, and passed to ElevenLabs for transcription.
4. The transcript goes to Anthropic, which produces the note, the brief and the follow-ups. Text only at this stage, no audio.
5. The result lands in Postgres, owner scoped, and your device reads back only its own rows.

How long each thing stays.

Where a fixed period exists, it is a real number taken from the code that enforces it. Where none exists, the row says so rather than implying one.

Every permission we ask for, and why.

The exact OAuth scopes are printed rather than described, because that is what an IT policy is actually written against. Two of them are write capable, and we would rather you read that here than discover it on a consent screen.

Every company that touches your data.

The full list, with what each one does and what it actually sees. Several of them see nothing belonging to you at all, and are listed anyway so the list is complete.

Where our compliance work genuinely stands.

A security page is the easiest place in the world to imply a certificate you do not hold. Here is the real state of each item, including the one that is not finished.

• SOC 2

  In progress, not complete

  Our internal security programme has been written and operating since June 2026: policies, a risk register reviewed quarterly, a vendor inventory, access reviews and a documented system description. The independent audit has not started. We are targeting a Type I report first, then a Type II observation window. There is no SOC 2 report we can hand you today, and we will not imply otherwise.

• Encryption

  In place

  TLS on everything in transit. AES-256 at rest, managed by Supabase on AWS key management. Desktop session tokens are encrypted using the operating system keystore.

• Data isolation

  In place

  Row level security on every table in the database, storage buckets scoped to a per-account folder path, and all provider API keys held server side, never in an app you download. An external security review in June and July 2026 closed eleven findings, each recorded with its date in our register.

• Microsoft publisher verification

  Complete

  The Microsoft consent screen shows Finche as a verified publisher, so corporate tenants are not being asked to approve an unknown application.

• GDPR and UK GDPR

  Honoured

  Access, rectification, erasure, portability, objection and restriction. Email us with the subject line GDPR Request and we will respond within 30 days. Export and deletion are also self-service, so most requests need no one's involvement but yours.

How to evaluate this properly in an afternoon.

If you are assessing Finche on behalf of someone else, this is the shortest honest route to a decision.

1. Read the scope table above against your tenant policy. The calendar scope is write capable. If that fails your policy, users can simply leave the calendar disconnected, and every other part of the product still works.
2. Trial it with one person for a week, then have that person run the JSON export and read it. It is by far the fastest way to see precisely what is held about them, in their own words.
3. Delete that test account and confirm the export no longer returns anything. Deletion is immediate, so this takes a minute rather than a support ticket.

What to ask us for.

Every item below is something we will answer in writing. If the answer is not yet a yes, we will say which one it is.

• The hosting region for your account, named in writing
• The current sub-processor list, plus notice before we add one
• A data processing agreement
• The status of our SOC 2 engagement, and the auditor once one is appointed
• Provider level confirmation of retention and no-training terms
• Our incident response process and notification timelines
• Anything on this page you want evidenced rather than asserted

The work that is not finished.

Publishing this is not a confession, it is the point. A security page with no open items is either very old or not being kept honestly.

• An independent SOC 2 audit. The programme is running, the audit has not begun
• Signed data processing agreements with each AI provider
• A documented restore test against the database backups, with recovery targets written down
• Code signing for the Windows installer, before Windows becomes generally available
• Separation of duties, which arrives with the first hire

Who to talk to.