ReCaptured
Your data, your rules.
This page says what the system does with your data, what you control, what we will never do, and where we stand on certifications, in plain language. Nothing here requires a security questionnaire to understand.
What's in the product today
Multi-factor authentication and SSO
Multi-factor authentication is required for every account, with sign-in through Google or Microsoft if you prefer, and an admin can end every active session so the whole organization signs back in with MFA.
Role-based access, previewable
Roles decide who sees and changes what, down to "assigned work only." Admins can open the app as any member to check exactly what they'd see, without editing anything.
Audit log, and a log of our access
Every privileged action in your organization is recorded with actor, target and outcome. Separately, every time a ReCaptured operator accesses your organization you see who, when, why and for how long.
Files scanned before they're read
Every upload is scanned before anything, including your assistant, can read it. Files that fail scanning are quarantined.
Private and Off-the-Record
Direct messages are private by structure. Any note, channel or conversation can be marked off the record and is never indexed. You control what’s indexed.
Recording consent, time-stamped
Meeting capture asks every participant before recording starts and stamps each consent on the meeting record, whether the participants are your own people or external guests.
Retention, holds and privacy requests
Set how long each class of data is kept, place holds that suspend deletion, and handle access, correction and erasure requests from the people whose data you hold.
Export your data any time
Choose scope, fields and format. Your records, files and history leave with you in standard formats. No exit fee. Export is available for 30 days after your subscription ends; we delete what remains within 90 days after that, except signed-document audit trails, security logs and invoices.
Guarded bulk changes
Every bulk change is audited record by record, and large changes need a second approval.
Integrations you can revoke
See every connected service, what each is allowed to do, and the credentials behind it. Rotate or revoke access in one action; nothing syncs again until you reconnect it.
What we will never do
- ✕Sell your data. We share it only with the providers who run the platform, when the law requires, or with a successor who takes on these same commitments.
- ✕Let the assistant act in your records, or send anything outside your organization, without a person's approval.It drafts, suggests and surfaces. Confirm-first is the hard ceiling.
- ✕Index anything you mark Private or Off-the-Record.
- ✕Access your organization without leaving a record of it.Operator access is logged and visible to you. Support sessions are read-only and time-limited.
- ✕Keep your data after you leave.If you leave, you can export everything for 30 days. We delete what's left within 90 days after that, keeping only what the law requires: signed-document audit trails, security logs and invoices.
- ✕Use your records to train AI models that serve anyone else.Your records power your workspace and nothing else.
Our Privacy Notice names the AI providers we use. A current list of all service providers who process customer data is available on request at privacy@recaptured.io; a published list follows with our data processing agreement.
Recording consent
Before a meeting is recorded, every participant, including external guests, is asked, and each consent is time-stamped on the record. Some states and countries require every party to agree before a conversation is recorded; the product is built to help you ask, not to decide for you. Determining and obtaining the consent your jurisdiction requires remains your responsibility, and if a participant declines, the host can hold an unrecorded meeting instead.
Where we stand on certifications
SOC 2 and ISO 27001: on our roadmap, not certified today. We do not claim compliance with any framework, and we do not currently accept protected health information (see our Terms of Service). We'd rather tell you that plainly than imply otherwise. The controls above are in the product: MFA, roles, audit logging, access recertification, retention and privacy-request handling, and operator-access logging. These are controls, not a certification, and we say so in writing on request. Certification is the next step, not a substitute for them.
If your organization needs specific controls, a data-handling agreement or a security questionnaire, bring it to your call or write to security@recaptured.io. We'll walk through it honestly.