Security & your data
Last updated: July 30, 2026 · Coommit is operated by TAAO Inc.
The short version. Your rooms are private and reachable only by link or invitation. Files you upload are stored in private buckets that have no public address. Coommit never trains any model on your content — and when Echo talks to an AI provider, which provider and under whose terms is a choice you make and can see. You can delete a room, a recording, or your whole account yourself.
Where your data lives
Coommit runs entirely on Google Cloud. The application runs on Cloud Run, your content is stored in Cloud SQL (PostgreSQL) and Cloud Storage, and Google encrypts data at rest across those services by default. We don't run servers of our own anywhere else.
We're a US company (Delaware) serving customers on both sides of the Atlantic, and our infrastructure spans US and EU regions. If the exact storage region matters for your compliance review, ask us and we'll tell you precisely which region your workspace sits in rather than guess in a marketing page.
Encryption
- In transit, to and from you — the app and API are HTTPS only, real-time updates ride an encrypted WebSocket, and live audio and video use WebRTC's mandatory DTLS-SRTP encryption. Every connection between your browser and us is encrypted.
- Inside our own infrastructure — our servers talk to the database and to file storage over Google Cloud's encrypted internal paths. One internal hop is not TLS today: the Redis instance our servers use to pass real-time events between themselves runs on Google Cloud's private network without transport encryption. It is not reachable from the internet, but we would rather list it than let "everything is encrypted" stand as a blanket claim. It is on the fix list.
- At rest — database, file storage, and recordings are encrypted at rest by Google Cloud.
- Your AI keys — if you connect your own AI provider key, we encrypt it with AES-256-GCM before it touches the database, and it is never written anywhere in plain text. It is decrypted in memory only, when it is needed, and held in a short-lived process cache so we are not decrypting it on every keystroke. A restart or a change to your key clears it; a long live voice session holds it for the length of that session.
What this is not: Coommit is not end-to-end encrypted. Live audio and video pass through our media servers, which have to decrypt them to route the call and to run transcription. Anyone who tells you a browser-based meeting tool with recording and AI features is end-to-end encrypted is either wrong or selling you something. We'd rather say it plainly.
Who can get into your room
- A room is reachable by its link or by an emailed invitation. There is no public directory and rooms are not indexed by search engines.
- Guest links expire — they are not permanent keys to your workspace.
- You can see who is in the room at all times, and as the room owner you can remove someone.
- Recording is never silent: when a session is being recorded, everyone in the room sees it.
Your documents and our AI
This is the part people ask about most, so here it is in full.
- We do not train any model on your content. Coommit trains no models, fine-tunes nothing, and builds no dataset out of your rooms.
- Echo, our in-call assistant, runs one of two ways, and you choose which.
· Your own key (BYOK) — you paste a key from Anthropic, OpenAI or Google in Settings, and requests go to that provider under your account and your terms. This is the mode we recommend, because it means your prompts are governed by a contract you signed rather than one we signed.
· Prepaid credits — if you top up a credit balance instead, requests are routed through OpenRouter on a Coommit key and debited from your balance. Convenience for a Coommit key: worth knowing, and worth choosing deliberately.
With neither a key nor a balance, Echo declines and asks you to pick one. It never silently spends on your behalf and it never silently sends your data somewhere you didn't choose. - Because Echo needs context to be useful, the relevant part of your transcript and canvas is sent to the provider you selected when you ask it something.
- Two honest caveats. Some providers treat free-tier API keys differently from paid ones, and a few may use free-tier traffic to improve their models — that is their policy, not ours, so if it matters to you use a paid key and read their terms. And in credits mode, OpenRouter is in the path and sees the prompt; it is listed as a sub-processor below.
Audio, transcripts and recordings
| What | Stored? | Notes |
|---|---|---|
| Live meeting audio | No | Streamed for transcription as the call happens; the audio itself is not written to storage. |
| Text transcript | Yes | Kept with the room so you can search and reuse what was said. Room owners can turn transcription off entirely. |
| Recordings | Yes, if you record | Only when someone starts a recording. Stored in a private bucket; you can delete them (see the retention note below on what "delete" guarantees). |
| Canvas, files, chat | Yes | That's the product — a room that remembers. Files sit in private buckets served through short-lived signed links, never a public URL. |
How long we keep things
We keep your content for as long as you keep it. There is no automatic expiry today — we'd rather tell you that than publish a retention promise our servers don't enforce. What that means in practice:
- Delete a room and its content goes with it — canvas, chat, transcript, and the links to its files.
- Delete a recording and it disappears from your account.
- Delete your account from Settings and we immediately hard-delete your database records — rooms you own, chat, transcripts, notes, recording entries, everything that cascades from your user row. There is no grace period and no soft-delete, so it cannot be undone.
One limit, stated plainly — and it applies to all three of those. Deleting removes the record immediately and completely: nothing is listable, no link works, no account can reach it. What we cannot yet promise is that the underlying file has been erased from cloud storage in the same instant. Our delete paths ask the storage layer to remove the object, but they do not block on it or retry, so a transient storage error can leave a blob behind with nothing pointing at it. Unreachable is not the same as erased, and we would rather write that sentence than let you assume the stronger one.
If you need certified erasure of stored files — a GDPR request, an end-of-engagement clause, a client audit — email hello@coommit.com and we will do it by hand and confirm it to you in writing. A durable purge queue with retries, and automatic retention limits, are both on the fix list; when they ship we will say so here, with the numbers.
Who else touches your data
Always in the path:
| Who | What they get |
|---|---|
| Google Cloud | Hosting, database, file storage, speech-to-text and text-to-speech. Effectively everything, because it is our infrastructure. |
| Metered | TURN relay servers for WebRTC. Relays call media when a direct path is blocked by a firewall. |
| Resend | Transactional email — your address and the contents of the email itself. |
| Sentry | Error reports: stack traces, browser and page context. |
| PostHog | Product analytics — which features get used, tied to your account id. Not your canvas, not your transcripts. |
| Stripe | Payments. Card details go to Stripe and never to us. |
Only when you opt in:
- OpenRouter — only if you use prepaid credits instead of your own AI key. It then receives the prompt and context Echo sends.
- Anthropic / OpenAI / Google AI — only if you connect your own key, and then under your own account with them.
- Browserbase — only if you open a shared browser inside a canvas. It sees the pages you browse in that panel.
- Google Calendar, Calendly, Slack, Notion, Figma — only if you connect them yourself, and only the scopes you grant.
We don't sell data to anyone, and we don't run advertising networks on your content. If you spot something in the product that implies a vendor we haven't listed here, tell us — that is a bug in this page and we want to fix it.
What we don't claim
Coommit is a young product from a small team, and the fastest way to lose your trust would be to imply otherwise.
- We are not SOC 2, ISO 27001, or HIPAA certified. We haven't started those audits.
- We are not end-to-end encrypted, for the reasons above.
- We do not yet offer customer-managed encryption keys or a signed DPA with named sub-processor SLAs. If your procurement process requires one, talk to us — we'd rather have that conversation than have you assume.
If any of these is a blocker for you, tell us. Knowing which one actually stops a deal is more useful to us than a badge on a page.
Found a security problem?
Please tell us before you tell anyone else, and we'll work with you. Write to security@coommit.com — details and preferred languages are in our security.txt. We don't run a paid bounty programme yet, but we do credit people who help us.
Questions
Anything not answered here: hello@coommit.com. See also our Terms of Service.