Regcall
EN IT
Sign inRequest an invite

Security

How we protect your meetings

Calls are full of clients and prices. This page lists, one by one, the measures Regcall applies today to protect what you record. For what data we process and why, read the privacy policy.

Last updated:

  • Data stored in the EU
  • Password and code sign-in, for every account
  • Zero data retention AI models, by default
  • A separate archive for each person
  • Share links with a password and an expiry date
  • Always encrypted connections, with HTTPS and HSTS

Where your data lives#

  • Recordings, transcripts and notes are stored on Regcall's servers in the European Union, in Germany and Finland, with Hetzner Online GmbH.
  • Traffic goes through Cloudflare's network, encrypted between your browser and Cloudflare and between Cloudflare and our servers. Cloudflare carries the traffic without storing its content.
  • The Chrome extension sends data only to dashboard.regcall.app and records only the call tab, never other tabs or the rest of your screen.

Zero data retention AI models#

By default, transcription and meeting notes go through OpenRouter and model providers in the United States, only on zero data retention endpoints: they process the call to return the result, then keep nothing and never train on it.

  • Regcall asks for this on every request, with the conditions zdr: true and data_collection: deny.
  • If the chosen model has no zero data retention endpoint, the request stops with an error. It is never retried without these conditions.
  • If you connect your own provider for meeting notes, data retention follows your agreement with that provider. Transcription always stays on zero data retention endpoints.

Signing in#

  • Every account signs in with a password of at least 12 characters and a 6-digit code from an authenticator app. The code is required for everyone, administrators included.
  • Accounts are created by invitation only. There is no public sign-up.
  • After 5 wrong attempts the account locks for 15 minutes. After 20 failed attempts from the same network, that network is locked out for 15 minutes too.
  • Passwords are stored with scrypt, a slow hash function. Sessions, invitations and extension keys are stored only as hashes.
  • The session cookie lasts 14 days and is HttpOnly, Secure and SameSite=Strict: scripts on the page cannot read it and other sites cannot send it.

One archive per person#

  • Each person has a folder of their own on the server, with their own database, recordings and settings.
  • In the dashboard, the administrator manages invitations and plans and sees only counts: number of meetings, minutes, storage used. They do not see other people's titles, transcripts or notes.
  • We access the content of your meetings only if you ask us to, for example to fix a problem, or if the law requires it.

Share links#

  • Every share link has a password of at least 8 characters, stored with scrypt, and can have an expiry date. You can revoke it at any time.
  • After 5 wrong passwords the link locks for 15 minutes.
  • Whoever opens the link sees only that meeting, read only. Video, audio and downloads are there only if you allowed them.
  • After the password, the link stays open for 12 hours in that browser, for that meeting only.

Connections and web pages#

  • The website and the dashboard use HTTPS with HSTS: after the first visit, for a year the browser no longer opens unencrypted connections.
  • A strict Content-Security-Policy allows only scripts and styles served by Regcall, plus Cloudflare Turnstile's anti-robot check on the invitation form and the sign-in page. No inline scripts, and the pages cannot be embedded in other sites.
  • No analytics services, no advertising networks, no third-party tracking.

AI agents and integrations#

  • Tokens for AI agents and the API are personal: read only or read and write, with the expiry you choose, stored only as hashes and revocable at any time. Creating one asks for your authenticator code again.
  • The addresses you choose, such as your iCal calendar or your own notes provider, must use HTTPS and are checked on every connection, so they cannot point into the server's internal network.
  • The calendar is read in an isolated process, with limits on time, memory and size. From your calendar Regcall keeps only the title, invitees, companies and agenda of the recorded meeting.

What you can do#

  • Delete any meeting, with its recording, transcript and notes.
  • Revoke share links, extension keys and agent tokens.
  • Download notes, transcripts, audio and video.
  • Choose who writes your meeting notes, or go back to the zero data retention default.
  • Ask for a data processing agreement (Article 28 GDPR) if you use Regcall for an organisation.

Incidents and reports#

No system is free of risk. If a personal data breach occurs, we notify the Italian data protection authority within 72 hours, where the law requires, and we tell you without undue delay if it is likely to put your rights at high risk.

Found a security problem? Write to [email protected]: we will reply and keep you posted.