Security

What leaves the room

The Frasiey app opens the microphone you choose on the room's own computer, and the speech becomes text on that computer. Only the text is sent to us. There is no recording and no upload, and there is no way for us to listen to a room.

So there is no audio for us to lose, to disclose, or to be compelled to hand over. It was never ours to hold.

In transit

Every connection is encrypted in transit: the room laptop to us, your browser to us, and an attendee's phone to us. Nothing about a meeting travels in the clear.

Every account's data is its own

Every meeting, room, laptop and transcript belongs to the account that made it, and every request is checked against the account it claims to come from. A request for another organisation's meeting is answered as if it did not exist. Not "you are not allowed", which would confirm that the meeting is there: nothing, as though there were nothing to find.

Signing in, and the room laptop

Signing in is a six-digit code sent to your email address. It lasts ten minutes, and we store a scrambled copy of it rather than the code itself, so the code cannot be read back out of our database.

A room laptop is paired the same way. Its credential is handed over exactly once, when the laptop is paired, and what we keep is a scrambled copy. Any laptop can be cut off from the dashboard, and it stops captioning at once.

How long the words are kept

Each meeting chooses: a number of days, or until somebody deletes the meeting. Where a meeting chooses a number of days, its transcript is removed from the archive when that day comes. Where a meeting sets no limit, its words are kept until the meeting or the workspace is deleted. The copy in our working database is dropped 14 days after the transcript is archived, whichever the meeting chose.

An owner can delete a whole workspace from account settings. It closes at once, and everything in it, meetings, rooms, laptops and transcripts, is deleted within 30 days. Owners can reopen it during those 30 days.

No trackers

No advertising cookies, no analytics, no profile of anybody who reads captions on their phone, and nothing sold to anybody. Two cookies exist and both are needed to sign in; they are listed on the privacy notice. Attendees need no account, no app and no sign-in, so there is nothing to hold about them.

Our providers' certifications

Frasiey runs on a host that holds ISO 27001, ISO 27701 and SOC 2 Type II certification for its platform. Where a meeting turns on an optional feature that uses an outside service, such as correcting names and terms, that text goes to a provider that holds SOC 2 Type II, ISO 27001 and ISO 42001.

Those are our providers' certifications.

If your procurement team needs a particular questionnaire answered, tell us which one and we will help.

Telling us about a problem

If you find something wrong, write to security@frasiey.com. We read it, we reply, and we do not pursue anybody who reports a problem in good faith.

If we learn of a breach affecting your data we will tell you without undue delay, and the relevant authority within 72 hours where the law requires it.

The paperwork

Our data processing agreement is written out in full and is already signed on our side. The companies that handle data for us are named, with what each one does and where, on our providers page. What we hold and why is on the privacy notice.

Written to be checked · 2026