What Dot does with your meeting, in specific terms

What we store

Transcripts, not recordings. By default no audio or video is retained at all: audio is transcribed and discarded, and the transcript is what remains. Recording is available where a customer requires it and is off unless they turn it on.

Chat messages the bot can see, the participant list, and the minutes derived from them. Nothing else from the meeting.

Where it lives

Each region is a complete, independent stack: its own database, its own storage, its own keys, its own compute. An organisation picks its home region when it signs up and is never moved without being asked.

Customer content does not cross a regional boundary, for any reason. Only three things are global, and none of them is content: which region a tenant lives in, billing, and this website.

London is not a European Union region. If you need European Union processing, choose the European Union region. We will not tell you the United Kingdom is the same thing.

What we will never do

No voiceprints, no speaker embeddings, no voice-based identification, ever. Identity comes from the meeting platform’s own identifiers and from the calendar. This keeps us outside biometric law rather than inside it with a policy on top, and it is enforced by a build-time check rather than a promise.

No sentiment, engagement, stress or emotion scoring. Inferring emotion at work is prohibited in the European Union, and there is no setting to enable it because the capability does not exist in the product.

We do not train models on your meetings.

Access control

Deny by default. Every endpoint declares the permission it requires, and a test fails the build if any endpoint declares none, which is what stops authorisation rotting as the surface grows.

Permissions are scoped, so somebody can administer one project and merely read another. Access to meeting content comes from membership alone, never from how confident we are about who someone is.

Single sign-on with Entra ID and Google Workspace, and provisioning that also deprovisions when someone leaves.

Authentication

Argon2id password hashing, email verification before anything can be created, and time-limited single-use reset tokens compared in constant time.

Short-lived access tokens with rotating refresh tokens and reuse detection: if a stolen refresh token is used, the whole family is revoked and every session ends.

Multi-factor authentication, enforceable for everyone or for admins only. An organisation can disable password login entirely and require single sign-on.

Configurable to your policy, never below ours

Password rules, breach checking, lockout behaviour, session lifetimes and multi-factor requirements are all set per organisation. An organisation may be stricter than our floor and can never be weaker.

Breach checking uses a range query, so no password and no complete hash ever leaves our infrastructure.

Password expiry exists because some customers’ own policies still demand it, and is off by default because forced rotation makes passwords worse rather than better.

Audit and evidence

An append-only audit log covering sign-ins, permission and role changes, security policy changes, settings changes, exports, support impersonation, and access to meeting content. Exportable.

Notice is evidence too. Every disclaimer shown is recorded with what was shown, when, and who was in the meeting at the time. If we are ever asked whether a room was told, the answer is a query rather than an argument.

Deletion

Erasure is a query by design. Every stored fragment carries the identifiers needed to find it, so deleting a person or a meeting cascades through transcripts, search indexes, extracted decisions, minutes and logs.

Backups expire on a documented schedule rather than being claimed to delete instantly, because that claim would not be true.