Security and privacy

Security & Trust

You are handing us a recording of a real conversation. Here is exactly what we do with it.

No claim on this page is a plan or an aspiration. Everything below is how X-Scribe by Xipp behaves today. The privacy policy has the full details.

Six promises, all true today

Each one is also covered in the privacy policy.

Your meetings never train AI models

X-Scribe does not use your audio, transcripts or notes to train AI models, and does not sell your data. Transcription runs on Google's paid Gemini API, under whose terms Google does not use the content to train its models. Gemini receives only what the meeting needs (audio, transcript, names, the title, context and documents you entered, and for interviews the resume), never your browsing history or other tabs, and a whole-recording upload is deleted as soon as it is transcribed.

No model training

Encrypted in transit

Audio and notes travel over HTTPS. Every request needs a signed-in session or a key, and a key only reaches its own workspace. Passwords and sign-in codes are stored hashed, codes are single use and expire after 10 minutes, and repeated failed sign-ins are rate limited.

HTTPS everywhere

Stored privately

Transcripts, notes, cues, speaker names and voice samples are kept in our database. Recordings are stored privately: in Amazon S3, with encryption at rest and short-lived signed links, where it is configured; otherwise on our own server.

Private storage

Bring your own AI key

A workspace can choose to use its own Gemini API key. Transcription and notes then run on that key, and Google's terms for that key apply.

BYOK

Recordings are deleted after 30 days by default

Recordings (the audio) are deleted automatically 30 days after the meeting by default. Transcripts, notes and voice samples stay until you delete the meeting or your account. Deleting a meeting removes its transcript, notes, cues, speaker names, voice samples and recording straight away, including audio still uploading or being processed.

30-day audio

Recording is always visible

In the extension and the web app, X-Scribe starts recording only when you press Start, and shows a red REC badge on the extension icon and on the page the whole time. Recording stops when you press Stop, close the tab, leave the call or stop sharing the tab. Telling the other participants, and getting consent where the law requires it, stays with the person recording.

No hidden capture

Want every detail?

The privacy policy covers what is collected, where it is kept, who processes it and how to delete it.