security · nosy for you, no one else

Encrypted. Never sold. Never trains anyone else's AI.

I sit in your most sensitive conversations, so trust isn't optional, it's the product. Here's exactly how your data is protected, in plain language.

SOC 2HIPAAGDPR

*SOC 2 and HIPAA are not yet certified. We build on compliance-ready infrastructure and are working toward the formal reports, see our commitments below. GDPR is in force today.

Try me free for 14 daysSee our commitments ↓
Encrypted in transit & at restNever sold, never rentedNever trains anyone else's AI
the principles

Four promises. No asterisks.

Encrypted, always.

TLS in transit, encrypted at rest. On every plan. No exceptions.

Never sold.

Not sold, shared or rented. There's no second business model here.

Never trains others' AI.

Your conversations train nothing but your own experience with me.

Yours to take or delete.

Export everything, or wipe it, one click, on your command.

how your data is handled

Your conversations are yours. Full stop.

No fine print, no surprises. The six things your security team will ask about, answered up front.

Encrypted, always

In transit and at rest. Your meetings are locked down by default, on every plan.

Never sold

Your data is never sold, shared or rented. There is no second business model here.

Never trains others' AI

Your conversations never train anyone else's model. What's yours stays yours.

SSO & access control

SAML SSO, role-based access and audit trails on Enterprise.

You're in control

Delete a meeting, an account or everything, it's gone, on your command.

Compliance-ready

Built to meet the standards your security team will ask about. Details on request.

HeidiI'm nosy about your meetings so I can help, not so anyone else can. Big difference, and I take it seriously.

data lifecycle

Where your data lives, and dies.

Four stages, start to finish. Captured only when you choose, encrypted the whole way, used for you and no one else, and deleted the moment you say so.

replace · Heidi media
your data · lifecycle
CapturedOnly what you choose to recordyou decide
EncryptedStored encrypted, access-controlledlocked
Used for youTo make you sharper, nothing elsefor you
Deleted on demandOne click. Gone for good.wiped

HeidiNothing here is a trapdoor. You can follow your data the whole way, and end it whenever you like.

what happens to one sensitive call

The call that helped you, and trained nothing.

You take a hard renewal call, numbers, names, a frustration the customer hasn't said out loud anywhere else. The kind of conversation you'd never want leaking into a shared model. That's exactly the call this page is about.

The moment it's captured, it's encrypted, in transit and at rest. It's used to brief you, score the room, and draft your follow-up.✦ heidiEverything I learned here stays in your workspace. It sharpens you. It never becomes someone else's training data.No copy of it is sold, rented, or folded into a model anyone else will ever query.

A week later you decide you're done with that account's records. You hit delete.✦ heidiGone means gone, the meeting, the notes, the read. One click, no support maze, no retention trick.The data leaves the same way it arrived: on your command.

HeidiI'm built to make you sharper, not to feed someone else's AI. That's not a setting. It's the whole point of me.

honest about where we are

Certifications: our commitments, in progress.

We'd rather under-promise than fake a badge. Here's what we're building toward, stated as commitments, not claims.

SOC 2 Type IIIn progress

Not yet certified. We'll publish the report once it's complete, likely phrased as “built on SOC 2-compliant infrastructure” until then.

HIPAATo confirm

Targeting HIPAA-compliant infrastructure. Not asserted as done, the exact posture is being confirmed before any claim.

Encryption in transit & at restStandard practice

Industry-standard encryption for data moving to us and stored with us.

GDPR & EU data residencyBuilt in

GDPR principles by default, your content hosted in the EU, DPA available on request.

Status is intentionally honest. Nothing here is presented as a completed certification until it genuinely is. The exact status of each item (SOC 2, HIPAA, encryption details, sub-processors) is to be confirmed and published by the Heidi team, we won't claim a badge we haven't earned. Need specifics for a security review? Ask us directly.

eu-first, by default

Your data stays on this side of the ocean.

Europe isn't an afterthought here. Your data lives in the EU, under GDPR, with a DPA ready when your legal team asks.

Hosted in the EU

Your meetings, transcripts and account data are stored on EU-based infrastructure, not shipped off to another region behind your back.

GDPR by default

Built around GDPR principles from day one: lawful basis, data minimisation, your right to access, export and erasure, no dark patterns.

DPA on request

Need a signed Data Processing Agreement for your legal team? Ask us and we'll send one, a standard part of onboarding, not a fight.

the whole guest list

Every hand that touches your data.

A short, honest list of the services I rely on to work, what each one does, and why it's here. No hidden hands on your data.

  • Meeting-recording infrastructureCapture layerBrings Heidi into your calls to capture what you choose to record. SOC 2, HIPAA and ISO 27001 certified.
  • Cloud infrastructureHosting & databaseStores your account and workspace data in the EU.
  • AI providerThe reasoning enginePowers Heidi's analysis. Your data is never used to train AI models.
  • Voice providerSpoken repliesGenerates Heidi's voice. Used only to serve you the audio.
  • StripePaymentsHandles billing. Card details go to Stripe, we never see or store them.

The current list of sub-processors and their regions is confirmed and kept up to date by the Heidi team. Ask us for the latest before a security review.

HeidiThis is the whole guest list, no silent partners, no data brokers. If someone new ever joins it, you'll see them here.

you're in control

Stay because I'm worth it, never because you're stuck.

Your data follows your rules. Pull a full export whenever you like, or delete everything and walk, one click, no support maze, no retention tricks. That's the whole point of owning your data.

Try me free for 14 days
  • Export anytime. Everything you've got, in a portable format.
  • Delete in one click. Account and content gone, actually gone.
  • Revoke access. Disconnect any integration the moment you want to.
straight answers

Security questions, straight.

found something? tell us

Responsible disclosure.

Think you've spotted a vulnerability? Please tell us before you tell the world. Email the details and we'll look into it, keep you posted, and credit you if you'd like. Good-faith research is always welcome here.

info@hi-heidi.ai

Trust, by design.

14 days, the full me, €0 today. Encrypted, never sold, never used to train anyone else.

Try me free for 14 days
one last thing ✦

Still worried about your data? Ask me exactly what happens to it.

Ten seconds, and I'll go first.

Sound on, it's a real voice call