Security

incogno is built to hold as little of your meeting content as possible:

• Raw audio is never stored. Meeting audio streams transiently to our speech-to-text providers for live transcription; the optional deep-analysis upload is deleted right after processing.
• Screen features send extracted text by default — screenshots are uploaded only by the explicit screen-vision feature, processed ephemerally, and never stored.
• Assist prompts and answers are not stored. We keep only usage metadata (model, token counts, latency). Transcripts persist only when you save a summary or run deep analysis — and you can delete them anytime.
• Meeting content never enters shared response caches. Only standalone coding/definition answers with no transcript or screen context are cacheable.

• All traffic is encrypted in transit with TLS (HTTPS).
• Passwords are stored only as salted hashes — never in plain text.
• Web sessions use HttpOnly cookies with short-lived access tokens and rotating refresh tokens; you can view and revoke active sessions from your account page.
• Optional multi-factor authentication (TOTP) with single-use recovery codes.
• Signup requires email verification; password resets use single-use, expiring links.

The service runs on Google Cloud Platform (Cloud Run, Singapore region) behind our own hardened edge server with TLS termination (Cloudflare provides authoritative DNS), with data stored in our managed database cluster. Production access is restricted to authorized operators, rate limits and abuse detection protect authentication and billing endpoints, and payment card data is handled entirely by our PCI-DSS-compliant payment processor (Razorpay) — it never touches our servers.

We review the data-handling terms of every provider before use. We use business/API offerings and configure AI and speech-to-text providers, where supported, not to use submitted content to train general-purpose models — per-provider details, data involved, and processing locations are maintained at incogno.ai/subprocessors.

If a personal-data breach creates a legal notification obligation, we will notify affected users and the relevant authorities as required by applicable law, with plain-language detail about what happened, what data was involved, and what we are doing about it. For incidents in scope of India's CERT-In directions, we report to CERT-In within the mandated timeline and retain security logs for the required period. We are preparing our incident-response, logging, and retention practices for the requirements that will apply under India's DPDP framework as its provisions take effect.

If you believe you have found a security vulnerability in incogno, please report it to security@incogno.ai with enough detail to reproduce the issue. We ask that you give us a reasonable window to fix the issue before public disclosure, and that you avoid accessing other users' data. We do not pursue good-faith security research conducted under these guidelines.

Keep your device and OS updated, use a strong unique password (and MFA), and revoke sessions you don't recognize. Questions about our security practices: support@incogno.ai. For how we handle personal data generally, see the Privacy Policy.