Security at CallScribe

Our security posture, encryption model, access controls, data handling practices, and responsible disclosure program.

Encryption at Rest

All audio files and transcripts are encrypted at rest using AES-256 via PostgreSQL's pgcrypto extension. Encryption keys are stored in a separate environment variable source (never in the database), rotated quarterly, and validated at application startup — a missing or invalid key causes the API to refuse to start rather than silently fall back to plaintext. This is tested by the CI pipeline.

Encryption in Transit

All traffic between the browser, API, worker, and database flows over TLS 1.3. HTTP requests are redirected to HTTPS at the edge. Strict-Transport-Security (HSTS) is enabled with a two-year max-age and includeSubDomains. Internal worker-to-API traffic runs over a private Tailscale mesh, so even inter-datacenter hops are encrypted and authenticated.

Tenant Isolation

Multi-tenant isolation is enforced at the database layer using PostgreSQL row-level security (RLS). Every query runs inside a transaction that sets a tenant context, and every table with tenant-scoped rows has an RLS policy that filters by that context. This means a bug in the application layer cannot leak data across tenants — the database itself will refuse the query.

Access Controls

  • JWT-based authentication with short-lived access tokens and rotating refresh tokens.
  • Per-route rate limiting backed by Redis, with progressive penalties on auth-failure IPs.
  • Audit logging on all privileged endpoints.
  • Password hashing with bcrypt at cost factor 12.
  • Optional SSO (SAML / OIDC) for enterprise customers.

Infrastructure

CallScribe runs on Hetzner Online infrastructure in Germany and Finland. The control plane (API, PostgreSQL, Redis, nginx) lives on a dedicated VPS; the GPU workers run Whisper large-v3-turbo and pyannote on either our own GPU nodes or customer-provided hardware connected over Tailscale. Letsencrypt TLS certificates are auto-renewed.

Secure Software Development

  • Dependency scanning on every pull request.
  • Typed codebase (TypeScript + Python type hints).
  • Tests gate every merge to main.
  • Staging environment mirrors production before any deploy.

Incident Response

CallScribe has a documented incident response playbook covering detection, triage, containment, eradication, recovery, and post-mortem phases. Customers are notified of a personal data breach within 72 hours as required by GDPR Article 33.

Data Handling & Retention

Audio files uploaded to CallScribe are processed on private infrastructure and never leave the processing pipeline. Completed transcripts are stored in PostgreSQL with AES-256 encryption. Default retention is 90 days, configurable per-account down to 1 day. When a user deletes a file or closes their account, the audio blob, transcript text, diarization output, and all derived analytics are hard-deleted from the database and object store within 24 hours. No copies are retained for training or analytics purposes.

Compliance Alignment

  • GDPR: CallScribe publishes a Data Processing Agreement (DPA) covering Article 28 processor obligations, sub-processor disclosures, 72-hour breach notification, and data deletion on termination.
  • UAE PDPL: All processing runs on EU-hosted infrastructure (Hetzner, Germany) with optional GCC-resident workers. No audio is routed through US data centers.
  • SOC 2: Not yet certified. Roadmap item for Q3 2026.
  • Sub-processors: Stripe (billing), Resend (transactional email), Sentry (error telemetry), Hetzner (hosting), Tailscale (private mesh networking). No sub-processor receives audio or transcript data.

Network Security

The CallScribe control plane runs behind a hardened nginx reverse proxy with TLS 1.3 and HSTS (2-year max-age). GPU workers connect to the API over a private Tailscale mesh — no transcription traffic traverses the public internet. All ports except 80/443 are firewalled at the host level. SSH access requires key-based authentication; password login is disabled. DNS is managed through Cloudflare with DNSSEC enabled.

Responsible Disclosure

Security researchers are welcome. Report vulnerabilities to security@callscribe.ae. We will acknowledge within 48 hours, triage within 5 business days, and credit reporters in our public security advisories unless anonymity is requested. Please do not publicly disclose until we have had a reasonable opportunity to patch.