Security
Your graph is your business.
Consellations holds some of the most sensitive information a company has: customer conversations, deal terms and contacts. Here's how we protect it.
Pre-launch version. This page describes current practices and will be reviewed before launch.
Infrastructure
- The application runs on Vercel's serverless platform in the United States, and data is stored in Neon managed Postgres.
- All traffic is encrypted in transit with TLS 1.2 or later. Data at rest is encrypted by our hosting providers with AES-256.
- Secrets, such as calendar connection tokens, are additionally encrypted at the application layer before storage.
Accounts and access
- Passwords are hashed with scrypt and never stored in readable form. Google sign-in is supported.
- Sessions use secure, HTTP-only cookies.
- Workspaces have roles and permissions down to record type and field level, so people see only what their role allows.
- Every change to a record is logged with who made it and, for AI suggestions, the source sentence it came from.
Meeting recordings
- No bot joins your calls. The Mac app captures audio on your own computer and streams it for transcription using short-lived tokens. Our long-lived provider keys never leave our servers.
- Audio is used to create a transcript. By default we don't keep the audio after transcription.
- You're responsible for telling participants a call is being recorded where the law requires it. The app reminds you.
AI and your data
- We send notes and transcripts to AI providers only to deliver features you use, such as summaries, suggested updates and answers.
- Our AI providers don't use your data to train their models under our commercial terms.
- Every change an agent makes passes one commit process: checked, sourced and recorded with who made it. Any change can be undone.
Vendors
We use a short list of carefully chosen subprocessors. See the current list.
Report a vulnerability
If you believe you've found a security issue, email security@consellations.com. Please give us a reasonable time to fix it before any public disclosure. We won't take legal action against good-faith research that respects our users' privacy and data.
Enterprise
Enterprise plans include SSO, a data processing agreement and help with your security review. Talk to sales.