MirrorCaption trust
How we handle your data
Privacy posture, partners, sub-processors — at a glance.
Last updated: June 5, 2026
Our privacy posture
MirrorCaption is built so most of what matters to you never leaves your device. Below is what we do, who we depend on, and what each party touches.
- Live audio is never stored on our servers. Voice streams directly to our speech-to-text provider, is transcribed in real time, and is discarded. Optional local recording is off by default; when enabled, recordings stay only on your device.
- Transcripts stay on your device. Sessions, settings, and any bring-your-own API keys live in your browser's IndexedDB, encrypted at rest.
- Ephemeral credentials. Speech-to-text tokens are minted per session with a 2-second time-to-live.
- Consent before any tracking. Analytics and support chat load only after explicit cookie consent.
Partners & processors
We carefully select vendors with recognised, independently audited certifications and rely on their established compliance controls. At the same time, we apply diligent internal processes and rigorous quality controls to keep data handling lawful and compliant — with security as our top priority. The table below is the categorical view required by GDPR Art. 13(1)(e).
| Vendor | Role | Region | Certifications |
|---|---|---|---|
| Supabase | Authentication & database | EU | SOC 2 Type II, HIPAA |
| Stripe | Payment processing | US / Ireland | PCI DSS Level 1, SOC 1, SOC 2 Type II |
| Vercel | Application hosting & edge | Global edge | SOC 2 Type II, ISO 27001, HIPAA |
| Cloudflare | Edge networking | Global edge | SOC 2 Type II, ISO 27001, PCI DSS |
| Sentry | Error monitoring (consent-gated) | EU | SOC 2 Type II, ISO 27001 |
| OpenAI | Voice processing | US | SOC 2 Type II, CSA STAR |
| Product analytics (consent-gated) | US / EU | SOC 2, ISO 27001, ISO 27018 | |
| Soniox | AI service | US | SOC 2 Type II, ISO 27001, HIPAA |
Data Processing Agreements & updates
Customers under a paid plan can request a Data Processing Agreement by emailing info@mirrorcaption.com. The DPA discloses specific provider entities, contracted regions, and contact details.
Material changes to this page are announced in-product and reflected in the "last updated" date above. Customers under an active DPA receive sub-processor change notices per their DPA terms.