How Troopa keeps your meetings safe

At a glance

Where your meetings are kept

Each region, the United Kingdom, the European Union and the United States, runs its own copy of Troopa on Amazon Web Services, with its own database on MongoDB Atlas in the same place. An organisation’s meetings are stored in the region it chose when its account was created, and Troopa does not move them to another. The processes of one region can open only that region’s database, and they sign in to it with their own AWS identity rather than a password.

Some processing happens outside the region while a meeting is dealt with: the AI models are reached in the United States, and a UK organisation’s audio is transcribed in Europe. The data residency page says exactly what goes where, and the sub-processors page names the companies.

Who can see a meeting

A meeting, and everything made from it, is seen by the person who recorded it and the people they share it with, whatever anybody’s role. An organisation’s owners and administrators run its settings and its people, and they cannot open somebody else’s meeting unless it is shared with them. People a meeting is shared with can read it and cannot change it. A meeting shared by link can be opened by whoever has the link, and any share, a link included, can be stopped at any time.

If an old sign-in token is ever used a second time, as a stolen one would be, every session from that sign-in is ended.

Encryption and secrets

Everything between your computer and Troopa travels over TLS 1.2, and a plain connection is redirected to an encrypted one. The tokens that connect a calendar, a Zoom account or an app a person connects to Troopa, such as Notion or Google Drive, the secrets for signing in with another provider, and the keys for the services Troopa uses are sealed with AES-256-GCM under a key held only in the region, before they are stored. A connected app’s tokens are deleted when the person disconnects it or leaves the organisation, when their account or the organisation is erased, and after a year without use. Passwords are stored only as Argon2id hashes, and sign-in tokens and meeting links only as hashes of themselves, so a copy of the database holds no password, token or link that could be used as it stands.

What is kept, and for how long

• No recordings. Troopa keeps no audio or video of a meeting. The desktop app streams the audio for transcription and writes none of it to your computer’s disk: if the connection drops, it holds at most five minutes in memory until it is back.
• No pictures of the screen. When what is shared on screen changes, a picture of the meeting window is read by the AI and a short note of what was shared is kept. The picture is not. A question asked during a call can go with a picture of the meeting window or, when there is none, of the whole screen the pointer is on. It is read to answer the question, and not kept either.
• Transcripts, for a set time. An organisation’s owners and administrators choose how long transcripts are kept: 365 days unless they choose otherwise. After that the transcript, the search index made from it and what was asked of Troopa during the call are deleted. The notes, decisions and actions stay until the meeting is deleted.
• Deleting a meeting deletes its transcript, notes, search index, shares and any document attached to it alone, at once, and any decision recorded only in that meeting. A deleted document’s file can remain in Troopa’s file storage in the region for up to 35 days. Minutes already sent by email stay in the recipients’ mailboxes. A meeting is deleted by the person who recorded it: owners and administrators can delete their own, and members can where the organisation allows it.
• Documents for a meeting not yet held. A document added while preparing a meeting is deleted if no meeting uses it within 30 days.
• Connected apps. Troopa copies nothing from the apps it searches for a person. An answer Troopa keeps for them keeps the title, link and a short excerpt of each passage it cites. The Obsidian notes a person sends Troopa are kept in the region as their own documents.
• Erasing an organisation deletes its meetings and its records in its region, its audit log included. Its owner can ask for it at support@troopa.ai.

The audit log

Every organisation has its own audit log. It records sign-ins and failed sign-ins, people invited, removed or given another role, changes to settings, meetings shared and shares stopped, exports, erasures, calendars, Zoom accounts and other apps connected and disconnected, and every time our console replayed a meeting’s record of events. Nothing in Troopa can change or remove an entry. It is kept for as long as the organisation exists, and its owners and administrators can ask us for a copy. What our support does in a person’s account, and our staff reading a person’s meetings in our console, are recorded in a log of our own instead, as the next section says.

Our own access

We read customer content only where running the service or answering a customer’s request needs it. To help with a problem, our support can sign in to a person’s account in our own Troopa app. That needs a written reason and a fresh confirmation of who we are, starts from a link that works once within five minutes, and lasts an hour at most. The session sees what the person sees, their meetings included. It cannot record, change how they sign in, their billing, people, calendars or connected apps, search their connected apps, or delete their account.

Our staff can also read a person’s meetings in our console: the transcript, what was asked of Troopa, the minutes and the list of documents, each time with a written reason. Every support session, with what it changed, and every such reading is recorded in the person’s region, in a log only we can read. They are not written to the organisation’s audit log, and we do not tell the organisation each time.

What Troopa never does

Troopa does not create, store or compare voiceprints: it names speakers from the meeting app’s list of people and its speaking indicator. It does not score anybody’s mood, engagement or tone. A test in the product fails if code for either appears. And we do not train AI models on your meetings.

The desktop app

The Mac app is signed and notarised by Apple, and the Windows installer is signed by Tellme AI Limited. The app keeps no recordings on your computer, and keeps transcripts and notes there only in local mode, where the organisation allows it. It keeps copies of the decks and PDFs it shows, up to about 2 GB for each account, and removes them when the person signs out. Every build is on the downloads page.

Questions