Client context deserves clear boundaries.

Our security posture, and our providers’

We describe our security plainly. We build on established infrastructure providers and add our own controls on top: isolation, access control, encryption of sensitive credentials, private storage, auditing and human approval for consequential actions.

Workspace and tenant isolation

Every customer works inside a workspace. Separation between workspaces is enforced by the database itself through row-level security, so a query made on behalf of one workspace cannot read or change another workspace’s rows, even if application code made a mistake. Isolation is part of our automated test suite and our release checks, including tests that try to cross workspace boundaries and must fail.

Inside a workspace, restricted clients can be limited to the members who should see them.

Sign-in, roles and permissions

• Passwords are stored only as salted hashes produced with a modern memory-hard algorithm; we never store them in readable form.
• Sign-in attempts are rate limited, and failed attempts are logged.
• You can see your active sessions and sign out of any of them.
• Email addresses are verified, and team invitations are emailed directly to the person being invited.
• Workspaces use five roles (owner, administrator, manager, employee and viewer) and every sensitive action checks the role’s permissions on the server.

Firms that need single sign-on can talk to us about Enterprise.

Encryption

• In transit: connections to the LYNORIQ app, our API and our storage use HTTPS/TLS.
• At rest: our database and object-storage providers encrypt stored data at rest as part of their platforms.
• Connected-account tokens: credentials for connected services are additionally encrypted by LYNORIQ before they are stored, and the encryption keys are kept outside the database.

We do not describe LYNORIQ as end-to-end encrypted: to transcribe and analyse your meetings, our service processes their content.

Recordings and file storage

Meeting recordings and generated files are kept in private storage. They are never publicly listed; playback and downloads use signed links that expire after a few minutes and are issued only to signed-in members who have access to that meeting.

Workspaces can choose to process a recording and then delete the audio, keeping only the transcript and the intelligence derived from it.

Connected accounts

• Connections such as Outlook use the provider’s official OAuth sign-in. LYNORIQ never sees or stores your Microsoft password.
• Access is requested step by step: reading comes first, and permission to send email or change your calendar is requested only if you turn those actions on.
• Tokens are handled only on our servers and are never sent to your browser.
• When you disconnect an account, LYNORIQ asks the provider to revoke access and deletes the stored credentials.
• For Outlook, LYNORIQ decides whether a message relates to one of your clients from its participants before reading any text. Messages that are not relevant are never stored.

AI safeguards

• Evidence first: extracted commitments, numbers, dates and decisions must be supported by what was actually said or written. Uncertain items are marked for review instead of presented as fact.
• Sources: every insight links back to the moment in the transcript or the email it came from, and Ask LYNORIQ says when the evidence is missing.
• Suggestions, not silent changes: likely client matches are suggestions with their evidence, and you can confirm, reject or undo them.
• Your content and model training: LYNORIQ does not use your content to train AI models. Every transcription request opts out of the provider’s model improvement, and our language-model provider’s terms do not allow it to train on the data we send.

Human approval for consequential actions

LYNORIQ can prepare a follow-up email or a calendar event, but it does not send or schedule anything on its own. You review the recipients, wording and timing first. When you approve, the server checks that the action is exactly the one you reviewed, that you are the person approving it and that your consent is current; only then does it act, once.

Audit logging

LYNORIQ records security-relevant events in an audit log, including sign-ins, failed sign-in attempts, password changes, invitations, role changes, member removals and permanent deletions. Audit records contain identifiers and outcomes, never the content of your conversations. Our application logs follow the same rule.

Retention, export and deletion

• Retention settings: each workspace chooses how long meetings are kept, from deleting audio right after processing to keeping meetings until you delete them.
• Permanent deletion: you can permanently erase a meeting. That removes the recording, the transcript, the summaries and every item extracted from it. What remains is a content-free record that a deletion happened.
• Export: members with export permission can download meetings and transcripts as structured JSON.
• Account or workspace deletion: contact privacy@lynoriq.com and we will delete the workspace and its content.

Details, including how backups are handled, are in our Privacy Policy.

Who processes your data

Service	What it does for LYNORIQ
Database	Managed database for your workspace’s records
Hosting	Runs the LYNORIQ application
File storage	Private storage for recordings and files
Transcription	Turns meeting audio into text
Language models	Analyse transcripts and email to find what was agreed
Email delivery	Sign-in and invitation emails
Microsoft	Outlook mail and calendar, only if you connect it

The full list of subprocessors and what data each receives is in the Privacy Policy.

Responsible disclosure

If you believe you have found a security vulnerability in LYNORIQ, please email security@lynoriq.com with enough detail for us to reproduce it. We will acknowledge your report, keep you informed and credit you if you wish.

Please act in good faith: do not access or change other people’s data, do not degrade the service, do not use social engineering or physical attacks, and give us reasonable time to fix an issue before disclosing it.

For privacy questions, write to privacy@lynoriq.com.