Security & data handling

Last updated: September 2026

This page describes, in plain language, how Recon Brief protects client data. The contractual commitments live in your agreement with us and in our Terms of Service and Privacy Policy.

What your data is used for

Client data is used for one purpose: producing your own deliverables. It is never analyzed, exported, shared, or used for any secondary purpose. The Service contains no analytics, advertising, or tracking of any kind.

AI processing

Transcripts are sent only to Anthropic's commercial API, whose terms prohibit using customer data to train models. No other AI provider is used. The API credential is readable only by the background processing service — the web application cannot access it.

Retention and deletion

Your uploaded transcript (and any OCR text made from it) is deleted from our storage the moment its outputs exist — on success, and equally on failure or cancellation. Every generated output — summaries, the topic matrix workbook, the highlighted transcript, and the run's forensic record — is deleted automatically 30 days after it was generated, enforced by the storage platform itself rather than a scheduled job that could fail to run. The highlighted transcript is a new document we generate, not a copy of your original, and it expires with the other outputs. Our permanent operational records hold no transcript content — only counts, statuses, and timestamps.

Encryption

All traffic is encrypted in transit with TLS 1.2 or higher; older protocols cannot be negotiated. Every internal hop — application to database, to file storage, to the AI API, and outbound email — is encrypted, and the database refuses unencrypted connections outright. All data at rest — database, file storage, secrets, and application images — is encrypted with AES-256.

Access control

Every page and download is restricted to the account that owns the data, that account's organization administrators where the organization has enabled it, and Recon Brief staff. Staff access requires a second authentication factor, and repeated failed sign-ins lock the account for a timed period. Passwords are never stored: each account holds a salted, iterated PBKDF2-HMAC-SHA256 hash, verified in constant time. Each client's data is logically segregated — every read is scoped to its owner, and no page, download, or report can reach another client's data.

Application security

Every state-changing request carries an anti-forgery token and is rejected without it. The session cookie is HTTPS-only, unreadable by page scripts, expires on a fixed time-to-live, and is invalidated everywhere when a password changes or you sign out of all devices. Uploads travel over single-purpose signed links that expire in minutes, and every file is validated before it is accepted. Our pages send strict security headers and cannot be embedded by other sites.

Infrastructure

Recon Brief runs on Google Cloud, which maintains SOC 2 Type II certification. All resources are in the United States, and an organization-level policy prevents any resource from being created outside the US. The application exposes no network ports of its own — it is reachable only through Google's managed HTTPS front end — and neither the database nor file storage is directly reachable from the internet. Secrets live in a managed secret store with per-secret access limited to the one service that needs each. The database has automated daily backups with point-in-time recovery, plus an independent nightly copy, and the restore procedure is written down and exercised.

Testing

An authorization matrix of several hundred route-by-role assertions and an adversarial probe suite (request forgery, upload abuse, signed links, invitation and reset tokens, sign-in protections, injection) run automatically on every code change. Dependencies are audited against known vulnerabilities and every deployed image is scanned on push.

If something goes wrong

We will notify affected clients within 72 hours of confirming any unauthorized access to their data, investigate and contain it, cooperate with your own response, and supply what you need for your regulatory obligations. We maintain the records needed to reconstruct who accessed what, including an audit trail of every sign-in, administrative action, and download.

Privacy requests

We act as a CCPA service provider: personal information is processed only to deliver the Service, is never sold or shared, and can be deleted or produced on request — see the Privacy Policy and Contact pages.

Questions about any of this — including our data processing agreements — are welcome: Contact.