What you say stays yours
Zicelo hears what you dictate and what’s discussed in meetings. That’s why we handle data carefully—and tell you exactly what we do, with no badges we don’t have.
Encrypted connections
Everything sent from the apps to Zicelo’s servers goes through HTTPS (TLS). The same applies to our requests to AI providers and your integrations.
Dictation audio is not stored
A dictation recording stays on the server only while transcribing, then it’s deleted. What remains is only on your device, in your local history.
No training on your data
Transcription and cleanup use AI models via API. Data sent through the API isn’t used by the provider to train models. We don’t use it for that either.
Password-free accounts
You log in with a one-time code sent by email. On the server, we store only the session token’s fingerprint (hash), not the token itself.
Encrypted integration keys
Tokens for Slack, Notion, CRM, and app passwords for email are stored encrypted (AES-256-GCM) and never shown again after saving.
Admin controls
In teams, the admin decides if Notetaker is enabled, if public links are allowed, and how many days meetings are kept. Member transcriptions remain private.
Delete whenever you want
Delete one meeting or all at once, anytime. On Enterprise, meetings can auto-delete after the chosen days, and audio files may not be kept at all.
Audit log
On Enterprise, see who shared, exported, or deleted anything, with date and IP address.
Controlled public links
A meeting is private until you share it. Public links can have passwords and expiration dates, and you can revoke them anytime.
What data we process and where
- Dictations: audio is transcribed then deleted; cleaned text is sent back to your device. The server keeps only word count and duration for stats and package limits.
- Meetings: if you use an account, transcriptions, notes, and audio files (when applicable) are kept in your account so you can search and share them. You can delete them anytime.
- Settings: your dictionary, shortcuts, styles, and commands sync across devices.
- Providers: transcription and language models are supplied via API by OpenAI; emails are sent via our mail server. Integrations receive only what you choose to send.
What we don’t do
- We don’t sell or rent your data.
- We don’t listen to meetings or read transcriptions; technical access happens only at your request, for support.
- We don’t claim certifications we don’t have. If your company needs a Data Processing Agreement (DPA), contact us.
Found a security issue?
Thanks! Read the rules in the bug bounty program and report it there.