How is my data stored and secured?

Your recordings, transcripts, and notes are stored in Canto's cloud on Google Cloud / Firebase, in the EU. Data is encrypted in transit and at rest, access is enforced server-side, and nothing you record is public unless you deliberately share it. The authoritative version of everything on this page is the Privacy Policy.

Where is my data stored?

In the European Union. Audio files and Canto's server functions run in Google Cloud's europe-central2 region (Warsaw, Poland); the database lives in Google's EU multi-region. Analytics and AI-request tracing are EU-hosted too, and the meeting bot runs in an EU region.

Some processing does leave the EEA: the Gemini API that powers AI features is not region-pinned, and authentication and crash reporting run on Google's global infrastructure. Those transfers rely on the European Commission's Standard Contractual Clauses in the providers' terms.

How is it encrypted?

In transit, everything moves over TLS. At rest, storage and database contents are encrypted by the cloud provider. Calendar refresh tokens get an extra layer: they're additionally encrypted with a key Canto holds separately from the database.

Note the boundary of that claim: encryption at rest protects against infrastructure-level compromise; it is not end-to-end encryption. Canto's servers must be able to read your audio to transcribe and summarise it.

Who can access my recordings?

• You, and anyone you've deliberately shared with — Space members, organisation members, and public-link recipients. Access is enforced by server-side database and storage rules, and shared audio is served through short-lived signed links rather than public URLs. Exactly who can do what is in Who can see and edit what?
• Service providers, only to run the service — speech-to-text for transcription, the Gemini API for AI features. Canto does not use your recordings or transcripts to train AI models and never sells them; see Is my audio used to train AI models?
• A small number of Canto staff, where necessary to operate and support the service — for example signing into an account to diagnose a problem you reported. Such access is logged.

Public share links are unguessable random tokens, excluded from search-engine indexing — but anyone holding one can open it, so treat a link like the content itself. See Share a recording with a public link.

What happens when I delete things?

Deleting a recording removes its audio, transcript, the raw transcription output, and the AI data derived from it.

Deleting your account (Settings → Delete account, available in-app on every platform) is immediate and permanent: recordings, transcripts, notes, AI artifacts, chats, Spaces you own, your sharing memberships, and the account itself are wiped. Recordings other people contributed to your Spaces remain theirs. Backup copies age out on a rolling basis and are never restored to undo a deletion. See How do I delete my account?

FAQ

Does Canto sell my data or show ads?

No. Canto shows no advertising and does not sell or rent personal data. Data is shared only with the service providers listed in the Privacy Policy, and only to run the app.

What if there's a breach?

If a breach affects your personal data, Canto will notify you and the relevant supervisory authority without undue delay.