Security
What happens to what you say.
CuePilot sits inside private conversations, so the useful thing to publish is not a badge — it is a specific description of where data goes, who can read it, and what we cannot promise.
Local AI
On Local processing, transcription and suggestion generation run on your machine. Audio and transcript do not leave it. Some capabilities are cloud-only; the app names them rather than pretending otherwise.
Encryption
TLS in transit. At rest, data lives in Postgres with encrypted storage. Payment credentials are never stored by us — the provider holds them.
Tenant isolation
Every tenant-owned table has row level security, enforced in the database rather than in application code. A forged workspace ID in a request body returns zero rows.
Retention
Configurable per artefact: audio, screenshots, transcripts and sessions each have their own policy. The defaults do not store raw audio or screenshots at all.
Screen permissions
Screen context is off by default and On demand when enabled. It captures a single frame when you ask for one; there is no background screen recording.
Audio controls
Microphone and system audio are independent switches, per session. Where an operating system cannot provide system audio, the app says so instead of producing a one-sided transcript.
Access
Role-based membership per workspace: owner, admin, manager, agent, viewer. Managers can read team sessions; agents cannot read each other’s.
Secrets
The web app never holds a service-role key. Privileged work happens in the API service, which is the only place provider secrets exist.
Data path
Where a sentence goes.
Local and cloud processing differ in exactly one place, and it is the place that matters.
- Microphone / system audio
- Local transcription (on device)
- Local model (on device)
- CuePilot overlay
- Transcript stored in your workspace
- Microphone / system audio
- Speech provider over TLS
- AI provider over TLS
- CuePilot overlay
- Transcript stored in your workspace
Limits
What we will not claim.
These are the honest edges of the product. They matter more than a list of things that went right.
Screen Share Privacy is not a guarantee.
It asks your operating system to exclude the overlay from screen capture. Some capture methods, external cameras and some OS versions can still record it.
We do not help you avoid recording consent.
Where the law or the other party requires notice, that is yours to give. The product will not be built to circumvent it.
Not every feature is local.
The strongest reasoning models and some languages require a cloud provider. The AI settings screen marks which is which before you switch.
Nothing is written to your CRM without review.
CuePilot proposes an update. A human approves it. There is no silent write path.
A browser redirect does not unlock a subscription.
Only a verified provider webhook changes billing state.
Need a security review?
Enterprise adds SSO, SCIM, audit logs, custom retention and a named AI provider. We will answer a questionnaire with specifics rather than marketing language.
Contact us