Security
Local processing and account security
Last updated October 8, 2026
What stays on your computer
Transcript alignment, review, designation work, and clip rendering run locally. Video, audio, transcript text, and saved timings are not uploaded through account synchronization. When you deliver a bundle or clip, you choose the delivery channel and recipients.
Connect to create and pair your account, obtain credits, and install any additional speech model. With setup complete and sufficient credits, sync runs offline. Review requires an internet connection to purchase the designation unlock; reviewing and rendering then run locally.
Protect your device and backups under your firm's security and retention policies. Local storage reduces the need to send recordings to a processing service; it does not replace device security.
What the account service receives
Your account stores identity and firm details, payments and credit balances, and job metadata. Job records can include witness and matter names, case number, proceeding date and type, volume, duration, page count, media size, job status, and error information. App diagnostics and usage events help us investigate failures.
Witness and matter details can be confidential even without transcript text. We treat that metadata as case information. See the privacy policy for data uses and the service-provider list.
Account controls
Credentials and sessions
Passwords are hashed. Web sessions use httpOnly cookies, and desktop API tokens are stored as hashes on the server. Device pairing requires approval through your account.
Firm access checks
Server-side access checks scope firm records to authorized users. Device access can be revoked from Settings → Devices.
Transport and payments
The production account service uses HTTPS. Stripe processes card details, and payment webhooks are signature-checked before credit balances are updated.
Operational records
The account service records sign-in activity and selected content-access events for investigation. These logs describe server activity; they are not a complete audit trail of offline desktop work.
Model usage
Speech recognition uses pre-trained models. DepoFlow does not use your recordings, transcripts, designations, or case content to train or fine-tune AI models. Automated alignment can contain errors; review important passages and clip boundaries before delivery.
Cloud feature availability
The current commercial offer is local desktop processing with an online account service. Hosted transcription, remote live transcription, cloud media sharing, and server-rendered deliverables are not part of this offer. Account synchronization sends metadata and billing activity, rather than the underlying recording or transcript.
Certification status
DepoFlow does not currently hold SOC 2, ISO 27001, or ISO 42001 certifications or attestations. Any certifications held by infrastructure providers apply to those providers, not to DepoFlow.
Retention and deletion
- Your local recordings, transcripts, clips, and backups remain under your control. Closing an account does not delete files from your devices.
- You can request account and associated personal-data deletion. We may retain billing records where needed for tax, accounting, dispute, or legal obligations, as described in the privacy policy.
- Account logs and metadata are separate from your local library. Removing a local file does not by itself erase the corresponding account record.
Contact
Report a security concern to security@depoflow.com. For account deletion or privacy requests, contact privacy@depoflow.com.