You stay in control. We handle the security.
Mesakem transcribes and summarizes work meetings and calls. This page sets out what happens to that data: where it lives, how it's encrypted, what the AI does with it and who can see it.
Have a security questionnaire? Send it to hello@mesakem.com.
Is Mesakem right for our organization's meetings?
Mesakem's database and servers run in Frankfurt, in the European Union. Traffic is encrypted, and your content isn't used to train AI models, by us or by our AI providers. In an organization account each person gets a private space, and managers see usage only. The infrastructure is built on providers that hold SOC 2 Type II reports.
Eight things worth knowing
Hosted in the EU
Our database and servers run in Frankfurt.
Encrypted
Traffic is encrypted, and secrets like calendar connections are stored with AES-256.
Never trains AI
Your content isn't used to train AI, by us or by our AI providers.
Sensitive details masked
Card numbers, ID numbers and passwords are masked before text is sent for a summary.
Managers see usage, not content
In an organization, each person gets a private space. Managers see usage, never meetings.
Recording in the open
The bot joins under a visible name and waits to be let in. The desktop app records only when you press start.
Verified recipients only
Summaries go only to verified email addresses.
Delete anytime
A deleted meeting leaves your account at once. Closing your account deletes it for good after 30 days.
Component by component, no sweeping claims
The database, the application servers and background processing run in the European Union. Some services, such as the AI providers, run outside it.
In the EU
- Database: accounts, meetings, transcripts, summaries and agent memory
- Neon, Frankfurt
- Application and API servers
- Vercel, Frankfurt, with a global edge network that delivers the pages
- Background processing
- Render, Frankfurt
- Meeting bot and meeting transcription
- Recall.ai's EU region. According to the provider, its main processing operations are in the US
Outside the EU or global
- Recording files
- Cloudflare R2, encrypted. Storage is not restricted to one region
- AI processing: summaries, the agent, search and dictation
- Anthropic and OpenAI, United States
- Phone-call, uploaded-recording and dictation transcription
- Deepgram, global endpoint
- Email delivery
- Resend, United States
Israel is recognized by the European Union as providing an adequate level of protection for personal data. For transfers to the United States we rely on our providers' data processing agreements, which include Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as applicable.
How it works in practice
Encryption and accounts
- TLS with HSTS on all traffic, and an encrypted, verified connection to the database.
- Calendar tokens, call-provider credentials and tokens for connected services are stored with AES-256-GCM.
- Passwords are hashed with scrypt. API keys are stored as hashes and shown once.
- The session is signed and kept in a secure, httpOnly cookie.
- Rate limits on sign-in, sign-in links, password resets and the API.
- Single sign-on (SSO) on the Business plan: the organization verifies its domain, connects its identity provider (Microsoft Entra, Google Workspace, Okta and others), and can require everyone on the domain to sign in only that way.
- Recording files are reached only through short-lived signed links.
AI and your content
- Mesakem does not use meeting or call content to train AI models, and our AI and transcription providers do not use the content we send them to train their models.
- We use the business APIs of Anthropic and OpenAI. The providers may keep requests for a limited time for security and abuse prevention.
- Before content is sent for a summary, a filtering layer masks Israeli ID numbers, card numbers, security codes, passwords and API keys. In smart dictation, a spoken card number becomes •••• 1234. Details and limits in the privacy policy
- Our prompts tell the AI to treat a transcript as material to work with, not as instructions.
Privacy inside an organization
- Each person gets a private space of their own.
- No role in an organization can open someone else's meetings, transcripts or summaries.
- Managers see usage, seats and connections.
- Suspending or removing someone cuts their bot, calendars and access to the organization at once. Their content is kept and never transferred.
Recording and consent
- The meeting bot joins under a visible name and waits to be admitted. If it isn't let in, there is no summary.
- The desktop app records only when you press start, and no participant is added to the meeting.
- Informing participants and getting consent, where the law requires it, is the user's responsibility. Recording and consent
- Summaries go only to verified email addresses.
A signed desktop app
- Windows: digitally signed by a verified publisher, JANUAR TECHNOLOGIES LTD.
- Mac: signed with a Developer ID and notarized by Apple.
- Automatic updates are verified before they install.
- The device key is stored encrypted by the operating system, and the app's windows are isolated.
Deletion
- A deleted item leaves your account and search at once.
- Closing an account: it closes at once and is deleted for good after 30 days, including the recordings at the recording provider.
- Billing records and tax documents are kept as the law requires.
Our main providers
The infrastructure and AI providers Mesakem is built on. The certifications are the providers' own, as each publishes them. Mesakem itself does not hold a SOC 2 report or an ISO 27001 certificate. The full list is in the privacy policy
| Provider | Role | Location | SOC 2 Type II | ISO 27001 |
|---|---|---|---|---|
| Neon | Database | EU (Frankfurt) | Yes | Yes |
| Vercel | Application and API | EU (Frankfurt) and a global edge network | Yes | Yes |
| Render | Background processing | EU (Frankfurt) | Yes | Yes |
| Recall.ai | Meeting bot, meeting transcription and desktop recording | EU region; the provider's main processing is in the US | Yes | Yes |
| Cloudflare R2 | Recording file storage | Global | Yes | Yes |
| Anthropic | AI processing | United States | Yes | Yes |
| OpenAI | AI processing and search | United States | Yes | Yes |
| Deepgram | Call, upload and dictation transcription | Global | Yes | No |
| Resend | Email delivery | United States | Yes | No |
| WorkOS | Sign-in for the AI connector and organization SSO | United States | Yes | No |
Questions about security and privacy
Does Mesakem use my meetings to train AI?
No. Mesakem does not use meeting or call content to train AI models, and our AI and transcription providers do not use the content we send them to train their models.
Where is my data stored?
The database, the application servers and background processing run in Frankfurt, in the European Union. Recording files are stored encrypted in storage not restricted to one region, and the AI providers run in the United States.
Who can see my meetings in an organization account?
Only you. Each person gets a private space, and no role in the organization can open someone else's meetings, transcripts or summaries. Managers see usage.
Does Mesakem have SOC 2?
Not Mesakem itself. The main infrastructure and AI providers Mesakem is built on hold SOC 2 Type II reports, as they publish them.
How do I delete my data?
A deleted item leaves your account and search at once. Closing your account closes it immediately, and it is deleted for good after 30 days.
Can we get a data processing agreement (DPA)?
Yes. For organizations that need a DPA under GDPR, it is available on request at support@mesakem.com.