Security at HeyTalk

1. At a glance

• Stored in India. Our app and database run in Mumbai.
• Recordings are deleted once transcribed, unless you choose to keep them for playback.
• Private by default. Only you see a conversation until you invite someone or share a link.
• We never train AI models on your conversations.
• Nothing goes out without you. Tickets, messages and emails wait for your OK unless you turn on automatic mode.
• You can export or delete everything, yourself, at any time.

2. Where your data lives

The HeyTalk app runs on Vercel in its Mumbai region, and your account and conversations are stored in a Turso database hosted on AWS in Mumbai (ap-south-1). To transcribe and understand a conversation we send it to Google’s Gemini API, which may process it outside India.

The full list of companies that process data for us is below, under Who processes your data.

3. How it's protected

• Encrypted in transit. Every connection to HeyTalk uses HTTPS.
• Connected-app keys are encrypted. The access tokens for Slack, Notion, Jira and Gmail are encrypted with AES-256-GCM before they are stored, so a copy of the database alone can’t use them.
• Links and API keys are stored as fingerprints. Team invite links and personal API tokens are kept only as SHA-256 hashes; we can check them, but never read them back.
• No passwords. You sign in with Google, so HeyTalk never sees or stores a password. Sessions end after 90 days without use.
• Every request is checked. Each conversation, task and file is tied to its owner, and every read and change is checked against who is asking.

4. Your recordings

• Deleted once transcribed. By default, HeyTalk keeps the words, not the audio.
• Playback is your choice. On Pro you can keep recordings for 7 or 30 days to play any line again; after that the audio is deleted and the notes stay.
• Team admins decide for the team. An admin can turn off keeping recordings for everyone in the team.
• Consent. HeyTalk asks you to tell people you are recording. In many places everyone must agree first — it’s on you to do so.

5. AI and your data

• We use AI only to do what you asked: transcribe, summarise, pull out tasks, write your brief and answer your questions.
• We never use your conversations to train AI models.
• What the AI writes is shown to you first. Anything that leaves HeyTalk — a ticket, a comment, a message, an email — goes out only when you approve it, or when you have turned on automatic mode for that kind of action (with a hold before it goes, and undo where the tool allows).

6. Who can see what

• You see your conversations. Nobody else does until you invite them.
• People you invite to a recording see its summary and their tasks. You choose whether they also see the full transcript.
• Being in a team never opens up anyone’s recordings on its own.
• Share links show a read-only summary, decisions and tasks — never the transcript or audio. They aren’t listed by search engines, and turning sharing off stops the link at once. Team admins can turn share links off for the whole team.

7. Connected apps ask for as little as possible

• Gmail — permission to send only. HeyTalk can’t read your inbox.
• Notion — only the pages you choose to share with HeyTalk.
• Slack, Jira — post the messages and create the tickets you approve.
• Disconnect any app from Settings at any time; its keys are deleted.

8. Keeping and deleting

• Delete any conversation at any time — its transcript, tasks and any audio go with it, for everyone it was shared with.
• Conversations are deleted automatically after 90 days.
• Export everything we hold about you as a file, from Settings → Your data.
• Delete your account from Settings → Your data. Your conversations, connections and tokens are deleted straight away. Payment records we must keep by law are kept without your name on them.

9. Controls for team admins

• Turn public share links off for the whole team (existing links stop working).
• Turn off keeping recordings for playback.
• Share only the summary with attendees by default, not the full transcript.
• Invite people with links that expire after 7 days and can be limited to your company’s email domain.
• Choose who is an admin, and remove members at any time.

10. Who processes your data

11. Where we are, honestly

HeyTalk is a young product. We have not completed a SOC 2 or ISO 27001 audit yet, and we’ll say so here until we have. What we do today is described on this page; if your company needs a security questionnaire answered or a data processing agreement, write to us and we will work through it with you.

We support the rights the Digital Personal Data Protection Act gives you in India, and the GDPR in Europe: to see, correct, export and delete your data. See our Privacy Policy for the detail.

12. Report a security issue

Found something that looks wrong? Email support@heytalk.site with “Security” in the subject. We read every report, reply within 3 working days, and won’t take action against anyone who reports in good faith.