Security
Last updated: September 20, 2026
BufferMind handles lecture recordings, transcripts, and messages — things people expect to stay private. This page summarises how we protect them.
The Privacy Policy is the authoritative document. If this page and the policy ever differ, the policy governs.
Encryption
- In transit — all traffic between the apps, our API, and our providers is encrypted with TLS.
- At rest — data in our cloud database and object storage is encrypted at rest.
- On your device — to support offline playback and fast history, the apps keep a local copy of your sessions and audio. That copy is not separately encrypted; it relies on your operating system's account protections. Lock your device, and sign out on shared computers.
Where your data lives
When you are signed in, your data is stored with providers in the United States.
| Data | Stored with | Location |
|---|---|---|
| Audio recordings, profile photos, chat media | Cloudflare R2, with an hourly backup copy in a second bucket | Western North America |
| Transcripts, translations, notes, messages, account and billing records | Supabase (PostgreSQL on AWS) | us-west-2 · Oregon, United States |
| Some older recordings and recordings made on macOS | Supabase Storage | us-west-2 · Oregon, United States |
| API | Cloudflare Workers | Cloudflare's global network |
| Website and web app | Vercel | Vercel's global network |
Access to your data
- Each account can read only its own recordings, transcripts, and messages. This is enforced in the database with row-level security as well as in our API.
- A recording is private until you share it. A share link can be switched off at any time, and deleting a recording revokes its link.
- Access to production systems is restricted to authorized personnel.
AI providers and model training
We do not use your content to train AI models, and our AI providers process it under commercial API terms that do not permit them to use it for training. Audio is streamed to our speech-recognition provider for the duration of the session and is not stored by them beyond it.
Subprocessors
We share data with these providers only as needed to run the features you use.
| Provider | What it does for BufferMind |
|---|---|
| Soniox | Real-time speech recognition, speaker separation, language identification, and built-in translation |
| Anthropic | Claude models for summaries, titles, answers, course analysis, Andy conversations, and photo questions |
| Cloudflare | API hosting, storage for audio, photos and chat media (R2), folder search embeddings, call relay |
| Supabase | Database, authentication, real-time message delivery, legacy audio storage |
| Google Sign-In, Google Translate for text translation, Google Fonts on the website | |
| Apple | Sign in with Apple, push notifications, App Store purchases |
| Microsoft | Read-aloud voices for Live Conversation mode in English and Chinese |
| Stripe | Payment processing for purchases made on our website |
| LINE | LINE Login, when you choose it |
| Resend | Transactional email (invitations and recording-share emails) |
| Discord | Private channels where in-app feedback and operational alerts reach our team |
| Vercel | Website and web app hosting, cookie-less aggregate analytics |
The full description of what each provider receives is in the Privacy Policy.
Payments
Purchases on our website are processed by Stripe; purchases in the iPhone and iPad apps are processed by Apple. BufferMind never receives or stores your card number.
Retention and deletion
Recordings, transcripts, and AI content are kept until you delete them or your account — there is no automatic expiration. Deleting a recording removes its audio and transcript from your device, our primary storage, and the backup copy. You can delete your account from Settings at any time; the Privacy Policy lists the few records that are retained afterwards and for how long.
Reporting a vulnerability
If you believe you have found a security issue, email support@buffermind.com with the subject "Security report" and the steps to reproduce it. Please do not access other people's data or disclose the issue publicly before we have had a chance to fix it. We read every report and usually reply within 24 hours.
Certifications
BufferMind does not hold its own SOC 2 or ISO 27001 certification. The infrastructure providers listed above maintain their own security programmes and certifications.