Security · AI Meeting Assistant

Security for AI Meeting Assistant

Krisp records, transcribes and summarizes meetings on desktop, web and mobile. Transcription starts on your device, and nothing about a meeting is stored in the cloud until you choose to save it.

Open the Trust Center → Report a vulnerability

On the device

Noise CancellationAudio never leaves the device
Desktop transcriptionEnglish speech-to-text, on your device
Private mode (Enterprise)On-device transcripts and recordings

ENCRYPTED · TLS

Krisp cloud · AWS

Meeting notes you choose to saveTranscripts, summaries, recordings
AI summaries and AI ChatThird-party LLM, no training on your data
Mobile and uploaded audioTranscribed in the cloud by Baseten

SOC 2 Type II Independent audit. Report in the Trust Center.

PCI DSS v4.0.1 Covers cardholder data customers may say on calls.

HIPAA Safeguards for ePHI. BAAs available.

GDPR Data export and deletion on request. SCCs for transfers.

Governance

Information security program

Krisp's information security program is run by the Head of Security, who also serves as the designated HIPAA Privacy Officer. Security policies are approved and reviewed by executive leadership.

Audit

SOC 2 Type II

An independent auditor tests our controls over a full observation period every year. Download the report from the Trust Center.

Payments

PCI DSS

Krisp doesn't process payments, but customers may say card details on calls. Our PCI DSS certification covers how that data is protected.

Healthcare

HIPAA

Business Associate Agreements are available on the Enterprise plan for teams of 100 or more seats.

Documents

Trust Center

Policies, pen test summaries and compliance reports live at trust.krisp.ai.

Data map

What Krisp processes, where, and what it keeps

Noise cancellation and desktop transcription run on your computer. Meeting content reaches Krisp cloud only when you turn on Meeting Notes, record, use the mobile app or connect an integration.

Deviceprocessed on your computer Cloudprocessed in Krisp cloud (AWS)

Data	Processed	Stored in Krisp cloud	Your control
Noise Cancellation	Device	Never	Always local.
Desktop transcriptionEnglish; other languages are transcribed in the cloud by Baseten	Device	Only if you save the meeting	Turn on Meeting Notes to sync transcripts to your account.
Mobile app and file uploadsiOS, Android, uploaded audio, US phone call recording. Transcribed by Baseten	Cloud	Transcript, summary, audio	Non-English audio is deleted as soon as the transcript is ready.
Recordingsaudio, video, screen	Device then Cloud	Until you delete them	Storage quota by plan: 10 GB Core, 60 GB Advanced, unlimited Enterprise.
Summaries, action items, AI Chat	Cloud	Summaries and chat history, kept with the meeting until you delete it	Generated with Anthropic Claude on AWS Bedrock, sharing only the minimum data needed. Providers don't train on your data.
Calendar	Cloud	Event titles, times, attendees	Opt in by connecting a calendar.
Integrations and MCPSlack, Teams, Notion, Zapier, HubSpot, Pipedrive, Affinity, Salesforce, ConnectWise, API, MCP	Cloud	Tokens and the data you choose to sync	You connect each one. Integration data is never used to train AI models.
Comments and shared links	Cloud	Comments, share settings	Admins can disable auto-share and restrict link access (Advanced and Enterprise).
Account and usage	Cloud	Email, team names, invoices, app and device names, call timing and talk time	Card numbers stay with Stripe.

AI models and your data

Speech-to-text

Krisp on device, Baseten in the cloud

Desktop transcription uses Krisp's own speech models and runs on your device. Cloud transcription, used for the mobile app, uploaded files, phone call recording and non-English meetings, runs on Baseten.

Summaries & AI Chat

Anthropic Claude on AWS Bedrock

Krisp sends only what a summary needs. Models run through AWS Bedrock and are not trained on customer data. AWS Bedrock security.

Training

Opted out with vendors

Krisp has opted out of model training with every third-party AI provider.

Your data

Not used for ads or resale

Meeting content is used only to deliver the features you turned on.

Admin controls

Controls by plan

Control	Core	Advanced	Enterprise
MFA, user management, central billing
Disable auto-share, link access control, enforce recording mode	—
SAML SSO and SCIM	—	—
On-device private transcription and recordings	—	—
SOC 2 report access	—	—
HIPAA and BAA	—	—	(100+ seats)

Healthcare

HIPAA safeguards

Meeting transcripts and recordings can contain ePHI. These safeguards apply to Enterprise teams that sign a BAA.

Minimization

Only what's needed

Krisp collects and processes the minimum data each feature needs.

Access

Role-based

Unique user IDs, role-based permissions, and SIEM monitoring of every access to transcripts and ePHI.

Vendors

Assessed and contracted

AI and infrastructure vendors are security-reviewed and bound by BAAs or equivalent terms.

Audit

Logs and monitoring

Access to ePHI is logged and reviewed.

Continuity

Contingency plan

Backups and recovery procedures are tested to keep data available.

Oversight

Trained team

Employees complete HIPAA training every year. The Head of Security is the Privacy Officer.

Protection

Encryption

In transit

TLS 1.2 or higher

Every connection between Krisp apps, the admin portal and the backend uses HTTPS. Unencrypted traffic is refused.

At rest

AES-256

Production databases, transcripts, recordings and backups are encrypted with AES-256.

Payment data

Held by Stripe

Krisp never stores card numbers. Payments are processed by Stripe, a PCI DSS Level 1 provider.

Access

Authentication

Krisp does not store passwords, so there is no password database to leak.

Single sign-on

SAML 2.0 SSO and SCIM

Teams sign in through their identity provider and provision or remove users automatically with SCIM.

Passwordless

Google OAuth 2.0 or email code

Users sign in with Google or with a one-time code sent to their email.

Second factor

Two-factor authentication

Optional 2FA adds a second check at sign-in. How to turn it on.

Your rights

Privacy, GDPR and data residency

Request a copy of your data or its deletion at any time by writing to [email protected]. Account deletion is permanent and cannot be undone.
Deleted transcripts, summaries and recordings are hard-deleted, not soft-deleted or archived.
Data is stored in the United States by default. An EU region is available for Voice Translation, and data can also be stored in a customer-owned storage bucket.
Transfers of personal data out of the EEA rely on Standard Contractual Clauses.
Krisp uses a small set of vetted sub-processors. The current list is always in the Trust Center.

Inside Krisp

Data access and segregation

Segregation

Logical tenant isolation

Each account's data is isolated by access controls at the application layer. Databases and storage are shared infrastructure, not physically separated per customer.

Least privilege

Few people, logged access

Only a small group of senior engineering leads has standing access to customer data. Anyone else needs explicit, time-bound approval, for example to debug a support case.

Monitoring

SIEM

A SIEM records and alerts on access to sensitive data, including ePHI and transcripts.

Operations

Infrastructure and production security

Hosting

Amazon Web Services

The Krisp backend runs entirely on AWS, which holds ISO 27001, SOC 1/2/3 and PCI DSS Level 1 attestations for its data centers.

Availability

Fail-closed apps

Krisp desktop and mobile apps need the Krisp backend to run. If the backend is unreachable, the app stops rather than working outside policy.

Hardening

Minimal attack surface

Unused ports are closed, all services speak HTTPS only, and internal access follows least privilege.

Assurance

Penetration tests and scanning

Annually

Third-party penetration tests

Independent firms test the apps, APIs and infrastructure once a year. Summary reports are available in the Trust Center.

Continuous

Automated vulnerability scans

Code, dependencies and infrastructure are scanned on a regular schedule and findings are tracked to closure.

Every employee

Security training

All team members complete Security 101 on joining and annual HIPAA training.

Responsible disclosure

Found a vulnerability? Tell us.

Krisp runs a bug bounty program. Rewards depend on severity and report quality.

Submit: Report on HackerOne
Response: Within 3 business days
In scope: All Krisp-owned assets — *.krisp.ai, the desktop apps (Windows, macOS, Linux and ChromeOS), the iOS and Android apps, the browser extension, the admin portal and the APIs.
Out of scope: Only the assets explicitly listed as out of scope in our HackerOne program (for example whatsnew.krisp.ai and help.krisp.ai).

Give us reasonable time to fix the issue before you disclose it publicly.
Don't access, change or delete data that isn't yours. Use test accounts.
Don't run denial-of-service, spam or social-engineering tests.

Contact

Talk to the security team

Questions about this page, a security questionnaire or a BAA? Write to [email protected] or request documents in the Trust Center.