Security

• Email and password sign-in; passwords are hashed by our auth provider.
• New accounts start as Pending Approval and cannot reach the app until an administrator approves them. Accounts can be locked at any time.
• Administrator rights are held in a separate role table and checked server-side on every privileged action.
• Registration, sign-in and status changes are written to an audit log.

• All traffic is encrypted in transit over HTTPS.
• Recordings are streamed in parts for transcription and are not stored on our systems after processing. Successfully transcribed parts are removed as processing progresses, with clean-up for remaining processing files.
• Engagements, transcripts and Engagement Results are stored in the managed cloud service and protected by organisation-scoped access rules. Engagement records are subject to the current 30-day retention window.
• Account, client, organisation and administration data is held in the managed cloud service with row-level access rules. Organisation logos, templates and temporary recordings use private storage.

• No certification is claimed — Consultation Kelly is not represented as ISO 27001, SOC 2, HIPAA or Cyber Essentials certified.
• Multi-factor authentication is not currently enforced by the product.
• No formal penetration test or independent audit has been carried out.
• Files exported to a user's device are outside the product's access and retention controls and must be protected by the user and their organisation.

Email seanjames@axisbeamlabs.com with steps to reproduce. Please do not test against other people's accounts or real engagement data. We aim to acknowledge reports within five working days.