Where your recordings go — trust and subprocessor disclosure
Companion to the attestation and receipts page, which shows the enclave's quote and the key that signs your transcripts.
Describes the code merged on 2026-10-13 (shas in every citation). Published with the production deploy of that code.
The honest sentence
Your meeting content is stored and searched inside confidential hardware, and nothing is sent to a third-party service for processing when you read or search; the traffic itself passes through Vercel and the Cloudflare Worker in transit (see the transit row) (conclave config.py:283 @ 2c57664) (conclave storage/sqlite.py:19 @ 2c57664). The Ask feature, when enabled, sends your question and transcript context to NEAR AI for one synthesis call (conclave api/kb_routes.py:495-498 @ 2c57664) (conclave frontend/src/app/search/page.tsx:62 @ 2c57664); it is disabled unless ENABLE_ASK is set and answers 404 otherwise (conclave api/kb_routes.py:479-480 @ 2c57664) (conclave api/kb_routes.py:502-503 @ 2c57664), and the deployment does not set it. Audio is processed outside that hardware by named suppliers, both during and after a meeting (conclave docker-compose.yml:234-235 @ 2c57664) (sync scripts/stage-deploy.sh:125 @ d814e5fa). Moving that work onto one supplier concentrates the exposure; it does not reduce it. The shape of this paragraph comes from (sync plans/system-design/SYSTEM-DESIGN.html:559-562 @ d814e5fa).
Where your audio and content go
| What | Today | Inside attested hardware? | Source |
|---|---|---|---|
| Live words during an in-person recording | Sent to Deepgram, US endpoint api.deepgram.com, model nova-3. | No | (conclave docker-compose.yml:235 @ 2c57664) (capture services/diarization/diarization/config.py:93-94 @ 3db7d08) |
| Live speaker turns | Sent to Deepgram. | No | (conclave docker-compose.yml:234 @ 2c57664) |
| Final speaker pass and transcript after the meeting | A GPU machine at a third party (sync docs/deploy/DEPLOYMENT-GUIDE.md:59 @ d814e5fa) that is shared with other users of that machine; we hold an unprivileged account on it, with no root (sync plans/diarization-gpu/GPU-SETUP-rtx3090-fractal.md:16,21,37 @ d814e5fa). It downloads the decrypted recording, served by the confidential machine as a WAV file (conclave api/diarize_result_routes.py:69-82 @ 2c57664) (sync scripts/stage-deploy.sh:125 @ d814e5fa) (sync scripts/stage-deploy.sh:134 @ d814e5fa), and returns the result (sync scripts/stage-deploy.sh:132 @ d814e5fa). Our guide records that the worker dials out over cloudflared to claim jobs (sync docs/deploy/DEPLOYMENT-GUIDE.md:59 @ d814e5fa); the audio fetch and job URLs point at the confidential machine's own address (sync scripts/stage-deploy.sh:44 @ d814e5fa) (sync scripts/stage-deploy.sh:134 @ d814e5fa) (sync scripts/stage-deploy.sh:270 @ d814e5fa). Which of those requests cross Cloudflare's network is not recorded; treat the path as possibly crossing it. The deploy script emits the credential that lets the worker fetch recordings as a block to be pasted into a file on that shared machine (sync scripts/stage-deploy.sh:267 @ d814e5fa) (sync scripts/stage-deploy.sh:272 @ d814e5fa); the fetch route accepts that single service token (conclave api/diarize_result_routes.py:69-75 @ 2c57664), so anyone with access to that machine's files could fetch recordings while the token is valid. The deploy script configures that machine to run its own model (sync scripts/stage-deploy.sh:267-268 @ d814e5fa). The model weights it runs are licensed for evaluation only (sync plans/diarization-gpu/GPU-SETUP-rtx3090-fractal.md:27 @ d814e5fa). The deployment guide carries an instruction to switch it to post the recording to Deepgram; that is a deploy instruction, not a confirmed state (sync docs/deploy/DEPLOYMENT-GUIDE.md:258-259 @ d814e5fa). Either way, the recording leaves the confidential machine (sync docs/deploy/DEPLOYMENT-GUIDE.md:59 @ d814e5fa). | No | as cited in the cell |
| Uploaded recordings | Go to the same final pass. No transcription happens before it; the session starts with an empty transcript and the final-pass result replaces it (conclave api/record_routes.py:590-591 @ 2c57664) (conclave docker-compose.yml:20 @ 2c57664) (conclave api/record_routes.py:592 @ 2c57664). | No | as cited in the cell |
| Summaries, the story brief, knowledge base, answers to questions | NEAR AI Cloud, model z-ai/glm-5.3-flash, served from NEAR's confidential (TEE) inference (conclave infra/model_attestation.py:5-6 @ 2c57664) (conclave config.py:37 @ 2c57664) (conclave config.py:64 @ 2c57664) (conclave config.py:69 @ 2c57664) (conclave config.py:72 @ 2c57664) (conclave docker-compose.yml:45 @ 2c57664) (conclave docker-compose.yml:29 @ 2c57664) (conclave docker-compose.yml:51 @ 2c57664). | Yes, NEAR's hardware. We check it for genuineness and freshness only (conclave infra/model_attestation.py:1-30 @ 2c57664). The check is evidence served on the trust page and a boot-time check that never refuses; it is not a precondition on each request (conclave infra/model_attestation.py:418-443 @ 2c57664). | as cited in the cell |
| Stored recordings | Encrypted on the confidential machine with a key derived inside the hardware (conclave infra/audio_crypto.py:1-18 @ 2c57664). In the confidential deployment the key is the hardware-sealed one; the code also accepts an environment key or a development keyfile outside it (conclave infra/audio_crypto.py:17-18 @ 2c57664). Kept until you delete the meeting, which removes the audio with it (conclave transcripts/store.py:136 @ 2c57664). An audio-retention setting exists but nothing reads it (conclave config.py:144 @ 2c57664). The automatic purge that exists is for transcripts only and has no scheduler (conclave transcripts/retention.py:12-14 @ 2c57664). | Yes | as cited in the cell |
| Transcripts, summaries, search when you read them | Stay on the confidential machine, in a SQLite database file there. Search is full-text inside it. Nothing is sent to an external service for processing when you read them. The Ask feature, when enabled, sends your question and transcript context to NEAR AI for one synthesis call (conclave api/kb_routes.py:495-498 @ 2c57664) (conclave frontend/src/app/search/page.tsx:62 @ 2c57664); it is disabled unless ENABLE_ASK is set and answers 404 otherwise (conclave api/kb_routes.py:479-480 @ 2c57664) (conclave api/kb_routes.py:502-503 @ 2c57664), and the deployment does not set it. | Yes | (conclave config.py:283 @ 2c57664) (conclave storage/sqlite.py:19 @ 2c57664) |
| Transit between your browser and the confidential machine | Vercel hosts the web app and forwards API requests, including transcript reads and sign-in; Vercel terminates your browser's connection and forwards the request, so it handles transcript reads and sign-in in plaintext in transit (conclave frontend/next.config.ts:27 @ 2c57664) (conclave frontend/next.config.ts:32 @ 2c57664). The trust page itself is served from Vercel (conclave frontend/src/app/trust/page.tsx:620 @ 2c57664). The API hostname is fronted by a Cloudflare Worker, which stands in the path of API traffic the same way; our deployment guide marks its forwarding of one path and of response headers as unverified (sync docs/deploy/DEPLOYMENT-GUIDE.md:1188-1191 @ d814e5fa). | No (transit only) | as cited in the cell |
| Voiceprints and consent | A separate confidential machine, the identity service, receives the recording plus the speaker spans to measure voices (FPM main.py:261 @ 9090288) (sync docs/deploy/DEPLOYMENT-GUIDE.md:58 @ d814e5fa). It stores only encrypted voice measurements, never audio (FPM fpm/store/store.py:1-5 @ 9090288) (FPM fpm/store/store.py:108 @ 9090288). A name is shown only when that person's consent is 'allow' (FPM main.py:240 @ 9090288) (FPM main.py:484 @ 9090288). A name tied to an email is bound only after that person confirms, once per workspace, or when the person tags themselves (FPM main.py:332-335 @ 9090288) (FPM main.py:421-433 @ 9090288) (FPM main.py:400-402 @ 9090288) (FPM main.py:414 @ 9090288). A development flag can bypass confirmation; it is not set in the deployment (FPM config.py:137 @ 9090288) — the deploy script sets no such value. A display name without an email can still be recorded by the host through a legacy path (FPM main.py:338-339 @ 9090288); it is not shown without consent (FPM main.py:240 @ 9090288). | Yes | as cited in the cell |
| The meeting bot (online meetings) | Announces that it records, by display name and one chat message posted once admitted and before any capture starts; on by default (capture services/recato-bot/core/src/services/recording-notice.ts:2-3 @ 3db7d08) (capture services/recato-bot/core/src/services/recording-notice.ts:9 @ 3db7d08) (capture services/recato-bot/core/src/services/recording-notice.ts:22-24 @ 3db7d08) (capture services/recato-bot/core/src/platforms/shared/meetingFlow.ts:163-166 @ 3db7d08). If the notice fails to post, the bot logs that and still records (capture services/recato-bot/core/src/platforms/shared/meetingFlow.ts:164 @ 3db7d08). | No | as cited in the cell |
Subprocessors
| Company | What it receives | Attested? | Retention terms we rely on | Where configured |
|---|---|---|---|---|
| Deepgram | Live audio. Full recordings for the final pass as well, if the worker is switched to Deepgram as the deployment guide instructs; that switch is not a confirmed state (sync docs/deploy/DEPLOYMENT-GUIDE.md:258-259 @ d814e5fa). | No | Every request sends mip_opt_out=true, Deepgram's opt-out from model-improvement use of the audio (capture services/diarization/diarization/deepgram_engine.py:125 @ 3db7d08) (capture services/diarization/diarization/deepgram_engine.py:297 @ 3db7d08). What that opt-out covers is Deepgram's policy, not something our code can show. | (conclave docker-compose.yml:234-235,240 @ 2c57664); the final-pass key and switch live on the worker machine (sync docs/deploy/DEPLOYMENT-GUIDE.md:258-259 @ d814e5fa) |
| NEAR AI | Transcript text and prompts for summaries, knowledge and answers. Audio as well, if the recording API's non-upload branch is used: that branch sends the file to NEAR's Whisper transcription (conclave api/record_routes.py:717-722 @ 2c57664) (sync scripts/stage-deploy.sh:97-99 @ d814e5fa). The web app uses only the upload branch (conclave frontend/src/lib/api.ts:654 @ 2c57664). | Yes; we check genuineness and freshness only (conclave infra/model_attestation.py:1-30 @ 2c57664), as trust-page evidence and a boot-time check that never refuses, not per request (conclave infra/model_attestation.py:418-443 @ 2c57664). | None stated in our code. | (conclave config.py:69 @ 2c57664) (sync scripts/stage-deploy.sh:56,59 @ d814e5fa) |
| The host of the shared GPU machine, and its other users | Decrypted recordings while the final pass runs, on a shared machine where we have no root (sync plans/diarization-gpu/GPU-SETUP-rtx3090-fractal.md:16,21,37 @ d814e5fa). The deploy script emits the credential that lets the worker fetch recordings as a block to be pasted into a file on that shared machine (sync scripts/stage-deploy.sh:267 @ d814e5fa) (sync scripts/stage-deploy.sh:272 @ d814e5fa); the fetch route accepts that single service token (conclave api/diarize_result_routes.py:69-75 @ 2c57664), so anyone with access to that machine's files could fetch recordings while the token is valid. | No | None stated in our code. | (sync scripts/stage-deploy.sh:267-268 @ d814e5fa) (sync docs/deploy/DEPLOYMENT-GUIDE.md:59 @ d814e5fa) |
| Phala Network | Hosts the two confidential machines and runs the gateway in front of them (sync docs/deploy/DEPLOYMENT-GUIDE.md:57-58 @ d814e5fa). The in-person recording stream is TLS-passthrough into the enclave (sync docs/deploy/DEPLOYMENT-GUIDE.md:65 @ d814e5fa). The API hostname is also fronted by a Cloudflare Worker (sync docs/deploy/DEPLOYMENT-GUIDE.md:1188 @ d814e5fa). | Provides the attested hardware. | None stated in our code. | (sync docs/deploy/DEPLOYMENT-GUIDE.md:57-58 @ d814e5fa) |
| Vercel | Hosts both web apps. Terminates your browser's connection and forwards the request, so it handles transcript reads and sign-in in plaintext in transit (conclave frontend/next.config.ts:27 @ 2c57664) (conclave frontend/next.config.ts:32 @ 2c57664). | No | None stated in our code. | (conclave frontend/next.config.ts:27,32 @ 2c57664) (sync docs/deploy/DEPLOYMENT-GUIDE.md:60-61 @ d814e5fa) |
| Supabase (sign-in) | Your email address, to send the one-time sign-in code (conclave api/routes.py:65-69 @ 2c57664); it verifies the session token (sync docs/deploy/DEPLOYMENT-GUIDE.md:62 @ d814e5fa). | No | None stated in our code. | (conclave api/routes.py:65-69 @ 2c57664) (sync docs/deploy/DEPLOYMENT-GUIDE.md:62 @ d814e5fa) (sync scripts/stage-deploy.sh:54 @ d814e5fa) |
| Supabase, a second project used by Shape Rotator OS | A transcript, only when a host explicitly contributes a meeting. The web component for it exists but is mounted on no page at this sha (conclave frontend/src/components/refine/contribute-shapeos.tsx:16 @ 2c57664); the API route exists (conclave main.py:398-399 @ 2c57664). | No | None stated in our code. | (conclave config.py:229 @ 2c57664) (conclave main.py:398-399 @ 2c57664) (conclave docker-compose.yml:137 @ 2c57664) |
| Resend | Email: recipient address, meeting title, the link, the sharer's email address, and the fact that you were named as a speaker (conclave infra/email_catalog.py:120 @ 2c57664) (conclave infra/email_catalog.py:139 @ 2c57664). Never the transcript (conclave infra/email_catalog.py:120-139 @ 2c57664) (conclave infra/email_catalog.py:134 @ 2c57664) (conclave infra/email_templates.py:11-14 @ 2c57664). | No | None stated in our code. | (sync scripts/stage-deploy.sh:105 @ d814e5fa) |
| An analytics database (Postgres, outside the enclave) | Non-personal aggregates only: event type, timestamps, an opaque workspace id, counts; never content, names or free text (conclave infra/analytics.py:16-19 @ 2c57664). | No | None stated in our code. | (sync scripts/stage-deploy.sh:193 @ d814e5fa) |
| Calendar access if you connect it (sync scripts/stage-deploy.sh:63 @ d814e5fa), and sign-in for the consent dashboard (sync scripts/stage-deploy.sh:225-226 @ d814e5fa). | No | None stated in our code. | (sync scripts/stage-deploy.sh:63 @ d814e5fa) (sync scripts/stage-deploy.sh:225-226 @ d814e5fa) | |
| Cloudflare | DNS and certificates for the recording ingress (sync scripts/stage-deploy.sh:214 @ d814e5fa). The API hostname is fronted by a Cloudflare Worker, which stands in the path of API traffic the same way; our deployment guide marks its forwarding of one path and of response headers as unverified (sync docs/deploy/DEPLOYMENT-GUIDE.md:1188-1191 @ d814e5fa). Possibly the post-pass worker's traffic to the confidential machine; not recorded (sync docs/deploy/DEPLOYMENT-GUIDE.md:59 @ d814e5fa) (sync scripts/stage-deploy.sh:134 @ d814e5fa) (sync scripts/stage-deploy.sh:270 @ d814e5fa). | No | None stated in our code. | (sync scripts/stage-deploy.sh:214 @ d814e5fa) |
| An SMTP provider | The identity service's consent emails. The provider is set by configuration, not fixed in code. | No | None stated in our code. | (sync scripts/stage-deploy.sh:235 @ d814e5fa) |
What is not affected
- Nothing is sent to a third-party service for processing when you read or search; the traffic itself passes through Vercel and the Cloudflare Worker in transit (see the transit row); search is full-text inside the confidential machine, over a SQLite database file there (conclave config.py:283 @ 2c57664) (conclave storage/sqlite.py:19 @ 2c57664). The Ask feature, when enabled, sends your question and transcript context to NEAR AI for one synthesis call (conclave api/kb_routes.py:495-498 @ 2c57664) (conclave frontend/src/app/search/page.tsx:62 @ 2c57664); it is disabled unless
ENABLE_ASKis set and answers 404 otherwise (conclave api/kb_routes.py:479-480 @ 2c57664) (conclave api/kb_routes.py:502-503 @ 2c57664), and the deployment does not set it. - Voiceprints stay in the identity service, which stores encrypted voice measurements and no audio (FPM fpm/store/store.py:1-5 @ 9090288) (FPM fpm/store/store.py:108 @ 9090288).
- A name is shown only when that person's consent is 'allow' (FPM main.py:240 @ 9090288) (FPM main.py:484 @ 9090288). A name tied to an email is bound only after that person confirms, once per workspace, or when the person tags themselves (FPM main.py:332-335 @ 9090288) (FPM main.py:421-433 @ 9090288) (FPM main.py:400-402 @ 9090288) (FPM main.py:414 @ 9090288). A development flag can bypass confirmation; it is not set in the deployment (FPM config.py:137 @ 9090288) — the deploy script sets no such value. A display name without an email can still be recorded by the host through a legacy path (FPM main.py:338-339 @ 9090288); it is not shown without consent (FPM main.py:240 @ 9090288).
- Stored recordings are encrypted at rest on the confidential machine with a hardware-sealed key, so the operator holds ciphertext at rest; operator-blind at rest applies to stored recordings (conclave infra/audio_crypto.py:1-18 @ 2c57664). The code also accepts an environment key or a development keyfile outside the hardware (conclave infra/audio_crypto.py:17-18 @ 2c57664), and the trust page itself notes that the running code's registers are not checked against a published image (conclave frontend/src/app/trust/page.tsx:602-604 @ 2c57664). The database is a file on the confidential machine (conclave storage/sqlite.py:19 @ 2c57664) (conclave docker-compose.yml:195 @ 2c57664); the application does not encrypt it separately, so it relies on that machine's disk and access controls. This covers data at rest; it does not cover the final pass, when the recording is decrypted for the worker (see the final-pass row) (conclave api/diarize_result_routes.py:69-82 @ 2c57664).
Interim arrangements and what changes them
- Deepgram and the post-pass machine sit outside attested hardware (conclave docker-compose.yml:234-235 @ 2c57664) (sync docs/deploy/DEPLOYMENT-GUIDE.md:59 @ d814e5fa). Moving speech and speaker work back inside is a locked decision with consequences binding on later decisions, and no date (sync docs/decisions/DECISIONS.md:163-168 @ d814e5fa). Until then we describe what runs today (sync docs/decisions/DECISIONS.md:170 @ d814e5fa).
- NEAR's attestation is checked for genuineness and freshness. It is not checked for per-answer signatures or GPU evidence (conclave infra/model_attestation.py:1-30 @ 2c57664). It is not a precondition on each request (conclave infra/model_attestation.py:418-443 @ 2c57664).
- No automatic purge runs for transcripts (conclave transcripts/retention.py:12-14 @ 2c57664), and none exists for audio (conclave config.py:144 @ 2c57664).
- The public
/trustpage shows the hardware quote (conclave frontend/src/app/trust/page.tsx:386 @ 2c57664) and these limits (conclave frontend/src/app/trust/page.tsx:598 @ 2c57664). It states that speech-to-text runs outside the enclave (conclave frontend/src/app/trust/page.tsx:613 @ 2c57664). That sentence understates it: the audio itself leaves, decrypted, to Deepgram and to the worker (rows above); listed for correction in conclave#112. - When Deepgram is retired or the worker moves, this document changes in the same change set (sync#73).
Published copy this document corrects
Tracked in conclave#112 (filed 2026-10-13). Each line below contradicts a row above.
- conclave
frontend/src/app/dashboard/page.tsx:177@ 2c57664: "Confidential Enclave active", with no mention of the processing outside it (conclave docker-compose.yml:234-235 @ 2c57664). - conclave
frontend/src/app/search/page.tsx:145@ 2c57664: "Enclave Sandbox Safe · Intel Attested", while answers come from NEAR AI (conclave docker-compose.yml:45 @ 2c57664). - conclave
frontend/src/app/page.tsx:446@ 2c57664: says plaintext does not leave the enclave. - conclave
frontend/src/app/page.tsx:209@ 2c57664: "Zero external calls on the read path", without saying audio is processed outside (conclave docker-compose.yml:234-235 @ 2c57664). - conclave
frontend/src/components/record-meeting.tsx:101@ 2c57664: "Streamed live to the enclave", while live words and speaker turns go to Deepgram (conclave docker-compose.yml:234-235 @ 2c57664). - conclave
README.md:44@ 2c57664: describes Deepgram as temporary and flag-gated, while it is the configured live engine (conclave docker-compose.yml:234-235 @ 2c57664). - conclave
README.md:100@ 2c57664: names RedPill as the default LLM backend; the code allows only NEAR AI and Ollama (conclave config.py:37 @ 2c57664). - conclave
frontend/src/app/settings/page.tsx:95@ 2c57664: a "Transcript retention" setting, while no scheduled purge runs (conclave transcripts/retention.py:12-14 @ 2c57664).