inlocus

Security

How Inlocus protects your meetings.

We record audio from your conversations to draft tasks. We take that responsibility seriously — and the browser-extension model gives us a stronger story than typical meeting tools. This page is the long version.

LAST UPDATED · APR 27, 2026·QUESTIONS? support@inlocus.co

How recording works

Inlocus does not send a bot to your meeting. We are a browser extension that runs in the same Chromium tab as your Google Meet call. When recording is enabled, the extension captures the meeting's audio stream locally on your device and uploads it over an encrypted channel to our processing infrastructure.

Because there is no third-party participant, your attendees never see "Inlocus has joined." Recording state is visible only to you, in the extension popup.

Data we store

For every meeting you record, we store:

  • The audio file — used to generate a transcript, then optionally retained per your retention policy.
  • The transcript — text version of the audio, used to draft action items.
  • Drafted tasks — the action items we generate, including any edits you make before approving.
  • Meeting metadata — title, date, duration, attendees (from your calendar, if connected), and the IDs of the Asana tasks we sync.

We do not store video. We do not store the contents of any other browser tab. We do not have access to anything outside the Meet tab.

Encryption

All data in transit is encrypted with TLS 1.2 or higher. All data at rest — audio, transcripts, drafted tasks — is encrypted with AES-256. Our infrastructure runs on Google Cloud Platform in us-central1 and europe-west1; you can choose your region during workspace setup.

Retention & deletion

Workspace admins set a default retention window. Options are 7, 30, or 90 days, or delete-after-each-meeting (recording and transcript discarded as soon as drafts are produced).

Individual users can override the default for any specific meeting from the meeting detail page. Deleting a meeting purges the audio and transcript from primary storage immediately and from encrypted backups within 30 days.

Approved Asana tasks are not deleted from Asana when the source meeting is deleted — those live in your Asana workspace, where you control them.

Access controls

Workspace admins control who has access to recordings and transcripts. By default, a meeting is visible only to the user who recorded it; admins can choose to make meetings visible to all members of the workspace or scope them to specific Asana projects.

Single sign-on (SSO) via Google Workspace is available on every plan. SAML SSO and SCIM provisioning are available on the Team / Enterprise tier.

No AI training

We do not train AI models on your meeting content. Period. No audio, transcript, or drafted task from your workspace is used to train, fine-tune, or evaluate any model — ours or a vendor's.

We use third-party model providers to run transcription and task drafting. Those vendors are contractually bound under our data-processing agreements to not retain or train on the content we send them. The current list is in Sub-processors below.

You are responsible for getting consent from meeting attendees before recording — laws vary by jurisdiction. Inlocus provides tools to help:

  • Calendar pre-notice — admins can configure an automatic line in calendar invites announcing that the meeting may be recorded.
  • Per-attendee opt-out — any attendee can email us to request their voice be excluded from a specific recording or globally.
  • Pause — recording can be paused at any time from the extension popup, with a one-click resume.

Sub-processors

We work with a small set of vetted infrastructure providers:

  • Google Cloud Platform — primary hosting and storage.
  • OpenAI — transcription and task drafting (zero-retention API).
  • Stripe — billing.
  • Postmark — transactional email.

This list is the complete set of vendors with access to customer content. We notify customers in advance of any change.

Vulnerability disclosure

If you've found a security issue, please email support@inlocus.co. Please do not open a public issue or post details elsewhere until we've had a chance to address it. We aim to acknowledge reports within 2 business days and to provide a fix or mitigation within 30 days for confirmed issues.

We do not yet run a paid bug bounty program, but we say thank you publicly (with your permission) and we owe you a meaningful credit.

Contact

Anything else — DPAs, customer-specific addenda, questions about this page — write to support@inlocus.co. A real human will reply.

Related: read our Privacy Policy and Terms of Use.