Security and Data Protection Appendix

This appendix describes the main technical and organizational measures implemented by Objeqo to protect data processed in connection with the Application, the Extension, and related services.

It supplements the Terms of Use and Privacy Policy. It applies to processing carried out by Objeqo on its own behalf and, when the Client determines the purposes of processing, to data processed on the Client’s behalf.

Measures may evolve to account for changes to the Service, identified risks, regulatory requirements, and security recommendations. Objeqo does not guarantee absolute security or continuous availability of the Service.

• account, authentication, profile, subscription, and support data;
• offers, prospects, briefs, notes, calls, transcripts, memories, objections, signals, and reports;
• voice and audio recordings when the User authorizes microphone or tab audio capture;
• technical data necessary for connection, Extension operation, diagnostics, security, and traceability.

Access to data is limited to individuals, technical accounts, and service providers who need it to provide, secure, or maintain the Service. Internal access is granted according to job responsibilities and must be revoked when no longer needed.

Users access the Service through an authenticated account. Application data is linked to the owner account, and access controls verify the authenticated identity before the relevant operations.

Credentials, secrets, and technical keys must be stored in appropriate environments and must not be disclosed to end users. AI API keys are stored and used on the server side; they are not exposed to the browser or the Extension.

Application tables exposed by the database are protected by row-level access rules. These rules limit operations to data belonging to the authenticated User or authorized under the Service’s access model.

Create and update operations also verify that account ownership cannot be transferred to another User through an authorized request.

Functions, server routes, and AI processing must verify authentication, association with the relevant call, and data ownership before any read or write.

Audio recordings are stored in private storage. Storage rules limit reading, adding, modifying, and deleting files to those placed in the authenticated User’s folder.

Replay does not rely on a permanent public URL. When a recording is accessed, Objeqo generates a temporary signed link, limited in duration and associated with the path to the relevant recording.

The User must verify capture permissions and comply with applicable participant notice and consent requirements before any audio capture, transcription, or retention.

Communications between the browser, the Extension, the Application, and hosted services use secure connections when those services support them. Encryption and at-rest protection settings also depend on the hosting and storage providers used by Objeqo.

Production secrets, including API keys, must not be included in client-side code, the distributed Extension, or public variables. Only values explicitly intended for the browser may be exposed in the Application’s public variables.

Logs and error messages should avoid containing secrets, session tokens, audio recordings, or the full content of conversations when they are not needed for diagnostics.

Objeqo may use subprocessors necessary to provide the Service. Supabase provides authentication, database, realtime, and storage services. Deepgram provides real-time audio transcription. OpenAI provides AI and structured generation functions. Cloudflare provides Application hosting and delivery. Resend provides transactional email and support notifications. Stripe provides payment and billing information management when these functions are enabled. Google Calendar API synchronizes scheduled calls when the User enables this integration. Google Analytics is used only to measure traffic on public pages after consent.

Google Calendar refresh tokens are encrypted server-side using AES-GCM. The connection and mapping tables are not accessible to public or authenticated Data API roles.

Google Analytics configuration excludes private routes, query parameters, transcripts, audio recordings, prompts, and call content. Google Signals and ad personalization are disabled.

Deepgram streams use the European endpoint when it is available for the relevant feature. Transcription requests are configured to opt out of the model improvement program. The browser receives only a temporary Deepgram token, while the permanent API key remains server-side.

Objeqo selects service providers that offer appropriate safeguards, governs their access, and requires them to meet confidentiality and data protection obligations appropriate to the processing entrusted to them.

Processing locations and applicable transfer safeguards depend on the regions, options, and services enabled on the relevant accounts. Objeqo takes into account the contractual documents and subprocessor lists published by these providers and shares them with the Client upon request.

Backups, restoration, and technical continuity rely on the capabilities and configurations of the hosting, database, and storage providers used by Objeqo. Backups are protected by access controls and do not constitute an archive directly accessible to Users.

Objeqo uses reasonable measures to restore the Service and limit data loss in the event of an incident. Unless otherwise agreed in writing, no recovery time, recovery point objective, or specific availability level is guaranteed.

Maintenance, updates, and configuration changes are carried out as needed for the Service and may result in temporary unavailability when necessary for security or stability.

Objeqo has a process in place to detect, analyze, and address incidents affecting the confidentiality, integrity, or availability of data and the Service.

Any suspected unauthorized access, data loss, or vulnerability can be reported promptly to security@objeqo.com. Reports are reviewed based on their severity and potential impact.

If a personal data breach affects processing carried out on behalf of the Client, Objeqo will notify the Client as soon as possible after becoming aware of it and provide the available information needed to assess and fulfill the Client’s own notification obligations.

At the end of the Service, Objeqo returns or deletes data processed on behalf of the Client according to the Client’s documented instructions, subject to legal retention requirements, technical backups, and applicable deletion timelines.

The timelines for returning data, deleting it from production, and purging backups are specified in the Terms of Use, the contract, or the applicable order form when they need to be adjusted to the Client’s circumstances.

This appendix is revised when the security measures, essential service providers, or Service architecture change significantly. The applicable version is the one provided or made available to the Client for the relevant period.