Security
Security built around your audio.
Kiku makes a simple promise: turning a conversation into a transcript should never make it harder to protect. These are the controls behind the product today.
Last updated · October 23, 2026
Transport
TLS
Encrypted traffic in production
Storage
Encrypted
Audio and transcripts encrypted at rest
Training
No
Your audio is never used to train models
Controls
What protects your data
These controls cover the public site, signed-in pages, the database and the speech and AI providers that transcribe your audio.
Audio privacy by default
Recordings and transcripts are scoped to your account. Kiku does not sell them, share them with other users or use them to train models.
Encryption
Audio and transcripts are encrypted at rest, and production traffic is served over TLS with secure browser sessions.
Per-account access
Supabase Row Level Security returns only the rows that belong to the signed-in account, so one account cannot read another account’s transcripts.
Key separation
Public browser keys, server-only service keys and speech and AI provider keys are kept apart in environment configuration and never sent to the browser.
Input validation
API routes check request bodies before they reach business logic, and the contact form is rate limited.
Account control
Export your data, change your settings or delete your account and everything in it from Settings.
Development
Secure development practices
Security is part of how the product is built, not a checklist at the end.
- Validate every public API input before business logic runs.
- Keep authentication and authorization checks at route boundaries.
- Apply least-privilege access to service keys and infrastructure.
- Never log customer audio, transcripts or provider secrets.
- Run type, lint and test checks before production changes ship.
Customers
How to help keep your account secure
Accounts
Protect credentials
Use a strong, unique password, avoid shared accounts and sign out on shared devices.
Audio
Record with consent
Only record or upload conversations you have the consent and lawful basis to capture and transcribe.
Disclosure
Report issues quickly
Send security findings through the vulnerability disclosure policy.