Security Overview
This page summarizes how Live Assist protects data. Operator: Inspire Inc. (株式会社インスパイア). Last updated: October 19, 2026.
1. Architecture and data flow
- The user signs in to Live Assist (Next.js on Railway, HTTPS only).
- The user connects Zoom via OAuth 2.0 (authorization code flow). Live Assist stores the encrypted tokens.
- When the user selects a meeting, the server calls the Zoom API (read-only) to fetch the transcript. The recording file is streamed to the user's browser on demand and is not stored on our servers.
- The transcript and related text are sent to Anthropic's API to generate analysis and reports. Results are stored on our persistent volume for that user.
2. Access to Zoom data
- Scopes:
user:read:user, cloud_recording:read:list_user_recordings, cloud_recording:read:list_recording_files — all read-only. - Only the meetings a user explicitly selects are processed. Zoom data is not used for advertising, sale, or profiling.
- The OAuth
state parameter is HMAC-signed, bound to the signed-in user and provider, and expires after 10 minutes (CSRF protection).
3. Data protection
- In transit: HTTPS with HSTS.
- OAuth tokens: encrypted at rest with AES-256-GCM; the key is held in the server environment and is not stored with the data.
- Passwords: salted scrypt hashes.
- Interview data and accounts: the database files (accounts, candidates, imported transcripts, reports) and audio recorded in the browser are encrypted at rest at the application layer with AES-256-GCM before being written to the hosting provider's persistent volume. The data key is supplied through the server environment and is never stored on the volume. Data is separated per account; every API checks that the data belongs to the signed-in user.
- Integrity: files are authenticated (GCM); a tampered or wrongly keyed file is rejected and never overwritten. Writes are atomic.
- Sessions: HMAC-signed cookies, HttpOnly, Secure, SameSite=Lax; login attempts are rate limited.
- Browser security headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy.
4. Sub-processors
- Railway Corp. — hosting.
- Anthropic, PBC — AI analysis (receives transcript and document text).
5. Retention and deletion
Data is kept until the user deletes it. Users can delete an interview, a candidate, or the whole account in the app; deletion removes the data and the stored audio files immediately. Disconnecting an integration deletes its tokens. If a user removes the app in Zoom, Zoom sends a signed notification (verified with the app's secret token, HMAC-SHA256, with replay protection) and we delete the stored Zoom tokens automatically; if Zoom indicates the user's data must not be retained, interviews imported from Zoom are deleted too. See the Privacy Policy.
6. Current status (stated honestly)
- We do not currently hold SOC 2 or ISO 27001 certification, and have not yet had a third-party penetration test.
- We do not currently run a formal secure-development process or automated static/dynamic security testing.
- Encryption keys are managed by the operator through environment variables; automated key rotation is not yet available.
7. Reporting a vulnerability or incident
Please email yuichiro_iwashita@insp.co.jp. We will acknowledge the report, investigate, and notify affected users where required.