How we handle your transcripts

What happens when you upload a transcript

1. 1

   You upload a transcript

   The file is parsed to text and stored in your account. It is not sent anywhere external yet.

2. 2

   PII redaction (before any AI call)

   A local redaction layer (Microsoft Presidio plus custom recognizers) scans the transcript before any AI call. Every person’s name — the meeting participants (speakers) and anyone mentioned but not present alike — is reduced to bare initials (e.g. "Sarah Chen" becomes "SC", used consistently throughout), so the AI can still follow who said what without seeing real names. Other sensitive items — emails, phone numbers, addresses, government identifiers, employee IDs, API keys, dates of birth — are replaced with placeholder tokens like <EMAIL_1>, <EMPLOYEE_ID_1>. The original text never leaves our backend.

3. 3

   Redacted text is sent to the AI provider

   Only the redacted transcript is sent to the AI provider (OpenAI by default). We send every request with store=false, which disables OpenAI-side storage of the conversation, and OpenAI does not train on API data. Standard provider retention (up to 30 days, for abuse-monitoring) still applies.

4. 4

   AI response references speakers by name

   The AI only ever saw initials — every person’s name, yours included, is reduced to bare initials before the request leaves our backend. A reversible mapping of initials to names is kept encrypted on our side and applied when your analysis is displayed, so the coaching reads with real names even though none were sent. You can confirm exactly what was sent on any analysis via “View what was sent to the AI”, which always shows the redacted version. Other redacted details — emails, phone numbers, ID numbers — stay masked everywhere, including for you.

What we detect and redact

The redaction layer is configured with multiple aggressiveness levels (Conservative, Standard, Permissive). Standard is the default. The categories below are detected across all levels.

What we don’t redact (and why)

Some categories of information are intentionally preserved in the redacted transcript. These are deliberate design choices, not oversights — each has a specific reason.

Before and after

A representative example of a short 1:1. Every name — the speakers (Sarah Chen, Daniel Park) and people mentioned but not present — is reduced to consistent initials; other sensitive identifiers become opaque tokens.

What happens at the AI provider

• Requests are sent with store=false on OpenAI, which disables OpenAI-side storage of the conversation; OpenAI does not train on API data. On the default tier, OpenAI’s standard 30-day abuse-monitoring retention applies. Zero data retention is available through OpenAI’s enterprise agreement for higher-volume deployments; bring-your-own-endpoint or self-host route around vendor retention entirely.
• Customer organizations can configure their own LLM endpoint per-org (Azure OpenAI, enterprise OpenAI, OpenAI-compatible proxy, or Anthropic-direct) so transcripts route through their own contract instead of ours. Set up by your organization admin in Settings.
• We never send raw transcripts to any third-party service for storage, analysis, or any other purpose.

How your data is stored on our side

• Customer data lives in a managed Postgres database (Railway managed Postgres on Google Cloud Platform, US West region). Customer content is encrypted at rest at the application layer with AES-256-GCM under a per-organization key; on our hosted service the root key is held in AWS KMS (adding decrypt audit + key revocation). Standard cloud-managed AES-256 volume encryption applies to the database and all backups beneath that.
• Each organization's data is logically isolated via row-level tenancy keys (organization_id) and enforced at every API endpoint. Coachees outside an organization see only their own data.
• Raw transcript text and the redacted version (the exact text sent to the AI) are stored separately. You can view the redacted version on each analysis result.
• A reversible mapping of placeholder tokens to original values is kept securely — encrypted at rest, configurable per-organization — so admins can audit exactly what was redacted on any given run.
• You can delete a transcript and its analyses at any time from the run detail page.

Connecting your meeting tools (Zoom, Google Meet)

Instead of uploading each transcript by hand, you can connect a meeting account once and Myc will import new transcripts from meetings you host automatically. Connecting is optional, always your choice, and you can disconnect at any time. Here is exactly what Myc accesses, and why.

Imported transcripts are treated exactly like transcripts you upload yourself: PII-redacted before any AI call, encrypted at rest, and never used to train any model (see the sections above). The access tokens for your connected accounts are encrypted at rest. Google and Zoom user data is used only to provide the coaching features described on this page — we never sell it, never use it for advertising, and never share it with third parties except the AI provider that produces your analysis, and then only the redacted text.

You can disconnect a meeting account any time from Connected Apps in Myc, which stops all future imports. You can also revoke Myc’s access directly from your Google Account (myaccount.google.com/permissions) or your Zoom account settings.

Myc’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.