Security

Notes, recordings, transcripts, and agent memory are stored in a local, per-install database on the device running Optiq, not on our servers. The identity and billing service that handles your organization's sign-in, membership, and billing is intentionally kept separate from that content, and never receives your prompts, audio, transcripts, or files.

When a feature needs AI inference, only that specific request leaves the device, routed through a confidential backend. By default, requests are handled by private Venice models under a zero-data-retention policy: the request is not stored by the provider and is not used for training. A confidential, TEE-backed fallback is used only when needed to keep the Service available, and is designed to operate without falling below zero retention. Dictation and meeting transcription may use OpenAI's transcription models for that specific task.

Where a request does need our backend, it is designed to run inside a confidential virtual machine, a trusted execution environment (TEE) that keeps the code and data running inside it opaque to the infrastructure operator itself. We are building toward a public attestation page that will let anyone verify the exact source commit running in production, rather than asking you to take our word for it. This attestation capability is part of our architecture today; the public verification page is not yet live, and we'll announce it here once it is.

Desktop builds are signed and notarized before they reach you: macOS builds are signed with an Apple Developer ID and notarized by Apple, and Windows builds are signed with an Authenticode certificate. Automatic updates are verified against a dedicated update-signing key before they are applied, so what you install and what you're updated to is what we shipped.

Optiq does not join meetings as a bot or participant. Supported meetings are detected automatically on your device, and Optiq records the microphone, or the microphone plus system audio, directly on the device, with your action. There is nothing dialing into the call on our end.

Requests between the Optiq application and our backend, and between our backend and model providers, are encrypted in transit using TLS. Protection of data at rest on your own device depends on your operating system's disk encryption (such as FileVault or BitLocker); we recommend enabling it.

Enterprise plans can configure Optiq to route model inference through their own Venice API key instead of the shared default, giving that organization direct control over its own inference relationship and terms with Venice.

We'd rather tell you this plainly than let you assume it: Optiq is in private beta, and we have not yet completed a formal HIPAA compliance program, an independent third-party security audit, or Business Associate Agreements (BAAs) with our model providers. The public attestation page described above is also not yet live. If your organization needs any of these in place before deploying with real patient, client, or financial data, talk to us first at the email below so we can be specific about timelines.

If you believe you've found a security vulnerability in Optiq, please report it to us before disclosing it publicly. We ask that you:

• Give us a reasonable amount of time to investigate and address the issue before any public disclosure;
• Avoid accessing, modifying, or deleting data that isn't your own while investigating; and
• Provide enough detail (steps to reproduce, affected component, potential impact) for us to act on your report.

We'll acknowledge good-faith reports and keep you updated as we work on a fix.