Security and your data
Where your data is held
Your data is stored in your account's region: the European Union for an account on our EU region, North America for an account on our US region.
It is encrypted in transit and at rest, with access controlled and logged.
A few things run on services that are not tied to one region, among them a meeting's working state while it runs, the search index and our service logs. Our privacy policy lists every one.
Who processes it
Six providers process customer data for us: Cloudflare (hosting and storage, search indexing and voice-note transcription), TypeSafe AI (search ranking), Amazon Web Services (AI processing, web search, backup transcription and email), Deepgram (speech-to-text), Anthropic (AI models, reached through AWS) and Stripe (payments and invoicing).
They are named in our privacy policy, and a change to the list is published as a new version of it.
How one customer's data is kept apart from another's
Every customer's data is kept separate.
Each account's data is isolated behind a single access gateway.
What leaves the platform, and when
When you record, audio streams straight from your browser to our speech-to-text provider.
When Astra writes a summary or an answer, the model that writes it runs inside AWS. For an account on our EU region the request is received in London and the model runs in our cloud provider's European regions. For an account on our US region the model runs in a US region.
When Astra searches your documents, the search and a passage from each of up to 20 of the closest matches go to TypeSafe AI in the United States, whose model puts the best first.
When Astra looks something up on the web, it first rewrites the question to take out private details. Only what is left is sent.
We share personal data only with those providers, with your own business, and with authorities where the law requires it.
We do not sell your content, and we do not show it to other customers.
How AI is used on your content, and by whom
Astra, Orvaly's AI, transcribes meetings, writes the summaries and records, answers questions from your vault, and drafts documents when asked.
We do not use your content to train AI models. Neither do our AI providers, except that we cannot yet confirm it for web searches.
AI output can be wrong. Check anything important before you rely on it or send it on.
What you can ask for, and how
You can delete a document from your vault at any time. It disappears from your workspace, search and AI answers straight away, and you can restore it within 30 days.
When your business closes its account, we delete its data and tell you what was removed, including anything we could not yet remove.
You can ask us to show you the personal data we hold about you, to correct it, to erase it apart from what we are required or allowed to keep, or to send you a copy in a portable format.
Write to privacy@orvaly.com. We respond within one month.
Who to write to
For a question or a request about your data: privacy@orvaly.com.
You can also complain to the Information Commissioner's Office.
Orvaly Ltd is registered as a data controller with the Information Commissioner's Office, reference ZC141714.