// Security

Trust & Privacy

Prelude handles confidential customer call transcripts. Trust posture is a product feature, not a policy page. Here is exactly what happens to your data — what we do, and what we deliberately do not do.

No training on your data, ever

Your transcripts, artifacts, Vault content, and writing samples are never used to train models — ours or anyone else's. The model providers we use are configured so that your content is not used for their training either (see Subprocessors below).

UK/EU data residency

Your data is stored in the UK/EU. Our database (Neon Postgres) is pinned to the eu-west-2 (London) region, and the application runs on Vercel. The region is fixed at creation rather than migrated later.

Client-side redaction before anything is sent

Redaction runs in your browser. When it is on, customer names and other PII are removed from a transcript before it ever leaves your machine — even files you “upload” are read locally and never sent as files. What the server stores is the text as submitted: the redacted version when redaction is on.

Redaction is a real, labelled control with a review step, and each call honestly records whether it was redacted before sending. If you turn it off, we tell you plainly that the raw transcript will leave your browser and be stored unredacted.

The boundary is client-trusted. For pasted and uploaded transcripts the redaction runs entirely on your device and we store exactly what your browser submits — we never receive the raw text to re-check it. The raw transcript lives only in your browser’s memory; the single thing sent to us is the final (redacted-when-on) text. That means the guarantee is enforced by the client, by design, not re-verified on our servers.

Connected sources are different. When you connect Gmail or Calendar, the provider sends that content to our server, which redacts it server-side before it is stored or processed. So the “raw never leaves your device” guarantee applies to paste and upload; for connected sources the raw content transits our server in memory for the redaction pass and only the redacted text is kept.

What each processor sees

The only third party that receives transcript content is Anthropic, which generates and reviews your artifacts. When the Answer Vault is enabled, chunks of Vault content are also sent to Scaleway's EU-sovereign Generative APIs to compute embeddings. Both are configured for no-training and zero/short data retention. Content sent to these processors is post-redaction.

Adding any new third party that receives your content is treated as a security review, not a routine change.

Hard delete — no soft-delete

When you delete your account, your data is hard-deleted. Deleting your user record cascades through every deal, call, artifact, version, Vault item, embedding, and questionnaire you own — there are no soft-delete flags hiding your content after the fact. You can do this yourself from your Account page. It is immediate and irreversible.

Transcript content is never logged

We log metadata only — identifiers, durations, token counts, and sanitized error messages. Transcript or artifact content is never written to logs, error messages, analytics events, or URLs.

Security posture

  • UK/EU data residency (Neon eu-west-2, London).
  • Authentication and session management via Clerk.
  • Client-side PII redaction before content leaves the browser, on by default.
  • AI calls are bounded server-side: timeouts, retries, token budgets, and per-user daily spend caps.
  • Metadata-only logging; content never logged.
  • Hard deletes, enforced at the database layer.

We do not currently hold SOC 2 or ISO 27001 certification. Formal certification is on our roadmap; we will only claim it here once it is actually in place.

Subprocessors

The third parties that process your data on our behalf:

  • Anthropic — AI generation and review of artifacts. Receives transcript content (post-redaction). No training on your data.
  • Scaleway (EU-sovereign) — Vault embeddings, only when the Answer Vault is enabled. Receives Vault content (post-redaction). No training; zero/short retention.
  • Neon — Postgres database hosting (eu-west-2, London). Stores your content at rest in-region.
  • Vercel — application hosting.
  • Clerk — authentication and identity.