Security

Current product information · Updated 23 August 2026

Current architecture

Meeting records and captured audio are stored locally first: IndexedDB on the web and app-private files on iPhone, iPad, Apple Watch, and Android. Native audio recovery validates readable duration and quarantines corrupt partial files. AI processing is not local: audio is sent through Donald’s Mic server routes to ElevenLabs, and transcript text is sent to MiniMax. Successful transcript and brief responses may be held for up to 24 hours in an application-encrypted Neon retry cache. The cache stores no raw audio bytes and uses hashed request identities rather than meeting titles.

Credential handling

Provider credentials are read only by server routes and are not included in browser JavaScript or native binaries. The retry-cache encryption key is also server-only. Native sign-in uses short-lived, single-use pairing codes. Device tokens are random, revocable, stored in Keychain or Android Keystore-protected storage, and represented in the database only by SHA-256 hashes. The shared development token is rejected in production. Meeting content is excluded from routine product analytics.

Private synchronization

Cloud records are scoped to the authenticated user, versioned, and written with durable idempotency keys. Pull responses include the exact versioned record needed for reconciliation. Meeting deletions use durable tombstones so an offline device can retry them. Private audio upload URLs expire after 15 minutes, use an account-scoped object path, and require a separate server confirmation before an audio-object record is accepted.

Known limitations

Local meeting content is not end-to-end encrypted by Donald’s Mic beyond the operating system's app storage protection. Provider retention, training, human review, and processing location depend on the configured provider accounts and are not enforced or verified by this application. Browser storage can be cleared or evicted unless the browser grants persistent storage. Cross-device sync protects transport and account boundaries but is not end-to-end encrypted from the Donald’s Mic server. Avoid recording material you are not authorized to process.

Report a security issue

Use the Support page and do not include audio, transcript text, meeting titles, participant names, or provider credentials in the first report.