Security & trust
Executives rehearse sensitive, often unreleased messaging on MediaTraining.AI. We treat that data accordingly — kept in the EU, encrypted, and strictly isolated per organization.
EU data residency
Core account, project and report data is stored in Supabase's eu-west-1 (Ireland) region. Recordings use the configured Cloudflare R2 storage location. Some AI and meeting providers process data internationally, as described in our Privacy Policy.
Encrypted in transit & at rest
Every connection to the platform is encrypted with TLS, and your data is encrypted at rest on managed, audited infrastructure.
Isolated per organization
Row-Level Security (RLS) is enforced on every table in the database. A company or agency can only ever read its own data — isolation is enforced at the data layer, not just the UI.
Facial analysis on your device
In video mode, facial analysis runs entirely in the executive's browser (MediaPipe). Only the derived metrics are saved — the video itself is never sent to an AI provider for analysis.
Your content never trains AI
We use AI providers through their API tier, where prompts, transcripts and documents are not used to train their models. Your messaging stays yours.
We never store card data
Subscriptions and payments are handled entirely by Stripe (PCI DSS Level 1). Card numbers never touch our servers.
Access controls
Authentication is handled by Supabase Auth. Service-role access is server-side only and gated by ownership checks; sensitive operations are verified per request.
What we store, and where
A clear view of each type of data — where it's processed and where it rests. Stored data is encrypted; some providers process data outside the EU as described in our transfer safeguards.
| Data | Processed | Stored | Region |
|---|---|---|---|
| Facial analysis | On your device | Derived metrics only | — (browser) |
| Live voice | OpenAI (API) | Transcript and session metadata | International processing → EU storage |
| Video / audio recording | Your browser; Recall.ai when Live Meeting is enabled | Cloudflare R2 and/or Supabase Storage | Configured storage region |
| Account, projects, reports | Supabase | Supabase | EU (Ireland) |
Built on certified infrastructure
We build on industry-leading providers so your data sits on audited, certified infrastructure. The certifications below belong to these providers.
Supabase
Database, auth, storage (EU)
Vercel
Application hosting
OpenAI
Interview transcription, conversation, TTS & reports (API)
ElevenLabs
Self-Modeling voice cloning and audio generation (optional)
Stripe
Payments
Resend
Transactional email
Cloudflare
Video storage (optional)
Backblaze B2
Encrypted recovery backups (EU)
Calendar & Meet integration (optional)
Recall.ai
Live-meeting transport (when enabled)
Compliance & your rights
GDPR & LGPD. We are built for European (GDPR) and Brazilian (LGPD) privacy expectations: EU data residency, a clear Privacy Policy, and self-service data rights.
Access & erasure. From your account Settings you can export all of your data as a file, or permanently delete your account and its data at any time.
We don't currently hold our own SOC 2 / ISO 27001 / HIPAA certifications — those shown above belong to our infrastructure providers. If your organization requires a specific certification or a signed DPA, get in touch.
Last reviewed: July 2026