Trust at Align

Who touches your data, what you control, and where we honestly are on compliance. If something here isn’t clear, email hello@meet-align.com.

Every service that handles your data

ServiceWhat it doesWhat it sees
SupabaseDatabase, sign-in and file storageYour account and everything in your workspace
Amazon Web Services (EC2, Mumbai, India)Runs Align's APIEverything you send to Align, while it's processed
VercelHosts the web appsPage requests; no workspace data is stored there
GroqThe language model for notes, tickets and answersTranscript text and the prompts built from it
OpenRouterA second model for context and decisionsPrompts and short excerpts
DeepgramSpeech-to-text and the voice in Align RoomsAudio from Align Rooms
LiveKitLive audio and video in Align RoomsThe call's audio and video streams
PostHogProduct analyticsPage visits and events like “started a room”, never content
Titan (GoDaddy) emailSends Align's emailsYour email address and the message

Tools you connect: Jira, Linear, GitHub, Slack, Google and Microsoft calendars, Notion and Figma, only when you connect them, and only what that connection allows.

What you control

  • Download your data any time: Settings → Data & audit gives you one file with everything that’s yours. Passwords, tokens and keys are never in it.
  • Delete your account from Settings. Your account and the data tied to it go with it; meetings you hosted stay in the workspace without an owner.
  • See what happened on your account in the audit log: connections, keys issued to your apps, and every ticket move you approved or Align made for you.
  • Nothing changes without you by default: tasks and ticket moves Align suggests wait for your click, unless you turn on auto-move for your own tickets. Automatic moves can be undone.
  • Disconnect any tool from Settings → Integrations, and switch off any key issued to the browser extension, the Mac app or a git hook.

How it's protected

  • Encrypted in transit (TLS) everywhere, and at rest by our database provider.
  • Tokens for Jira, Linear, GitHub and other tools are encrypted again with Align’s own key before they’re stored.
  • Keys for the browser extension, Mac app and git hooks are stored only as hashes, and can be switched off.
  • Incoming webhooks are verified: GitHub by signature, Jira by its signed token, Linear by its secret.
  • The GitHub App is read-only: it reads pushes, branches and pull requests, and never writes to your code.

AI and your data

We don’t train AI models on your data. Text and audio are sent to the model providers above only to produce your notes, tickets and answers, under their data terms.

During early access some calls use a provider’s free tier, whose terms may allow it to keep what it processes. If you’re bringing regulated or very sensitive material, tell us first and we’ll say exactly which path it takes.

How long we keep things

  • Workspace content stays until you delete it or your account.
  • A room started without an account is kept in memory and deleted shortly after it ends.
  • A task you delete in Plans stays deleted, even if its Jira or Linear issue is edited later.
  • Sync logs for Jira and Linear are cleared after 7 days.

Compliance, honestly

Align doesn’t hold SOC 2, ISO 27001, HIPAA or FedRAMP certifications yet. We aim to meet GDPR obligations: you can export and delete your data yourself, and we answer access requests by email.

If your company needs a security review or a data processing agreement, email us and we’ll answer directly.

Report a security issue

Email hello@meet-align.com. We look into it promptly and tell affected customers if their data is involved.

More detail: Security & privacy · Privacy notice · Terms