Security
Keeping Limly secure
Your meetings hold some of the most sensitive conversations you have. Keeping them safe is part of how we design, build and ship Limly.
Our goal is simple: you shouldn’t have to wonder whether your notes are being misused, mishandled or sold.
Here’s what that looks like in practice:
Local-first by design
Notes, transcripts and recordings live in a local database on your Mac. Nothing leaves it unless you turn on a cloud feature.
No bot in your calls
Limly captures your microphone and your computer’s audio on the Mac. It never joins a meeting as a participant.
End-to-end encrypted sync
Cloud Sync encrypts notes on your device with a recovery key kept in your keychain. Limly stores ciphertext, not your notes.
AI and transcription providers
Transcription runs on your Mac when it has Apple silicon, or through Limly Cloud when you choose it. The audio or text a request needs goes only to the provider behind the option you picked.
Hidden from screen sharing
Limly’s windows are left out of screen shares by default on macOS and Windows.
Infrastructure
Limly-operated services run in the United States and use TLS in transit. Cloud data is deleted within 30 days of deleting your account.
How to reach us
Questions about security or procurement? Email hello@limly.io.
Reporting a vulnerability
If you find a security or privacy issue in Limly, email security@limly.io. We acknowledge reports within 3 business days, keep you updated while we investigate, and credit you in the release notes if you’d like.
Please don’t open a public GitHub issue for security reports.
FAQ
The desktop app stores notes, transcripts, and meeting metadata in a local SQLite database. Optional Cloud Sync encrypts that content on the device with keys derived from a recovery key that stays in the operating-system keychain and never reaches Limly. Sync servers see encrypted records plus account and workspace identifiers, timestamps, sizes, and device names — not titles or note content. Data in transit uses HTTPS/TLS. Shared notes and Cloud API & Connectors are separate, opt-in paths that store a server-readable copy so a recipient or agent can open the note.
Local notes never leave the device unless a user enables a cloud feature. Limly-operated cloud — accounts, optional Cloud Sync ciphertext, shared notes, and hosted AI/transcription gateways — currently runs in the United States. Customer-hosted capture and a customer-controlled data plane are the way to keep meeting infrastructure in a region you choose. We do not offer a certified-cloud EU SKU today.
Local notes, transcripts, and recordings stay on the device until the user removes them. Audio retention on the desktop is a user setting (don't save, 1 day, 3 days, 1 week, 1 month, or forever). Cloud Sync records, transcription results, shared notes, and Cloud API copies are deleted within 30 days of account deletion unless the law requires a longer hold. Audio uploaded for cloud transcription is deleted from our storage once the job completes. Cloud API copies are deleted when the feature is turned off. Shared notes remain available until sharing stops or the account is deleted.
| Data | Kept until |
|---|---|
| Local notes, transcripts, and recordings | On the device until the user deletes them |
| Desktop audio files | User-selected: don't save, 1 day, 3 days, 1 week, 1 month, or forever |
| Cloud Sync, transcription results, shared notes, Cloud API copies | Deleted within 30 days of account deletion, unless the law requires a hold |
| Audio uploaded for cloud transcription | Deleted from Limly storage when the job completes |
| Cloud API & Connectors copies | Deleted when the feature is turned off |
Limly does not use notes, transcripts, audio, or connected calendar data to train AI models, and we do not sell that data. If a team uses on-device transcription and a local language model, meeting content never leaves the device for AI. If they use Limly Cloud or a bring-your-own-key provider, the audio or text needed for that request goes to the selected provider under that provider's terms — review that provider's retention and training policy before sending sensitive meetings.
The current processor list lives in the table below and in the privacy policy. Providers receive only what the enabled feature needs. Cloud Sync storage holds ciphertext. Speech-to-text and model providers receive content only when a user selects a hosted or bring-your-own-key route. Analytics and error tools are designed not to include meeting audio, transcripts, notes, or summaries.
| Processor | Purpose | What they can receive |
|---|---|---|
| Fly.io, Netlify, Supabase, Render, Amazon Web Services, Cloudflare | Hosting, authentication, storage, and downloads | Account data, operational metadata, and any server-side records created by an enabled cloud feature |
| SQLite Cloud | Cloud Sync storage | End-to-end encrypted sync records plus operational metadata |
| Composio | Calendar and connected-account integrations | Encrypted OAuth tokens and the calendar or issue-tracker data needed for a connected feature |
| Stripe | Payments | Billing details; Limly never stores card numbers |
| PostHog, Google Analytics, Microsoft Clarity | Product and website analytics | Pseudonymous usage events, page views, and optional website session replay — not meeting audio, transcripts, notes, or summaries |
| Sentry, Honeycomb | Error monitoring and observability | Sanitized diagnostics and crash reports with meeting content stripped |
| Deepgram | Optional cloud transcription | Audio for a transcription job when a user selects Limly cloud transcription |
| Vercel AI Gateway, routing to OpenAI, Google, and Anthropic | Optional cloud AI | The text and instructions needed for a summary or chat request the user starts |
| Exa, Jina | Optional web search from AI chat | Search queries when a user enables web search in chat |
| Loops | Email address and the content of transactional or marketing messages |
Limly does not send a meeting bot into Zoom, Google Meet, Microsoft Teams, or other calls. Capture happens on the desktop from microphone and system audio. That is the product, not a setting. Customer-hosted Meet or Zoom workers, when used by an enterprise pilot, are a separate capture path and are disclosed as such — they are not the default desktop product.
SOC 2, ISO 27001, AIUC-1, and HIPAA/BAA programs are planned after we have operational evidence. This page does not claim any of them. A hosted trust center — the Vanta or Oneleet surface buyers expect — comes after those programs start. It will be a separate site, not this page.
Yes, on request for team and enterprise evaluations. Request the DPA.
- Security review
Forward this site to IT, security, and legal. The security page, privacy policy, and source-visible client are the packet. We answer questionnaires from the same facts — we will not invent certifications. - Scoped pilot
A founder-led trial with a named team, a defined data boundary (local-only, encrypted sync, or customer-hosted capture), and a success check you choose. No SDR queue. - Rollout
Expand seats and policies after the pilot. Workspace admin, SSO/SCIM, or a customer-hosted data plane land with the teams that need them — not as a surprise bot in every meeting.
Documents
Need company-wide controls? Talk to us about Enterprise