Security for AI Meeting Assistant

Information Security Program

Krisp’s Information Security Program is designed to ensure the highest level of protection for all data entrusted to us. We take a proactive and comprehensive approach to secure our applications, infrastructure, and associated services. Krisp employs information security policies and there is an executive-level commitment to implementing and following the policies throughout the organization. The Information Security program is led by the Head of Security @ Krisp.

Trust Center

At Krisp, we are committed to upholding the highest standards of privacy, security, and reliability for your data. As a trusted provider of noise-canceling technology and real-time voice enhancement, we understand the critical importance of protecting your information.

Our Trust Center provides a clear and comprehensive overview of our dedication to safeguarding your data and maintaining adherence to industry-leading compliance standards.

The Trust Center also offers detailed insights into the security practices and solutions implemented by Krisp to protect your data. You can access our certifications, penetration test reports, and policies to gain a deeper understanding of Krisp’s security posture.

SOC-2 Type II Audit

SOC 2 Type II report demonstrates our commitment to strong security and privacy practices to our customers, business partners, and other stakeholders. SOC 2 (Service Organization Control 2) is a widely recognized auditing standard developed by the American Institute of CPAs (AICPA) that focuses on the evaluation of a service organization’s controls over security, availability, processing integrity, confidentiality, and privacy.

You can download Krisp’s SOC-2 Type II audit report from Krisp’s Trust Center.

PCI DSS Certification

Krisp has achieved PCI DSS (Payment Card Industry Data Security Standard) certification, underscoring our unwavering commitment to maintaining the highest standards of security for our customers, business partners, and stakeholders.

Although Krisp does not process payments directly, we have obtained PCI DSS certification to ensure that any potential Cardholder Data (CHD) present in our customers’ data while using our offerings is stored and processed in compliance with globally recognized best practices and standards.

HIPAA Compliance

Krisp is committed to safeguarding Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA). Our AI Meeting Assistant is designed with robust security and privacy controls that support HIPAA compliance:

Data Protection & Encryption

All data, including electronic PHI (ePHI), is encrypted both in transit and at rest using industry-standard encryption protocols to prevent unauthorized access.

Access Controls & Monitoring

Access to ePHI is strictly controlled using Role-Based Access Control (RBAC), granted only on a need-to-know basis. Krisp uses a Security Information and Event Management (SIEM) solution that continuously monitors access to ePHI and triggers alerts for any access, whether authorized or not.

Data Retention & User Control

PHI is retained in accordance with Krisp’s Data Retention Policy. Users can request to access or delete their data at any time.

Geographic Data Storage

All data is stored on secure servers located in the United States. At this time, Krisp does not offer regional data storage options.

Business Associate Agreements (BAAs)

Krisp enters into BAAs with customers and relevant partners to ensure that all parties handling PHI adhere to HIPAA requirements.

Training & Organizational Oversight

All Krisp employees undergo HIPAA compliance training at least annually.

Customer Data

Krisp is a desktop app and online service for providing AI meeting assistance while users do calls, video meetings, making recordings, or podcasts. Krisp stores the following customer data in its cloud:

• Email addresses
• Team names
• Payment history and invoices (credit card numbers are stored at Stripe)
• Analytics data
  • Application name which Krisp has been used with (e.g. Zoom, Skype)
• Call metadata
  • Time and duration when Krisp has been used
• Calendar data
  • User’s meetings data (meeting name and other info including participant emails)
• Meeting transcription
  • Meeting transcription (who said what)

AI Meeting Assistant Architecture

Krisp will store meeting information (transcripts, recording, and summaries) only after the Meeting Notes feature is enabled and the user opts to store data in the Krisp cloud.

Transcripts and meeting notes are stored encrypted with strictly limited access. Access to user data is possible only in "break-the-glass" situations by duly trained Krisp employees who are bound by confidentiality duty.

Encryption

• Data in transit is secured by enforcing TLS 1.2 throughout all our services.
• Data at rest is encrypted with AES-256.

Authentication

Krisp supports three authentication methods for users:

1. Google sign-in (OAuth 2.0)
2. Email verification based sign-in (a random magic code is sent to the user’s email every time)
3. SAMLv2 based SSO (for team plans)

Two-Factor Authentication (2FA)

Krisp offers convenient and flexible authentication methods, implementing 2FA to provide an additional layer of security.

GDPR and Data Retention

Customers can delete all their data by sending an email to DPO@krisp.ai. Once a user account is deleted, all associated data are removed from Krisp systems. This action is irreversible.

3rd Party Data Sharing

This document provides the full list of authorized Krisp Sub-processors and describes the process of receiving notifications on sub-processor changes.

Contact

If you have any questions about this document please contact us at: security@krisp.ai.