Skip to content
ReccieReccie

Trust and security

Your people, heard and protected.

What your people tell Scout is some of the most sensitive data your organisation has. Reccie keeps it anonymous to your organisation, isolated per client, and handled with the same care as personal information, on infrastructure built to satisfy a security review.

Request the trust packBook a demo

  1. Your people

    Anonymous to your organisation

  2. Your environment

    Isolated, one per client

  3. Processing

    Every provider named

  4. Your read-only site

    Never touches the database

Where what your people say goes, from the conversation to your read-only site.

Who sees what.

  • Anonymous to your organisation

    No one at your company sees who said what. Findings trace to roles, never to names.

  • Answers in aggregate

    Executives’ questions are answered in aggregate, only once at least three people have contributed.

  • Never passed on

    What one person says is never repeated to another.

  • Said plainly

    The small 1QLabs team that runs the discovery can see who said what, so they can do the work properly. Your organisation can’t.

Five decisions the platform is built on.

Most are enforced by infrastructure configuration rather than a promise in application code. Where one rests on a contract instead, it says so.

  • Isolated per client

    Each client gets its own Google Cloud project, network and database. One client’s data never shares a database with another’s.

  • Stored in your agreed region

    Your data sits in the region agreed for your discovery, Australia by default, and policy blocks storing it anywhere else.

  • Read-only discovery

    Reccie reads and analyses. It holds no write access to your operational systems.

  • Keyless service identity

    Services authenticate without stored keys, and policy blocks creating them wherever client data runs.

  • Every processor named

    Each provider that handles client data is listed below, with what it handles and where.

Who processes your data, and where.

Google Cloud

What it handles
Hosting, storage, semantic-memory embeddings and de-identification, and analysis and synthesis by Anthropic’s Claude models, served on Google Cloud
Where
Storage, embeddings and de-identification in Australia; Claude models in the United States

Google Cloud, live interviews

What it handles
Scout’s reasoning during a live voice interview
Where
Outside Australia, on a global endpoint

Deepgram

What it handles
Speech recognition and Scout’s voice in live interviews
Where
Australian endpoint

Cartesia, through Deepgram

What it handles
Generating Scout’s voice, called by Deepgram on its own account
Where
Partly outside Australia

Recall.ai

What it handles
Joining and transcribing Microsoft Teams, Zoom and Google Meet meetings
Where
United States

Twilio, phone interviews

What it handles
Carrying a phone interview’s call audio
Where
Australia

Twilio, verification codes

What it handles
Sending and checking phone verification codes
Where
United States

Resend, through Amazon SES

What it handles
Invitations, email interviews and notifications
Where
Japan

TypeSafe

What it handles
Reading an interviewee’s reply to tell whether they have declined a topic
Where
United States

Slack

What it handles
Internal operational alerts and reports to our team, which can name a participant
Where
United States

Microsoft 365, your own

What it handles
Teams notifications
Where
Your own Microsoft 365 tenant

Last updated 19 October 2026.

The AI, disclosed in full.

Analysis and synthesis use Anthropic’s Claude models, served on Google Cloud. Google’s terms prohibit training on customer data, and Deepgram’s model-improvement programme is switched off.

  • Scout

    Interviews. Always clearly AI. Attendees are told when Scout joins a meeting.

  • Lens

    Cross-references everything, and catches the contradictions.

  • Arc

    Designs the builds, and ranks them.

  • Pulse

    Answers questions about the evidence, citing its sources.

Where certification stands, honestly.

Neither audit has happened yet, so we claim neither. Until a report or certificate exists, we publish where we stand rather than a badge.

  • Working towards

    SOC 2

    An independent audit of security controls.

  • Working towards

    ISO 27001

    A certified information security management system.

Frequently asked questions

Can our security team review the architecture?

Yes. We will walk your team through the cell architecture, the identity model and the data flows in as much detail as you want, and provide the diagrams and a pre-filled vendor questionnaire on request.

What happens to our data at the end of a discovery?

Our team hands over the blueprint, findings and proposals, and exports transcripts and anything else you ask for. How long your data is kept, and when it is deleted, is agreed with you before the discovery starts.

Is any of our data processed outside Australia?

Storage isn’t: your data is held in Australian regions. Processing can be: some data processing and AI reasoning runs outside Australia. The table above names each provider and where it runs.

Do you offer a data processing agreement?

Yes. Data protection terms are agreed with every client before a discovery starts. If your organisation has its own agreement, we are glad to work from that.

For your security review

Everything your security review needs, in one pack.

The architecture, the data flows, the processors and the controls, with a pre-filled questionnaire on request.

Request the trust pack
Book a demo