Security and data
What we keep. What we delete.
Alice is a neuro-quest: she listens to a session, scores it and hands you a report. This page says what she keeps, what she deletes, who can see what, and what she never does. It is written to be forwarded. Send it to Legal before you book; most of the questionnaire is answered below.
A manager replies within one business day.
- At a glance
- No facial recognition
- No emotion recognition
- Raw audio deleted within 24 hours
- Encryption in transit and at rest
- GDPR-ready processing
- SOC 2 Type II in progress
What we never do
No faces. No emotions.
No facial recognition. No emotion recognition. No voiceprints: the Assessor knows who is speaking because each participant has their own microphone channel in the Room, not because she has learned anyone's voice. No analysis of video at all; video is streamed between participants during the session and never recorded. No automated decisions about anyone. No selling of data. No training on your transcripts or your reports.
PostureAlice listens to what people say and do. She does not read faces or infer emotions; workplace emotion recognition is off-limits under the EU AI Act, and Alice does not do it by design. The report is decision support for a human debrief, not an automated decision about anyone. Participants consent before the Room opens.
What we process
Audio in. Indicators out.
During a session the Room carries video and audio between participants. The Assessor takes the audio only. Speech becomes text; text is attributed to a speaker by channel; and the Assessor emits Signals: who spoke, when, for how long; turn-taking; interruptions; decision latency; card usage; captain handovers; mission outcomes. Signals become 92 indicators, indicators become 25 competencies, competencies become 7 dimensions, scored against the Cohort. That is the whole pipeline. Nothing in it needs a face.
- 00Signals
- 0192 indicators
- 0225 competencies
- 037 dimensions
- 04the Cohort
- 05the Alice Report
| Data | Where it comes from | What it is used for | Where it ends up |
|---|---|---|---|
| Session audio | Each participant's microphone in the Room | Transcription and Signals, during the session | Deleted within 24 hours unless the client opts in |
| Video | Each participant's camera in the Room | Seen by the other participants, live | Never recorded, stored or analyzed |
| Transcript | Speech-to-text on the audio, attributed by channel | Moments: the timestamped evidence behind every score | Kept with the session record; text only |
| Signals and indicator scores | The Assessor, during the session | The Alice Report | Kept with the report |
| The Director's Log | Alice's timestamped record of twists and cuts | In the report; improves how Alice paces a room | Kept with the report |
| Cohort contribution | Indicator scores, stripped of names, team, company and session | The benchmark every team is scored against | Aggregated; cannot be re-identified |
| Account and booking data | What the session owner enters | Sign-in, scheduling, invoicing, the access policy | Kept while the account is active |
| Salary bands (optional) | Entered by the session owner at booking | The money lines on the People-Risk Map | Kept in that owner's report only |
Participants see all of this before the Room opens. The Room Check screen says: Alice listens to this session. Audio is processed live; raw recordings are deleted within 24 hours unless your session owner opted in.
What we delete
Gone in 24 hours
Raw audio exists to be transcribed and scored. Once it has been, it has no further job. It is deleted within 24 hours of the session's end unless the client opts in at booking to keep it. Everything else has a stated life and a named person who can end it.
- 01:55Last decision
- 02:09:32Report ready. Generated 14 min 32 s after the last decision
- 03:00Session ends. Video was never recorded
- +24:00Raw audio deleted, by 03:00 the next day at the latest
The transcript stays, text only, as the source of Moments. Unless the client opts in at booking, nothing else of the audio survives the day.
| Data | Kept for | Who can delete it earlier |
|---|---|---|
| Raw session audio | Deleted within 24 hours unless the client opts in; opted-in audio is kept for the period stated in the order form and deleted on request | The session owner, at any time |
| Video | Never kept | — |
| Transcript (text) | With the session record, because every Moment cites it; deleted with the session | The session owner, from the Workspace |
| Signals and indicator scores, named | With the report | The session owner |
| The Alice Report, Gap Cards, the Director's Log | While the account is active; deleted on request, and within 30 days of account closure | The account owner; each participant may request their own Gap Card be deleted |
| Cohort contribution | Indefinitely, as aggregated indicator scores with no names, team, company or session attached | Cannot be re-identified, so cannot be removed per person; Enterprise contracts set the terms of contribution |
| Solo Probe decisions | With no email given, nothing identifying is kept and the decisions join anonymous aggregates. With an email, First Glance and the email are kept until you unsubscribe or ask | You, by writing to report@alice.report |
| Account data | While the account is active, then for the period the law requires for invoicing | The account owner |
| Lead forms | Until the inquiry is resolved and, with your agreement, for follow-up | You |
| Service logs | A limited period, for security and debugging; no session content | Automatic |
What we protect
Encrypted. Role-based.
Session data, transcripts and reports are encrypted in transit and at rest. Media in the Room is encrypted in transit between browsers and our media servers. Access inside Discover IT LLC is by named role, least privilege, multi-factor, and logged. Backups are encrypted. Environments are separated. Dependencies are scanned and the platform is tested by independent penetration testers. If a participant drops, Alice pauses the Clock; if a session fails for a reason on our side, we re-run it.
Controls · status
- Encryption in transit (TLS) and at restLIVE
- Media encryption in the Room (DTLS-SRTP)LIVE
- Role-based access for customers: participant, session owner, success manager, partnerLIVE
- Staff access by named role, least privilege, multi-factor, loggedLIVE
- Encrypted backups; separated environmentsLIVE
- Dependency and vulnerability scanningLIVE
- Independent penetration testingLIVE
- Incident notification to affected customers without undue delay, in time for their own 72-hour obligationLIVE
- Alice pauses the Clock on a dropped connection; failed sessions re-runLIVE
- SOC 2 Type IIIN PROGRESS
Who sees what
Each person, their own card.
Access is role-based and set by the session owner at onboarding. Each participant receives their own Gap Card. The session owner sees the team report and, by the policy chosen at onboarding, individual cards or only aggregates. During the session the owner sees progress only, never the live transcript. Nothing is hidden from participants except the plot.
| Who | Sees | Never sees |
|---|---|---|
| A participant | Their own Gap Card; the team's results, together with the team, in the debrief | Other participants' Gap Cards; the transcript |
| The session owner | The team report; individual Gap Cards or aggregates only, by the policy set at onboarding; live progress across eras, who is connected, connection health | The live transcript during the session; raw audio |
| The success manager (Growth, Enterprise) | The report, to lead the debrief, with the session owner's permission | Raw audio |
| A partner (white-label) | Client reports and the Director's Log, under the partner's own agreement with its client | Raw audio |
| Discover IT LLC staff | Only what support or incident response requires, by named role, logged | Routine access to transcripts or reports |
| Alice | Audio during the session, the transcript, Signals, the Clock, the cards | Faces, emotions, your HR files, anyone's name beyond the invite |
Where the data lives
EU or US. Your call.
On Enterprise, data residency is yours to choose: session records, transcripts, reports and the Assessor's processing stay in the EU or the US. On Team Session and Growth, data is held in our standard region, and any transfer is covered by standard contractual clauses or an equivalent mechanism. Where the data lives is written into the Data Processing Agreement, not into a settings page you have to find.
Data residency · Enterprise
Data residency EU/US on Enterprise. LIVE
Who else touches the data
Six kinds of subprocessor
Alice runs on infrastructure we do not own and does not pretend to. Six categories of subprocessor handle data on our instructions and under contract. None of them is permitted to use your data for anything but the service, and none of them trains on it. The current list, with names, is attached to the Data Processing Agreement and sent on request.
| Category | What it does | What it handles | Region |
|---|---|---|---|
| Cloud hosting and storage | Runs the platform; stores encrypted session records and reports | All service data, encrypted | EU or US, per residency |
| Real-time media infrastructure | Carries video and audio in the Room | Media streams in transit; audio to the Assessor; video never stored | Nearest region to the session |
| Speech-to-text and AI inference | Transcription, Alice's narration and voices, scoring support | Session audio during the session; transcript text attributed by tile, not by name | EU or US, per residency; no-training terms |
| Transactional email | Magic links, confirmations, "Report ready" notices | Email address, session metadata | — |
| Payment processing | Invoices and cards | Billing details; we never hold card numbers | — |
| Error and performance telemetry | Keeps the service up | Technical logs; no session content | — |
Where we are honest
In progress, said out loud.
GDPR-ready processing: lawful basis, minimization, retention limits, data subject rights, a Data Processing Agreement for every paid plan, standard contractual clauses for transfers. SOC 2 Type II is in progress; we will say so until it is not. The validation study against outcomes is ongoing, and the Science page says so. The last page of every Alice Report, Method and Confidence, lists what Alice could not observe: muted mics, dropped connections, a confidence level per dimension. A security page that only lists what is finished is a marketing page.
Documents available on request: Data Processing Agreement · subprocessor list · security overview
The list we repeat everywhere
-
No facial recognition. No emotion recognition.
LIVEAlice listens to what people say and do. She does not read faces or infer emotions, by design.
-
Raw audio deleted within 24 hours
LIVEAudio is processed during the session. Raw recordings are deleted within 24 hours unless the client opts in to keep them.
-
Encryption in transit and at rest
LIVESession data, transcripts and reports are encrypted in transit and at rest.
-
Role-based access
LIVEEach participant receives their own Gap Card. The sponsor sees the team report and, by the policy set at onboarding, individual cards or only aggregates.
-
Participants consent before the Room opens
LIVEEvery participant sees what Alice does with audio and agrees on the Room Check screen. Nothing is hidden from participants except the plot.
-
Decision support, not automated decisions
LIVEThe Alice Report is decision support for a human debrief, not an automated decision about anyone.
-
GDPR-ready processing
LIVEProcessing is designed for GDPR: lawful basis, minimization, retention limits, data subject rights.
-
Data residency EU/US
LIVEAvailable on Enterprise.
-
SOC 2 Type II in progress
IN PROGRESSSOC 2 Type II is in progress; we will say so until it is not.
What the AI does, and does not do
She listens. She counts.
Alice does
- Narrate, voice every character, adapt the plot and the difficulty, trigger twists and manage pressure in real time.
- Listen to the audio of the session and turn speech into text.
- Attribute each turn to a participant by microphone channel.
- Time decisions, count interruptions, log card use and captain handovers, record mission outcomes.
- Map those Signals to 92 indicators, 25 competencies and 7 dimensions, and score them against the Cohort.
- Compile the Alice Report 15 minutes after the last decision, with a Moment behind every score.
- Pause the Clock when a participant drops.
Alice does not
- Analyze faces or video.
- Infer emotions.
- Build a voiceprint or any biometric template.
- Decide anything about anyone: hiring, promotion, pay, dismissal. A human reads the report and leads the debrief.
- Keep raw audio past 24 hours unless the client opts in.
- Train on your transcripts or your reports.
- Score personality. She scores behavior at a timestamp.
Alice · connection dropWe lost [name]. Clock paused. Sixty seconds to reconnect.
If something breaks
Report a vulnerability or a suspected incident to report@alice.report with “Security” in the subject line.
We acknowledge, investigate and tell affected customers what happened, what data was involved and what we did, without undue delay and in time for them to meet their own notification obligations. We do not pursue researchers who report in good faith.
Before you book
Send this page to Legal
Everything above is in the Data Processing Agreement in contract language. Ask for it, the subprocessor list or the security overview, and a manager replies within one business day.