Security & architecture

A working document for IT, security, and legal teams evaluating AI Assist. It covers what data crosses the network, what stays on the device, what's encrypted, and where the trust boundaries are. Written in plain terms and short enough to read in one sitting.

1. Data flow at a glance

AI Assist has three moving pieces: a browser extension, a desktop helper, and an optional cloud sync backend. In a normal capture, meeting audio and text traverse the following path:

Meeting tab (Chrome) │ │ captions + optional tab audio, over process-local RPC ▼ Browser extension (content script) │ │ HTTP over 127.0.0.1:7831, bearer-authenticated ▼ Desktop helper (runs on YOUR machine) │ │ HTTPS to api.openai.com/v1/audio/transcriptions ← YOUR OpenAI key ▼ OpenAI Whisper │ │ transcript text returned ▼ Desktop helper │ │ HTTPS to api.anthropic.com/v1/messages ← YOUR Anthropic key ▼ Claude (LLM) │ │ summary + answer returned ▼ Desktop helper │ │ written to SQLCipher DB at ~/Library/Application Support/AIAssistHelper/ ▼ Overlay in the meeting tab (via the same 127.0.0.1 channel)

Every hop where user data flows is either process-local, a loopback socket, or an authenticated TLS connection to a vendor you have an audit relationship with. AI Assist's own backend is never on this path unless you explicitly turn on cloud sync (Section 4).

2. What data goes where

Data	Origin	Destination	In transit
Meeting audio (bytes)	Meet tab	Local helper → OpenAI Whisper	Loopback → HTTPS
Transcript text	OpenAI Whisper	Local SQLCipher DB → Anthropic	HTTPS
Meeting summaries + Q&A	Anthropic	Local SQLCipher DB	HTTPS
Indexed local files (embeddings)	Folders you shared	Local vector store	Never leaves device
OpenAI + Anthropic keys	You (typed in Options)	chrome.storage.local + local file	Never leaves device
Pair token (extension ↔ helper)	Local helper	chrome.storage.local	Loopback only
Auth0 session (web app)	getaiassist.app	Auth0 hosted login	HTTPS
License status (Stripe → backend → helper)	Stripe webhook	Postgres → helper	HTTPS

AI Assist's servers see: billing metadata (Stripe customer ID, subscription state) and, if you enable cloud sync, opaque encrypted ciphertext addressed to your device key. That's it.

AI Assist's servers do NOT see: meeting audio, transcripts, summaries, LLM prompts or responses, your API keys, or the content of any local files you've indexed.

3. Local storage

The desktop helper stores everything in ~/Library/Application Support/AIAssistHelper/ on macOS (equivalent XDG paths on Linux). The three sensitive locations:

data.db — SQLCipher-encrypted SQLite database holding transcripts, summaries, embeddings, and indexed-file metadata. Encrypted at rest with AES-256 in CBC mode; the DB key is derived from the helper's master key.
master-key.hex — the helper's master key, 32 random bytes, hex-encoded. File is mode 0600 and lives inside your user account's home directory (so it inherits FileVault protection on macOS and LUKS protection on Linux).
indexer-cache/ — vector embeddings from local files (Anthropic doesn't do embeddings; we run fastembed locally). Rebuildable from source files; not encrypted individually but sits inside the encrypted user account.

The master key never touches the network. Everything derived from it (SQLCipher DB key, cloud-sync payload keys) is derived locally. If you delete master-key.hex, we cannot recover your data — and neither can anyone else who steals a copy of your data.db.

4. Cloud sync (optional, off by default)

Cloud sync is a separate $3/month add-on. When it's on, transcripts and summaries are pushed to AI Assist's backend so you can read them on another paired device. Everything transiting our servers is encrypted client-side before it leaves your device, using a key derived from your master key.

Our backend sees:

Your user ID (Auth0 sub claim)
Ciphertext blobs, opaque to us, keyed to your device
Object-storage metadata (byte size, upload time)

Our backend does NOT see:

Plaintext of any transcript, summary, or file
Your master key or any key derived from it
Your OpenAI or Anthropic API keys — those are never uploaded, ever

Turning cloud sync off severs this path completely. The desktop app is fully operational without it; if your policy is "no cloud", you can install the desktop client and never surface the sync toggle.

5. Trust boundaries — who has access to what

Party	Sees plaintext of your data?
Your device	Yes — this is where everything lives.
OpenAI (Whisper)	Meeting audio + resulting transcripts. Governed by OpenAI Business Terms — API calls default to no-training.
Anthropic (Claude)	Transcripts sent for summary/Q&A + resulting model output. Governed by Anthropic Commercial Terms — API traffic is not trained on.
Google Meet	The meeting itself, including anything spoken in it. This exists whether or not you use AI Assist.
AI Assist's backend	No plaintext of meeting content. Sees billing state + (if enabled) ciphertext blobs.
Chrome extension	The active tab's DOM while the meeting is open. Same trust level as any content script.

Notably, AI Assist itself has fewer trust surfaces than a typical SaaS notetaker because we're not in the audio path. Otter, Fireflies, and Read.ai transcribe your meetings on their servers using their vendor accounts; you have to trust both them and whichever vendors they've picked. AI Assist replaces the middle layer with your machine.

6. What your IT team should evaluate

Whether your team's existing OpenAI + Anthropic policies cover meeting audio + transcripts. They usually do — the Business Terms for both are more restrictive than most SaaS notetakers' default.
Whether your firewall rules allow api.openai.com, api.anthropic.com, and api.getaiassist.app. First two you likely already allow. Last one only carries auth/license/(optional) encrypted sync.
The Chrome extension manifest. Permissions requested: storage, offscreen, tabCapture, activeTab. Host permissions limited to meet.google.com, *.zoom.us/wc/*, teams.microsoft.com, teams.live.com. No blanket <all_urls>.
The desktop helper's binary. Signed with Apple Developer ID 6HJUY37TQ5, notarized. Runs a single localhost HTTP server on 127.0.0.1:7831. No inbound connections from outside the loopback interface.

What we don't have: SOC 2 Type II, HIPAA BAA, or ISO 27001. AI Assist is a small operation; those attestations are on the roadmap for once the customer mix justifies the audit spend. If your organization has a hard SOC 2 requirement today, we're not the right pick — Otter Business and Fireflies Enterprise both carry SOC 2 II and are the right choice for that constraint. For everyone else, the architecture above is the trust story.

7. Reporting a security issue

If you've found a vulnerability, please email security@getaiassist.app with a description and repro steps. We'll respond within 3 business days. AI Assist is a solo operation right now, so please don't publicly disclose before we've had a chance to look and patch — and expect a real conversation with the person who wrote the code.

Questions this page doesn't answer

Email support@getaiassist.app and put "Security review" in the subject. Happy to walk your IT team through the architecture on a call.