Security, privacy and accessibility

You hold public records in trust. Here is exactly what happens to them.

Where your data lives

  • Application and database: United States hosting behind Cloudflare. Postgres (Neon) with encrypted connections and point-in-time backups.
  • Recordings and attachments: Cloudflare R2 object storage, private by default. Files are uploaded straight from your browser to storage and read only through short-lived signed links.
  • Transcription: recordings are sent to our speech-to-text provider (AssemblyAI) through a signed link that expires. As soon as we have saved the transcript, we delete it from the provider.
  • Drafting: the transcript, agenda and roster are sent to Anthropic's Claude API to draft minutes. Anthropic does not train its models on API inputs by default.

What CivicPorch remembers

To draft better minutes for your board, CivicPorch keeps a short memory inside your account: names and places you add, spellings you've corrected, and your board's recently approved minutes as style examples. It is used only for your own drafts. It is never used to train AI models and never shared with another town. You can review and remove names and corrections under Settings.

Retention

Recording files are deleted 90 days after the minutes are approved; the official video of record stays on your own YouTube channel. Transcripts, agendas, minutes and posting records stay until you delete them or close your account, and you can export them at any time.

What's public and what isn't

Only posted agendas and approved minutes appear on your public page. Draft minutes, recordings, speaker names and transcripts stay private until you approve the minutes. Every publication is logged with a timestamp and a SHA-256 fingerprint of what was posted.

Accounts

Passwords are hashed with bcrypt. Sessions are HTTP-only, secure cookies. Login attempts are rate-limited. Each town's data is isolated at the query level, and our automated tests check that one account can never read another's.

Accessibility

Public pages are semantic HTML built to WCAG 2.1 AA: real headings and lists instead of scanned PDFs, keyboard navigation, visible focus, sufficient contrast, and support for reduced motion and dark mode. Meeting transcripts are published with approved minutes and caption files (WebVTT and SRT) are generated for every recording. Found a barrier? Email [email protected] and we'll fix it.

Report a security issue

Email [email protected]. We respond within two business days.