Controls you can inspect, configure, and verify.
Groundnote is designed for self-hosted meeting intelligence. Security outcomes depend on how your organisation deploys and configures the software, so this page separates built controls from operator responsibilities.
Built controls
- Role-based access control, expiring sessions, configurable login rate limits, and optional TOTP MFA.
- Optional OIDC SSO for compatible identity providers.
- Hash-chained audit records, configurable retention, legal hold, sensitivity tiers, and redaction controls.
- Local Ollama processing and local transcription paths, with a fortress profile that blocks cloud transcription fallback.
Deployment responsibilities
TLS: the server speaks HTTP and must be placed behind a correctly configured TLS reverse proxy.
Encryption at rest: PostgreSQL deployments rely on infrastructure or disk encryption. SQLite encryption is optional and must be enabled and verified. It is not accurate to assume every installation is encrypted by default.
External services: Microsoft Graph, Recall.ai, SMTP, cloud transcription, webhooks, and work-tracking integrations transmit selected data when an operator enables them.
Data lifecycle and external services
Meeting content enters Groundnote through a user-selected or configured capture path. Workspace access controls govern who can retrieve it. Retention rules, legal hold, redaction, and audited deletion support lifecycle management, but the operator remains responsible for configuring and verifying the deployed storage, backups, infrastructure encryption, and retention behaviour.
Microsoft Graph, Recall.ai, SMTP, cloud transcription, webhooks, and work-tracking connectors create external data flows only when the applicable service is configured and used. The exact provider and processing location depend on the deployment and integrations selected by the operator.
Security reporting and procurement
To report a suspected vulnerability or request current security, privacy, procurement, architecture, or data-flow information, contact support@groundnote.com.au. Do not send passwords, access tokens, private meeting content, or exploit data through a public form.
Groundnote does not currently publish a public bug bounty or promise a fixed disclosure timeline. Coordinate sensitive disclosure details directly with the Groundnote team before transmitting them.
Compliance status
Groundnote provides controls and evidence that may support an organisation's governance program. It is not SOC 2 certified, ISO 27001 certified, HIPAA certified, or independently penetration-tested as of this publication.
An operator enables OIDC, retention rules, and infrastructure encryption; a reviewer then verifies those deployment settings separately from Groundnote's built-in RBAC and audit controls.
Product controls do not make a deployment compliant by themselves. Your security, privacy, and legal teams should assess the deployed configuration and operating procedures. This page was reviewed on 4 September 2026.
Security and compliance FAQs
Is Groundnote SOC 2 or ISO 27001 certified?
No. Groundnote is not SOC 2 certified or ISO 27001 certified and has not completed an independent penetration test as of this publication.
Does Groundnote encrypt every deployment by default?
No. TLS must be configured through a reverse proxy. PostgreSQL at-rest encryption is infrastructure-level, while SQLite encryption is optional and must be enabled and verified.
Can Groundnote run without cloud AI services?
Groundnote supports local Ollama and local transcription paths. Fortress or air-gap behaviour requires explicit configuration, and enabled external integrations create intentional egress paths.