A trust model users can understand
NextStop separates meeting capture from AI processing with a clear, auditable boundary. Here is exactly how it works.
Four-layer trust architecture
Local capture zone
Meeting audio is captured and stored locally on the user's device. The desktop app handles recording, transcript history, speaker identity, and session controls entirely within the local runtime.
Mic and system audio never leave the laptop during the meeting
Transcript history stored on desktop
Session controls run locally in the HUD
Trust boundary
When the meeting ends, the user's desktop app sends a finalized meeting package to the secure gateway. This is the only point where data crosses the trust boundary.
Finalized meeting package, not live audio
User-controlled timing — after meeting end only
Package includes transcript, metadata, and tags
Secure gateway
The gateway holds the production AI credentials (e.g., OpenAI keys) server-side. It runs extraction, synthesis, memory lookup, and draft generation on the finalized package.
Production OpenAI keys stay server-side only
AI pipeline: extraction → synthesis → memory → draft
Policy-controlled: what runs, what's retained, what's exported
Structured return path
The desktop app receives structured artifacts back: summaries, tasks, decisions, drafts, memory references, and canonical markdown. Users review, regenerate, and export from their local workspace.
Artifacts applied locally for review
Targeted regeneration without rerunning the full pipeline
Markdown, Notion, and workspace-ready export routes
Security and data handling
A compact view of what is protected, who processes it, how long sensitive assets remain available, and how users can request deletion.
Encryption
Production traffic is served over HTTPS, provider credentials stay server-side, and source maps remain private release artifacts.
Providers
Supabase, Razorpay, Sentry, OTLP, Google, Notion, Deepgram, and OpenAI are isolated behind server-owned route boundaries.
Retention
Raw audio is short-lived, temporary transcript access is policy-controlled, and durable cloud records keep structured outputs and metadata.
Deletion
Users can request account, meeting, transcript, and integration cleanup through support while self-serve controls continue to expand.
Our security commitments
OpenAI is not used live during the meeting.
Production AI credentials never reach the desktop application.
The secure gateway owns all AI credential and policy management.
Users can review, retry, and control every generated output.