Security and privacy
Understand what a meeting processes, what is retained, and how to report a vulnerability privately.
On this page
Report privately
Send vulnerability reports through GitHub Security Advisories. We aim to acknowledge reports within 72 hours and provide a fix or mitigation before public disclosure.
Provider keys
API keys never enter the database, logs, or cache. Your key is encrypted in the browser and sent directly to the provider where possible. Proxy routes forward requests without retaining the key, audio, or transcript.
Transcripts and recordings
Transcription and retention are announced separately. Retained text is available for up to 30 days and can be deleted sooner. Expired rows are removed on read, so unopened rooms may retain inaccessible rows until opened. Local recordings stay in the browser tab and are not uploaded by LOR.
Room boundaries
Transcripts, decisions, tasks, and search stay within their room. Deleting a source removes its derived records; search excludes expired or deleted evidence. The call and collaboration tools work without AI.