Quick Example
Trust Model
Two-Component Architecture
Security is built into the architecture:| Component | Has API Key | Can See Media |
|---|---|---|
| Backend | Yes | No (receives events only) |
| Desktop Client | No (uses token) | Yes (captures locally) |
- API key never leaves your backend
- Desktop client uses short-lived tokens (10-15 min expiry recommended)
- Compromised tokens have limited blast radius
Token Pattern
Permission Handling
Request Before Capture
Required UX Elements
Storage Control
Ephemeral Mode
Process in real-time without persisting media:- Processing sensitive content
- Storage isn’t needed
- Privacy regulations require it
- Building real-time assistants only
Selective Storage
Store only what you need:Data Retention
Default Behavior
- Media stored until explicitly deleted
- No automatic expiration
- Indexes and transcripts stored with media
Manual Deletion
Implement Data Subject Access
Compliance Patterns
GDPR
- Implement data access endpoints
- Implement deletion endpoints
- Document processing purposes
- Use ephemeral mode when storage isn’t needed
HIPAA
- Use ephemeral mode for PHI
- Implement strict access controls
- Audit all data access
- Consider data minimization
General Best Practices
| Practice | Implementation |
|---|---|
| Never expose API keys | Use client tokens |
| Default to ephemeral | Only persist when needed |
| Short token lifetimes | 10-15 minutes |
| Implement deletion | Honor user requests |
| Get consent | Permission dialogs before capture |
| Show indicators | Recording visible to user |