Elicivia turns business analysis meeting recordings into structured artifacts. That means we handle material that is often confidential: internal meetings, requirements discussions, stakeholder conversations. This page explains how we treat that material, where it lives, and what we do to keep it safe.
Meeting recordings never live on Elicivia's servers at rest. When a Business Analyst records or uploads audio, it is transiently processed for transcription and then deleted from our infrastructure. What we store are transcripts and the analyses derived from them — not the recordings themselves.
Our production infrastructure runs in EU regions. Where our sub-processors are US-based (which is common for AI and hosting services), we rely on Standard Contractual Clauses to lawfully transfer data.
We process three categories of customer data on behalf of our customers:
We also process account data on our own behalf as a controller: the email address and name of the person signing up, authentication metadata, and product usage telemetry needed to operate and improve the service.
| Category | Location | Retention |
|---|---|---|
| Audio (during transcription) | Supabase Storage, EU (eu-west-1) | Deleted within minutes of transcription completing |
| Transcripts | Supabase Postgres, EU (eu-west-1) | Retained for the life of the customer account; deleted on request or account termination |
| Derived analyses | Supabase Postgres, EU (eu-west-1) | Retained for the life of the customer account; deleted on request or account termination |
| Account data | Clerk (US, EU dual-region), Supabase Postgres (EU) | Retained for the life of the customer account; deleted on account termination |
| Application logs | Railway (EU) | 30 days rolling |
Elicivia uses the following sub-processors to deliver the service. All transfers to US-based sub-processors are covered by the EU Standard Contractual Clauses.
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic PBC | Large language model inference for analysis generation | United States |
| Deepgram Inc | Speech-to-text transcription | United States |
| Supabase Inc | Database and object storage | US company, data in EU (Ireland) |
| Railway Corp | Application hosting | US company, EU region |
| Clerk Inc | Authentication and user management | United States |
| Stripe Inc | Subscription billing and payment processing | US company, EU processing entity |
Customers on paid plans are notified of material changes to this list at least 30 days before they take effect.
Elicivia uses multi-tenant organisation scoping. Every database query and storage access is scoped to the requesting user's organisation. No cross-organisation access is possible through the product.
User authentication is handled by Clerk, including support for Google SSO. Passwords are never seen or stored by Elicivia. Multi-factor authentication is available.
Application secrets (API keys, database credentials) are stored as environment variables in Railway, never in source control. Access is limited to BizIntech staff who administer the platform.
Production and development environments are fully separated: separate Anthropic organisations, separate Clerk instances, separate databases.
Dependencies are pinned and audited. Automated security updates for base infrastructure are applied by Railway.
BizIntech's staff who have access to production systems are bound by confidentiality obligations under Belgian employment law and their contracts with BizIntech.
If your organisation is a customer of Elicivia, your organisation is the controller of the data your Business Analysts submit and Elicivia is the processor. Data subject requests (access, rectification, erasure, restriction, portability, objection) should be directed to your organisation's data controller in the first instance. Elicivia will assist your controller in responding to such requests as set out in our Data Processing Agreement.
If you are an individual Elicivia account holder (e.g. an independent BA using Solo), you can exercise your rights directly by writing to privacy@elicivia.com.
If we become aware of a personal data breach affecting your data, we will notify our customers without undue delay and no later than 72 hours after becoming aware, in line with GDPR Article 33.
Our standard DPA is available on request before any customer relationship starts and is included with paid plans. Enterprise customers can request a contractual DPA with legal review as part of onboarding. Write to privacy@elicivia.com to request a copy.
We aim to respond to all enquiries within five business days.