Aimcast
Book a demo

/ Security & trust

Built for teams who answer to auditors.

Your recordings hold strategy, science and people's voices. Aimcast keeps them isolated, encrypted and accountable — with AI you can govern, not just trust.

Request the security packTalk to us
  1. 01

    Isolated by default

    Every tenant's content is walled off — in the database, in storage and on its own domain.

  2. 02

    Encrypted everywhere

    In transit and at rest, and every credential you give us is envelope-encrypted with AWS KMS.

  3. 03

    Provable, not promised

    Administrative, access and publishing changes are written to an audit log.

Tenant isolation

Your data never shares a room.

  • Tenant content is isolated by Postgres row-level security, enforced on every request.
  • Every uploaded file is stored under a tenant-scoped path.
  • Video and audio stream through short-lived signed URLs, issued only after an access check.
  • Custom domains are DNS-verified before we route a single request.

Identity & access

Sign-in your IT team already runs.

  • SAML SSO with Microsoft Entra ID, Okta and other standards-based identity providers.
  • SCIM provisioning — joiners and leavers sync automatically from your identity provider.
  • Passkeys, Microsoft or Google sign-in and email links for open workspaces.
  • Workspace roles plus per-channel and per-post access grants.

Data protection

Encrypted, backed up, recoverable.

  • TLS in transit; encryption at rest for databases and files.
  • API keys, OAuth tokens and SSO signing keys are envelope-encrypted with AWS KMS; SCIM tokens are stored only as hashes.
  • 35 days of database backups, with a copy in a second AWS region; file storage is versioned for 30 days.
  • Hosted on AWS in US East (N. Virginia).

Monitoring & audit

Changes leave a trail.

  • Audit log of administrative, access and publishing changes.
  • Web application firewall monitoring traffic to every workspace.
  • Application logs retained for a year.

AI governance

AI you can govern, not just trust.

Answers cite their sources, and you decide which model runs.

  • Bring your own model

    Use our managed models on AWS Bedrock, or connect your own Anthropic, OpenAI, Azure OpenAI or Bedrock account.

  • No silent fallback

    If your provider is down, requests fail — they never reroute to another model unless your admin turns fallback on.

  • Clear about what runs where

    Search indexing and transcription always run in Aimcast's AWS account, whichever model you choose.

  • Answers with sources

    Answers link to the posts they came from and, for video, to the moment.

Questions security teams ask

Where is our data stored?

On AWS in US East (N. Virginia), with a disaster-recovery copy of the database in US West (Oregon). AI requests on our managed models run on AWS Bedrock within the US.

Can we use our own AI provider?

Yes. Admins can connect Anthropic, OpenAI, Azure OpenAI, an OpenAI-compatible gateway or your own Bedrock account in settings. Keys are encrypted with AWS KMS. Search indexing and transcription always run in Aimcast's AWS account.

Bring your security questionnaire.

We'll walk your IT and compliance team through the architecture, live.

Book a security reviewRequest the security pack