Built to be trusted.
Know which steps run locally, which use your configured providers, and which use Becki's service. Synced memory lets your connected AI tools use the context you've kept.
Where your data lives
Local transcription processes audio on your device. Configured cloud transcription sends audio to the selected provider under its terms and your account settings. Meeting records can be stored locally while selected text is sent for extraction or another AI task. Local storage does not make every processing step local. See Privacy.
The vault text needed for cross-tool memory syncs to our database, along with its search index. Access is scoped to your account and the AI tools you authorize. Synced data is encrypted in transit and at rest.
Embeddings turn vault text and search queries into numbers for retrieval. A supported local model can process that step on your device. Server-side memory processing can send vault-entry or query text to Becki-managed infrastructure. That is distinct from the providers you connect. See Subprocessors.
What we never do with your data
Becki does not sell your data or use it to train models. Your configured provider's terms and account settings govern its processing and data use. No-training is not zero retention or a guarantee that no provider can review content. See Privacy and Subprocessors.
If that changes, we will tell you before the change takes effect.
Secrets, keys, and sensitive data
ODSR (On-Device Secret Redaction) checks incoming memory for recognizable secrets before storage and embedding. It redacts API keys and secrets from major providers (OpenAI/Codex, Stripe, AWS, GitHub, Slack, Supabase, Fly.io), JWTs, private keys, labeled Social Security numbers, and payment-card numbers. Unknown-shape high-entropy tokens are flagged, not redacted. The check runs on every write path, including direct database writes. A nightly check uses a decoy secret to detect any raw value that survives.
ODIT (On-Device Identity Tokenization) applies to covered memory paths where enabled. It does not find every identity by scanning free text, or shield every prompt, audio upload or tool call. Applicable writes can be held in a sealed quarantine lane pending the required controls. Queue encryption is not proof that no plaintext reached the service or that later processing never uses a provider. Device approval belongs in your real signed-in account.
Synced vault text is encrypted in transit and at rest, but not with a key only you hold. Becki is not a zero-knowledge service. Administrative access is described in the Privacy Policy.
Export and delete
Your local memory is stored as Markdown files you can copy elsewhere. You can also request an export of your cloud data.
You can delete individual memories or request account deletion. The Privacy Policy says cloud-synced vault content is deleted within 30 days of an account-deletion request. For an export or deletion request, email support@becki.io.
Teams and admins
Planned team access is separate from personal vault access, with explicit sharing and membership controls. See Pricing for availability.
Team and Enterprise plans are coming soon. Planned team controls are not available subscriptions.
What this page does not claim
- We do not claim SOC 2, HIPAA, or other certifications we do not hold.
- We do not claim end-to-end encryption for synced vault content. Local files and cloud retrieval have different boundaries.
- Team and Enterprise features are planned, not available subscriptions.
- ODIT is conditional and operation-specific, not universal anonymization or prompt shielding.
For questions about how Becki handles your data, email support@becki.io.