Security and data handling

Meeting content can be seen by the members of the folder where the minutes are saved. Even organization admins cannot open, on screen, the content of a folder they are not a member of.

An export of the whole organization's data can be made only by a designated organization admin, and only when the operator has enabled it.

The operator (Kaopiz Inc.) console handles administrative information such as contracts and usage. It has no screen for reading meeting transcripts or minutes.

Data is managed separately for each organization, and the system is built so that one organization cannot read the data of another.

AI only writes a draft. The minutes become final when the person responsible checks them against the sources, edits them and approves the whole document. Edits made after approval are saved as a new version.

The AI features of GIJITO, such as drafting minutes, naming meetings automatically and creating templates, are used through Amazon Bedrock of Amazon Web Services. AWS documentation states that model providers have no access to the content sent to Amazon Bedrock.

AWS documentation: Data protection in Amazon Bedrock

We do not use the meeting content you entrust to us to train AI.

Audio storage is available to organizations that have it enabled in their contract. Organization admins turn auto-save on or off; the retention period is set by the system administrator (the operator). Only audio is recorded, not the screen.

When a contract ends, we promptly delete meeting data such as transcripts and minutes, by a method that makes it unrecoverable, once 30 days have passed since the end date.

A deleted meeting can be restored by the person who created it within a set period (30 days by default). After that period the meeting can no longer be viewed or restored on screen, but its data (except audio) is kept in our systems until it is deleted after the contract ends.

Exceptions to this deletion, such as information the law requires us to keep and backups, are set out in the Privacy Policy.

Privacy Policy, Article 14 (Retention and deletion)

Only content a user chooses after the minutes are approved is sent to external tools. You can check the content before sending, and a history of what was sent is kept.

The credentials used to connect external tools are stored encrypted.

You can sign in with an email address and password, or with a Google or Microsoft account. Passwords are stored in a form that cannot be reversed (hashed).

Communication with your browser is encrypted (HTTPS).

Actions such as signing in, creating or deleting a meeting, and changing members are recorded and cannot be changed or deleted from the application.

Meeting data is processed and stored in Japan. The place for each kind of work we entrust is listed in our Privacy Policy.

Privacy Policy, Article 11 (Entrustment)