Technical controls in the hosted product
- Identity and access
- Set per event.Events can be limited to approved email domains, rooms locked, and roles assigned.
- Encryption
- Encrypted at rest and in transit.Audio, video, and screen sharing are encrypted in transit between participants.
- Keys
- AWS Key Management Service.Encryption keys are protected by hardware security modules.
- Network
- Private networks and firewalls.Workstations run behind restrictive security groups and are reached with signed access tokens.
- Application delivery
- AWS CloudFront.The application is delivered with DDoS mitigation.
- Data handling
- Request documentation of data separation, access logging, hosting locations, and data flows, including recordings and AI processing.
- Monitoring
- AWS GuardDuty and CloudWatch.Threat detection and monitoring across the platform.
UME.Studio's SOC 2 Type II report covers the hosted product. It does not cover a deployment you run yourself.
What a recorded session keeps, and who can use it.
You are in charge of your data: what is recorded, how it is used and managed, and who can open it. Customer content is never used to train models.
Ask about recording and AI processingYou decide whether participants come back to Replay, keep their workstations, and how much knowledge they reach.
Past sessions are listed per event. You decide how recordings, transcripts, and derived knowledge are kept.
Speech is transcribed; speech and chat are translated. The agent answers privately. Hosted: our AI providers; sovereign: yours.
Each shared screen, the transcript, chat, annotations, documents, and activity. Participants see a notice and a recording symbol.
Stored by UME.Studio in the hosted product, or on your infrastructure in a sovereign deployment.
What security reviews ask
Request it through our security access page. We share the SOC 2 Type II report and documentation of our practices for your security and risk assessment.
The hosted UME.Studio product. Every service it integrates must be SOC 2 compliant too. A deployment you run yourself is outside the report and is assessed under your own security program.
In the hosted product, the hosting region and data flows for your event are confirmed with you, and we document customer data separation, access logging, and hosting locations on request. In a sovereign deployment, data is stored on the infrastructure you run.
Your organizers choose which sessions are recorded, whether participants can come back to Replay, whether they keep workstation access, and how much accumulated knowledge they can reach. In a sovereign deployment, you bring your own AI providers and storage.
No. Participants use a standard browser. Their workstations run in the platform, not on their own computers.
Need our security documentation?
Request the reports, or tell us what your review needs.