• All data in storage is protected with AES-256 encryption; data in transit uses TLS 1.3.
• Row-Level Security is enforced on every database table.
• API requests are authenticated with JWTs signed by our Auth service.
• Access to Supabase and other production systems is restricted to Marloo staff through role-based permissions and mandatory multi-factor authentication.
• Our external audit confirmed compliance with SOC 2 Type 1; the Type 2 audit is in progress.
• We operate a GDPR-aligned privacy programme and honour deletion requests at any time (we are live in UK, AU, NZ)
• Additional technical and organisational measures are published in our Trust Centre.

• The database is in AWS Sydney.
• AssemblyAI (transcription), Recall (meeting bots) and Anthropic (LLM) process data in the United States. 
  
  • AssemblyAI: Data deleted once received by Marloo
  • Recall: Data deleted after 7 days (call recorded on US-hosted infrastructure)
  • Anthropic: Zero data retention (summaries are generated by Anthropic’s LLM service in the United States. We have an enterprise agreement with Anthropic for zero data retention and priority throughput, so prompts are discarded once the response is returned)
• Transient email and edge traffic may pass through Cloudflare or Amazon SES points of presence in other regions; no customer data is stored there.

Yes. Annex 2 of the Data Processing Agreement, together with our Trust Centre, sets out encryption standards, access controls, audit logging and incident-response procedures. Key points are AES-256 at rest, TLS 1.3 in transit, enforced MFA, twelve-month log retention and SOC 2 Type 2 accreditation.

• Data remains available while your account is active. Users tend to re-visit meetings and recordings frequently. 
• Clients can configure deletion in several ways:
  
  • Meeting bot recordings are automatically deleted within seven days
  • Webapp recordings are stored unless deleted
  • Transcripts are stored unless deleted
  • Summaries are stored unless deleted
• The above is a short term position, and we are about to launch deletion control preferences. 
• When an account ends you may instruct us to delete or export all data. We then delete working copies and keep one encrypted legal-backup copy for up to seven years unless you request a shorter hold.
• Daily encrypted backups are taken and stored in the same AWS Sydney region.
• You can request earlier deletion of specific items by emailing support@gomarloo.com.

No.

Yes, we manage quality control through both internal testing with our own test data. We have never had a complaint or issue with the quality or bias of our summaries. 

If there are any issues, we will act quickly. Our average Intercom response time is <10 minutes.