Security & privacy
Private byconstruction,not by promise.
Your client's page carries their name, their family situation and their numbers. Here is exactly how it is handled.
Access
Who can open a page.
Unguessable linksNo sequential identifiers, nothing enumerable, no public index. A page is reachable only by someone holding its link.
An access check they already knowLast four digits of their phone number. No account to create, no password to lose — friction is how a follow-up dies unread.
Search engines are blockedEvery page is served with no-index directives and is excluded from crawling.
Expiry by defaultEvery page carries an expiry date you set. After it passes, the link stops resolving — a stale quote doesn't circulate indefinitely.
Revoke instantlyOne click pulls a page down. The link stops working immediately, on every device that has it.
Encrypted in transit and at restTLS on every request. Stored content encrypted at rest.
Data
What we hold, and for how long.
- What you put in
- The meeting transcript or notes you submit, the figures you enter, and each reader's name and phone number. We never ask for account numbers or government identifiers. Some recaps carry health details because the decision turns on them, such as a condition that affects coverage. You decide what goes on a page. We don't ask for diagnoses or medical records, and nothing requires them.
- What we generate
- The draft text, the published page, the time you approved it, and open events.
- How long it's kept
- Meeting audio is not kept. Transcripts are kept until you delete them. Published pages live until they expire or you revoke them. After that, content is retained for 90 days so it can be restored on request, then deleted. Approval times are kept for the life of your account.
- Deleting your account
- Ask, and every page, draft and record is deleted within 30 days. We'll send you an export first if you want one.
- Client communication
- Room Two does not message your clients. We generate the page and a short note for you to send yourself, from your own phone or inbox. We hold no client phone numbers for messaging, operate no sending infrastructure on your behalf, and never appear in the middle of a conversation between you and the person you're advising.
- Training
- We don't train models on your client content. We use OpenAI's API in two places, and OpenAI does not use API data to train its models by default. Audio clips go to its transcription endpoint (Whisper), where OpenAI's published terms list no abuse-monitoring retention. Transcript text goes to its chat completions endpoint to build your draft, where OpenAI keeps abuse-monitoring logs, which can include what we sent and what came back, for up to 30 days.
- Selling data
- We don't, and there's no arrangement under which we would. There is no advertising business here to feed.
Meeting audio
What happens to a recording.
Record Mode can record the meeting itself. Here is exactly where that audio goes.
- Before it starts
- Before it records a meeting, Record Mode asks you to confirm you’ve given any required notice and obtained any required consent, every time. Recording laws vary by state. That call is yours. A private voice debrief records only you and skips this step.
- While you record
- The audio goes to our server in short pieces, about two minutes each, so it is transcribed while the meeting runs. Nothing waits on the phone for one large upload at the end.
- Who transcribes it
- OpenAI is our transcription subprocessor. Each piece is sent to OpenAI's Whisper speech-to-text model, and the text comes back to your screen. OpenAI also reads the finished transcript to prepare your draft.
- Then it is discarded
- Room Two does not store meeting audio. Once a piece is transcribed, its audio is discarded, on our server and in your browser. The transcript is saved with your recap, so you can check the draft against what was said, until you delete it.
- Your voice notes
- Your private note after the meeting is transcribed the same way, and its audio is discarded. A voice note you record for your client is different. It is stored so it can play on their page, until you delete or replace it.
Tracking
What you get, and what you deliberately don't.
Your client is reading a document about their family at their kitchen table. That reality set the limits below.
What you do get
- A notification on first open
- View count and last viewed
- Whether the access check passed
- Roughly how long each section was on screen. Recorded on every published recap page, however the recap was created. Stored against the page, never against a person: no IP, no device id, no session id, nothing that distinguishes one reader from another. Times are counted in whole seconds. Your own previews are never counted.
- Pages used against your monthly allowance
What you don't get
- No scroll depth or heat mapping
- No per-person measurement of any kind — a page has one recipient, so “this page’s reader” is the finest resolution that exists
- No device fingerprinting
- No location or IP-derived geography
- No visibility into who they forwarded it to
- No third-party advertising or analytics scripts on a client page
The second list is a product decision, not a gap in the roadmap. A recap page works because it feels like a document from a professional, not a tracked marketing asset — and the moment a client senses the difference, the trust that makes the whole thing function is gone. Section timings sit on the line deliberately: they tell you which part of the page someone went back to, which is the useful thing for your follow-up, without ever telling you anything about the person holding the phone. Every recap page links the recipient to the privacy policy, whose Sections 2, 3 and 11 spell this out in plain language.
Regulated work
What Room Two will never do.
Invent a number.Figures come from what was said or what you type, and you check them before you approve.
Publish without you.No page goes live until you approve it. Each publish is logged.
Message your client.You send every link yourself, from your own number or inbox.
Predict an outcome.No page states or implies a likelihood of approval, performance, or result.
Remove a disclosure.Required language is not editable by any user, at any tier.
Recommend a product.The page explains what you presented. It doesn't choose or rank.
For your compliance officer
What to send them.
A real sample pageA complete document with the disclosure block intact — not a screenshot, not a marketing mock. It's the fastest way to get a yes or a specific objection.Open the sample →
The constraint listThe six things the product will never do, in writing, so a reviewer can check them against your firm's policy directly.See the platform →
A conversationIf your firm needs something specific — a retention term, an export format, a DPA — tell us before you subscribe rather than after.Get in touch →
Read a real one before you decide.
The sample page is complete, current, and yours to forward — to a colleague, to your agency, to whoever needs to see it.