Security

Written for the manager who has to approve this, not for a compliance checklist. If something here is unclear, email support@usewindshield.com and you will get a straight answer from the person who built it.

The short version

A rep talks into their phone after a visit. Windshield turns that into a note they copy into your CRM. It never connects to your CRM, does not record your customer unless the rep deliberately switches on an optional meeting mode and confirms consent, and one rep can never see another rep’s visits.

Where your data lives

• Database — Supabase (managed PostgreSQL), hosted in Canada (ca-central-1). Holds transcripts, generated write-ups, and product usage events.
• Application — Vercel. Serves the app; stores nothing itself.
• Payments — Stripe. Card details never reach us. We store a customer reference and a subscription status.
• Transcription and writing — Deepgram and Anthropic, described below. Each receives one visit at a time and keeps nothing of it.
• Maps and routing — Google Maps draws the map; openrouteservice works out drive times. Both receive coordinates only, never account names or notes.

Supabase, Vercel, Stripe, Deepgram and Anthropic each hold a SOC 2 Type 2 report and publish it through their own trust pages. Windshield itself is a thin layer on top of that audited infrastructure; see What we do not have below for what that layer has not done.

Audio, and what happens to it

• Audio is transcribed and discarded. It is never written to our database.
• Deepgram processes the audio to produce the transcript. Windshield sends every transcription request opted out of Deepgram’s Model Improvement Program, so those requests are not used for model training. For opted-out requests, Deepgram retains data only as long as necessary to process the transcription.
• If a rep records somewhere with no signal, the audio is stored on their own phone until it can be uploaded, then removed from the device. It never sits on our servers.
• Anthropic receives the transcript to generate the write-up. Anthropic does not use commercial API inputs or outputs to train its models. Under their standard API retention policy, inputs and outputs are generally deleted within 30 days, subject to limited legal and safety exceptions.

Generated content can be wrong

Windshield uses automated transcription and a language model. Names, dates, dollar amounts, summaries and drafted emails can contain errors, including errors that read as entirely plausible. Reps are told this in the product and in our terms, and every write-up is editable before it goes anywhere. Treat it as a first draft written by someone who was not in the room.

How accounts are kept apart

Every row in our database is restricted to the account that created it, and that restriction is enforced by PostgreSQL row-level security — in the database itself, not only in application code.

This matters because of where the check happens. Many applications enforce access in application logic, where one missing condition in one query can expose data. Here the database applies the restriction independently, so an application-layer mistake is far less likely to result in one rep seeing another rep’s visits. We test this directly, by querying as one account and confirming another account’s records are not returned.

No system is immune to compromise, and we do not claim otherwise. What we can tell you is where the control sits and how we verify it.

Sign-in

Windshield has no passwords of its own. A rep signs in one of three ways: with their Google account, with their Microsoft account, or with a one-time code sent to their work email. The first two mean your existing identity provider, and whatever policies it enforces, controls access; Windshield receives only a verified email address. The code option exists for anyone outside those two, and means there is still no password to reuse, guess or breach. If the same person signs in two different ways with the same email, it is one account. Sessions are held in encrypted, HTTP-only cookies over HTTPS.

No connection to your systems

Windshield has no integration with Salesforce, HubSpot or anything else. There is no OAuth grant to review, no API token to rotate, no access to revoke. The rep copies text and pastes it. That is the entire data path back into your business.

It also means there is nothing for IT to install and nothing for procurement to connect.

Recording the customer: off by default

Windshield is designed for the rep to talk to their own phone, alone, after the visit is over. That is the default and it is how the product is used. The intended content is the rep’s own recollection, the same thing they would otherwise type into your CRM from memory, captured while it is fresher. It does not join calls.

There is an optional meeting mode for recording an in-person sit-down. It is off for every account until the rep turns it on in Settings, and every recording starts with the rep confirming that everyone in the room has been told. That confirmation is logged with a timestamp. Meeting audio is handled exactly like memo audio: transcribed and discarded, never written to our database. A meeting a rep records, including one marked as a team meeting, is private to that rep’s account like every other visit; there is no shared workspace and no manager view.

Like any recording tool, it cannot physically prevent misuse. Our terms require every user to have the rights and consents necessary for whatever they submit. Several states in which reps work require the consent of everyone being recorded, and the rep carries that responsibility. If your organisation does not want reps using meeting mode, tell them not to switch it on; we can also disable it for your reps on request.

Retention and deletion

Visits stay until the rep deletes them or deletes their account. Account deletion is a button inside the app, under Settings. It removes every write-up, every transcript and the sign-in from our live database straight away, and we do not restore deleted accounts.

Two qualifications, because the honest version is more useful than the tidy one. Routine database backups exist for disaster recovery and expire on their own schedule, so a deleted account may remain in a snapshot until it rolls off. And content already sent to our processors follows their retention windows rather than vanishing at the moment of deletion.

What we do not have

Windshield is a small, independent product, and it is more useful to tell you this than to let you discover it during a review:

• No SOC 2 or ISO certification of our own. The infrastructure underneath is audited; the application layer we wrote is not. We think that is proportionate for what Windshield holds: a rep’s own dictated notes, which the rep copies out, with no connection to your CRM or any other system of yours. We will complete a security questionnaire and sign a data processing agreement on request. If your procurement process requires a report in our own name, we are not a fit yet.
• No field-level encryption. Data is encrypted in transit and at rest at the storage layer, which is standard. It is not individually encrypted per record, which means operator access to the database is possible — as it is with essentially every hosted product you use.
• No single sign-on or centralised admin yet. Each rep holds their own account and signs in with Google, Microsoft or an emailed code. Both are planned for a team edition; ask if they are what stands between you and a pilot.

Reporting a problem

If you believe you have found a security issue, email support@usewindshield.com with the details. You will get a reply within one business day. We will not take legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

See also: Your data for the plain-English summary, and our privacy policy.