Security

Written for the manager who has to approve this, not for a compliance checklist. If something here is unclear, email support@usewindshield.com and you will get a straight answer from the person who built it.

The short version

A rep talks into their phone after a visit. Windshield turns that into a note they copy into your CRM. It never connects to your CRM, never records your customer, and one rep can never see another rep’s visits.

Where your data lives

• Database — Supabase (managed PostgreSQL), hosted in Canada (ca-central-1). Holds transcripts, generated write-ups, and product usage events.
• Application — Vercel. Serves the app; stores nothing itself.
• Payments — Stripe. Card details never reach us. We store a customer reference and a subscription status.

Audio, and what happens to it

• Audio is never written to our database.
• Deepgram processes the audio to produce the transcript. Windshield sends every transcription request opted out of Deepgram’s Model Improvement Program, so those requests are not used for model training. For opted-out requests, Deepgram retains data only as long as necessary to process the transcription.
• If a rep records somewhere with no signal, the audio is stored on their own phone until it can be uploaded, then removed from the device. It never sits on our servers.
• Anthropic receives the transcript to generate the write-up. Anthropic does not use commercial API inputs or outputs to train its models. Under their standard API retention policy, inputs and outputs are generally deleted within 30 days, subject to limited legal and safety exceptions.

Generated content can be wrong

Windshield uses automated transcription and a language model. Names, dates, dollar amounts, summaries and drafted emails can contain errors, including errors that read as entirely plausible. Reps are told this in the product and in our terms, and every write-up is editable before it goes anywhere. Treat it as a first draft written by someone who was not in the room.

How accounts are kept apart

Every row in our database is restricted to the account that created it, and that restriction is enforced by PostgreSQL row-level security — in the database itself, not only in application code.

This matters because of where the check happens. Many applications enforce access in application logic, where one missing condition in one query can expose data. Here the database applies the restriction independently, so an application-layer mistake is far less likely to result in one rep seeing another rep’s visits. We test this directly, by querying as one account and confirming another account’s records are not returned.

No system is immune to compromise, and we do not claim otherwise. What we can tell you is where the control sits and how we verify it.

Sign-in

Windshield has no passwords. Signing in sends a one-time code to a work email address, which the rep enters in the app, so there is no password to reuse, guess or breach. Sessions are held in encrypted, HTTP-only cookies over HTTPS.

No connection to your systems

Windshield has no integration with Salesforce, HubSpot or anything else. There is no OAuth grant to review, no API token to rotate, no access to revoke. The rep copies text and pastes it. That is the entire data path back into your business.

It also means there is nothing for IT to install and nothing for procurement to connect.

Not built to record your customer

Windshield is designed for the rep to talk to their own phone, alone, after the visit is over. It does not join calls or meetings, and there is no feature for capturing a conversation between two people. The intended content is the rep’s own recollection — the same thing they would otherwise type into your CRM from memory, captured while it is fresher.

Like any recording tool, it cannot physically prevent misuse. Our terms require every user to have the rights and consents necessary for whatever they submit, and the product is built around the solo-dictation workflow rather than conversation capture.

Retention and deletion

Visits stay until the rep deletes them or deletes their account. Account deletion is a button inside the app, under Settings. It removes every write-up, every transcript and the sign-in from our live database straight away, and we do not restore deleted accounts.

Two qualifications, because the honest version is more useful than the tidy one. Routine database backups exist for disaster recovery and expire on their own schedule, so a deleted account may remain in a snapshot until it rolls off. And content already sent to our processors follows their retention windows rather than vanishing at the moment of deletion.

What we do not have

Windshield is a small, independent product, and it is more useful to tell you this than to let you discover it during a review:

• No SOC 2 or ISO certification. If your procurement process requires one, we are not a fit yet.
• No field-level encryption. Data is encrypted in transit and at rest at the storage layer, which is standard. It is not individually encrypted per record, which means operator access to the database is possible — as it is with essentially every hosted product you use.
• No single sign-on or centralised admin. Each rep holds their own account.

Reporting a problem

If you believe you have found a security issue, email support@usewindshield.com with the details. You will get a reply within one business day. We will not take legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

See also: Your data for the plain-English summary, and our privacy policy.