Meeting data is sensitive by nature. As per our SOC II, Truly employs a Privacy By Design architecture where it doesn't store any information that it needs to, longer than it needs to. In Truly's case this can be very short since we sync data to Salesforce in real-time and expect it to be your system of record for Activity.

We use Oauth to access data on behalf of each registered user. We do not access that accounts of others in the organization even if they are shared/visibile.

Truly is the only sales tech vendor who treats Salesforce as its back-end. There is a 1:1 mapping of all data in our system and SFDC, and all of our analytics capability resides in Salesforce as an AppExchange app.

As such, we need to store the data only as long as it is useful to do so. For meeting recording data, this can be in the range of 'minutes'.

The time period over which you store your data is up to you through our 'Data Retention Policy feature, where you can specify the scope and length of how long any given piece of data is stored in our system.

We limit information stored to the scope in which this feature is deployed. By default, we store only calendar even data, filtering out any internal calendar event that is not with a participant who is 'external' to the company (identified by domain). This includes the date/time, participants and meeting description.

If call recording is active, we also store an mp4 file of the session.

If transcription is active, we store a secure/encrypted copy of the raw transcript inside AWS. We also allow you to leverage AWS's native 'PII Recaction' feature to ensure all names, numbers, emails, credit card numbers and other sensitive data are never stored in any system for any length of time

If call summarization is active, we store a secure/encrypted copy of the meeting summary inside our secure/encrypted database in RDS.