Trust

Security

Last updated 28 October 2026.

• Audio never reaches our servers. Your phone streams it straight to our speech-to-text provider, which processes and discards it.
• Encrypted in transit (HTTPS) everywhere.
• Walled off per person. Every row is tagged to its owner, and the database itself (row-level security) refuses to show one account's data to another. We test this on every change.
• Secrets sealed. Your own API keys and your calendar link are encrypted with AES-256-GCM, bound to your account, and never shown back in full.
• No content in logs. Our logs record timings and errors, never what was said.
• Browser protections: a strict content security policy, no framing, no third-party scripts, trackers or cookies.
• Glasses pair with their own device key, separate from your password.
• Certifications: none yet. We'll say so here when we have them.

Found a problem?

Email security@sottolens.com. We'll reply within 3 business days, won't take legal action against good-faith research that respects users' privacy, and will credit you if you'd like.

If there's a breach

If we learn that someone got into Sotto data without permission, we'll email the people affected without undue delay, aiming for within 72 hours of confirming it. We'll say what happened, what data was involved, what we've done, and what you can do.