Security and procurement
Security, reliability and support
Everything an IT or procurement review asks for, in one place: where data lives, how it's protected, what we commit to, and the current status of our certifications.
At a glance
How meetings are handled
- Hosting
- Amazon Web Services, United States only: Northern California (us-west-1), with speech recognition in Oregon (us-west-2).
- Encryption
- HTTPS (TLS 1.2 or 1.3, with HSTS) for every website, screen, phone page and API call. Encoder audio is encrypted in transit when sent over RTMPS or encrypted SRT (AES-256); plain RTMP remains available for older encoders. Data encrypted at rest (AES-256).
- Audio and video
- Converted to text in real time and never recorded or stored.
- Caption retention
- 90 days, then deleted automatically. Download transcripts to keep them.
- Closed session
- While captioning is paused, nothing is captioned, translated, stored or billed.
- Separation
- Each customer has its own API keys; each meeting its own stream key and view token. No customer can read another's meetings.
- Keys
- API keys are shown once and stored only as SHA-256 fingerprints.
- Staff access
- Named CSP staff only, through single sign-on with Clerk; every change is recorded with who made it.
- Backups
- Continuous backup of the caption database with 35 days of point-in-time restore.
- Logs
- Application logs 30 days; an audit log of meetings, failures and staff actions 90 days.
Reliability and support
What we commit to
Availability
99.9% monthly availability target for captioning and the API, excluding scheduled maintenance. Maintenance is never scheduled during a customer's scheduled meeting, and our deployment tooling refuses to update the service while any meeting is live. We report monthly availability to customers on request, and current status is always on our system status page.
Monitoring and alerts
The stream server, captioning, translation, outside deliveries (YouTube, Zoom, webhooks) and server health are checked every few seconds. Failures alert our team by email immediately: captioning stopping, a live meeting's stream being lost, captions being dropped, a webhook failing, or the server restarting.
Automatic recovery
If captioning fails it restarts on its own while the encoder keeps sending; if the encoder reconnects, the meeting continues where it left off. A paused meeting stays paused through restarts.
Recovery targets
- Recovery point: captions are saved as they are produced, so at most the sentence in progress is lost; the database can be restored to any point in the last 35 days.
- Recovery time: under 4 hours to rebuild the service from our infrastructure code if a server is lost entirely.
Incidents
We notify affected customers promptly when an incident affects their meetings, and send a written summary of what happened and what we changed for any significant incident.
Support
- Hours
- Monday to Friday, 8:00 a.m. to 5:00 p.m. Pacific
- Meetings
- An engineer on call during each customer's scheduled meetings, evenings included
- Live meeting problem
- Response within 15 minutes during covered hours
- Other questions
- Response within 1 business day
- Phone
- (559) 251-7767
- sales@civicca.com
Customers receive the on-call contact for their meetings during setup.
Certifications
Independent assurance: current status
Computer Systems Plus does not currently hold a SOC 2 Type II report or ISO/IEC 27001 certification. We state this plainly rather than imply an assurance we don't hold. What we offer instead:
- A SOC 2 readiness program is under way, with third-party penetration testing scheduled to complete by the end of Q4 2026. We will share the results on request. Our target is a SOC 2 Type II report by the end of Q2 2027.
- Infrastructure assurance. Amazon Web Services, which runs the infrastructure SentraCaptions uses, maintains SOC 2 Type II, ISO/IEC 27001 and FedRAMP attestations for its services. Clerk, which handles staff sign-in, maintains a SOC 2 Type II attestation. These cover those providers, not CSP itself.
- Your security questionnaire, or an industry-standard one such as the CSA CAIQ or SIG Lite, completed at no cost within your evaluation timeline.
- Architecture, incident response and disaster recovery details available for review through a confidential process.
- CSP is a SeedPod Certified Partner (independently vetted cybersecurity partner).
Accessibility
Built to WCAG 2.1 AA
Our website, chamber screen, phone page, JavaScript caption box and control center are built and tested to WCAG 2.1 Level AA. See the Accessibility Conformance Report (VPAT 2.5) and our accessibility statement. Captions support WCAG 2.1 Success Criterion 1.2.4 for the meetings you caption; they don't by themselves make an agency's website or apps meet ADA Title II.
Data and subprocessors
Who handles what
Amazon Web Services (hosting, speech recognition, translation, storage), Resend (email), Clerk (staff sign-in) and Cloudflare (DNS only). Meeting content stays in the United States. SentraCaptions doesn't use meeting content to train AI models. Details, retention periods and your rights are in the privacy policy; contract terms are in the terms of service.