Security

Last updated: 31 October 2026

Schools and businesses trust Presently with information about students and meeting participants. This page explains, in plain terms, how we protect it. For full details of what data we process, see our Privacy Policy and our sub-processors page.

1. Less data, less risk

• Recordings stay in your Google Drive. The extension uploads them directly to your Drive. We do not keep copies of your video recordings or attendance sheet files.
• Narrow Google permissions. For Drive we use the drive.file scope, which only gives access to files Presently creates or that you open with it, not your whole Drive. Other Google permissions are read-only.
• No long-lived Google tokens on our server. Our server does not keep your Google password or long-lived Google tokens. When you ask us to create AI notes from a recording in your Drive, the short-lived access the extension passes along is used only for that request.
• Audio is temporary. Audio sent for AI notes is deleted from our server as soon as processing ends, whether it succeeds or fails.
• Automatic clean-up. Transcripts and AI notes are deleted automatically after the retention period (90 days by default).

2. Protecting data in transit and at rest

• All connections to the website, the extension's server calls and our providers use HTTPS (TLS).
• Sign-in cookies are marked Secure and HttpOnly, so they are only sent over HTTPS and cannot be read by scripts on the page.
• We store only a one-way hash of each sign-in session token, not the token itself. Sessions expire automatically.
• Secret keys for payment, AI and email services are stored encrypted.
• Card details are entered on our secure payment provider's pages. We never receive or store full card numbers. Payment notifications from the payment provider are checked with a cryptographic signature before we act on them.
• Our server and database are hosted in a data centre in Germany (EU).

3. Access control

• Only a small number of authorised administrators can access production systems, on a least-privilege basis, with strong authentication.
• Administrative actions, such as changes to plans, refunds and account deletions, are recorded in an audit log.
• We do not read your content, including transcripts and notes, unless you ask us to for support, it is needed to investigate abuse or a security problem, or the law requires it.

4. AI providers

AI features are optional and can be turned off for an account, or by us for everyone. When they are used, audio and transcripts are sent to trusted AI providers. We configure zero data retention where it is available and use only providers that do not train on your data. See our AI disclosure.

5. Abuse protection and reliability

• We limit how often sensitive actions, such as sign-in links and AI jobs, can be used, to reduce abuse.
• Uploads have size limits and are checked before processing.
• We monitor the Service for errors and keep technical logs for a short period (normally no more than 90 days).
• We keep backups of our database so we can recover from failures. Deleted data is removed from backups within 90 days.

6. Data breaches

If a security incident affects personal data, we will inform affected schools and users without undue delay, and for student data within 72 hours of becoming aware of it. We will notify regulators where the law requires and help schools meet their own obligations.

7. What you can do

• Use a strong password and two-step verification on your Google account.
• Share recordings and attendance sheets in Drive only with people who need them.
• Sign out on shared computers, and remove Presently's access in your Google Account if you stop using it.
• Review AI notes before sharing them.

8. Reporting a vulnerability

If you believe you have found a security problem in Presently, please email support@ai-365.uk with the subject "Security" and enough detail for us to reproduce it. Please do not access other people's data, disrupt the Service or make the problem public before we have had a reasonable chance to fix it. We will acknowledge your report and keep you informed. We do not take legal action against people who report problems in good faith under these rules.

No system is perfectly secure, and this page does not promise that a breach can never happen. It describes the measures we take today; we review and improve them over time.