Security

OEURE is a small company. This page describes our current practices plainly, and the work still ahead. This site is served over HTTPS. If you need more detail for a security review, write to hi@oeure.com.

Live

• AI disclosure. The host says it is an AI when it joins, and its messages and recaps are labeled.
• Transcripts off by default. Transcripts and recaps are created only when your company turns them on for a session. Your company decides who receives recaps and is responsible for obtaining attendee consent; OEURE provides the per-session switch.
• Facilitation only. The host does not give medical, legal, insurance or financial advice and is not used for clinical care.
• No patient information by default. Customers should not use OEURE to discuss patients’ health information.
• AI provider. Session content needed to generate the host’s responses is sent to Anthropic’s Claude API under Anthropic’s commercial terms.
• No training on your content. We don’t use customers’ content to train AI models. Under Anthropic’s commercial terms, data sent through the Claude API isn’t used to train its models by default.
• Deletion on request. Customers can ask us to delete transcripts and recaps at any time.

In development

• Private knowledge bases, designed so that each company’s content is stored separately from other customers’ data, owned by that company, and can be exported or deleted on request.
• A consent log where your company can record, for each session, how it informed attendees about the AI host and transcription.
• A published list of our service providers (subprocessors) and data-retention periods.

On the roadmap

• A path to HIPAA business associate agreements with each vendor in the chain, for healthcare customers who need it. We are not offering BAAs today.
• An independent SOC 2 audit, later. We do not hold a SOC 2 report today.

Reporting a vulnerability

Email hi@oeure.com with the subject “Security report”. Please give us reasonable time to fix an issue before disclosing it.