Security

The same six answers as on the For IT firms page, in more detail. If your question is not here, email hello@lastwordapp.com.

Where does our data live?

On your own hub: one small server per firm, with its own database and its own storage. Your recordings are never pooled with another firm's, and there is no shared multi-firm database to break into.

Who holds the key?

Your hub's encryption key. Transcripts, notes and audio are encrypted at rest with AES-256, with a separate key derived for each purpose, and the nightly backups are encrypted too. A copied disk or a stolen backup cannot be read without the key.

What goes to AI?

Only recordings an owner has confirmed, and only to file them. Until a person ticks a recording as work, the hub reads its title and nothing else, and the first sort happens on your own server. The AI may only choose clients and contacts that already exist in your PSA; anything it is unsure of goes to a "Needs filing" queue for a person.

How do people sign in?

Through your existing Google or Microsoft sign-in, behind a zero-trust gate. The hub has no open ports on the internet, and there are no separate passwords to manage.

Does it change our PSA?

No. Last Word reads your PSA's clients and contacts and does not write to it today. Writing tickets will be opt-in, with a person approving each one.

Can we delete?

Partly, today. Anything a person has not confirmed is erased automatically after 30 days, and skipped recordings are erased straight away. Confirmed meetings are kept until your firm decides: we agree a retention period with each founding firm at setup and delete on request. There is no delete button yet; an admin delete option, with every deletion logged, is being built.

Meanwhile, owners can hide one recording, or all of theirs, from admins, and someone without access gets "not found", never a hint that a recording exists.