®Data retention & AI privacy
Your clients trust you with privileged information. This page explains exactly what happens to your firm's data when Superpractice's AI features process it, which features are not covered by zero data retention, how your data is encrypted, what we store, and for how long.
How AI processing works
Superpractice uses AI models for features like the assistant, meeting and contact summaries, outreach drafts, recommendations, and content generation.
Text AI requests go through one shared connection, and that connection requires zero data retention on every request. Only model providers with zero-data-retention agreements can serve those requests.
The requirement is fail-closed: if no zero-data-retention route is available for a model, the request is refused. Superpractice will not silently fall back to a route that keeps your content.
Voice is not covered by zero data retention
Zero data retention covers text AI only. It does not yet cover live voice: phone calls your AI voice agents answer or place, the assistant's voice mode, the spoken dashboard brief, and the spoken setup guide. We don't have zero data retention for the real-time voice model yet. Voice runs under the voice provider's standard API terms, which Features outside zero data retention explains below.
What zero data retention means
These points apply to every request covered by zero data retention.
-
Not stored by model providers. The model provider deletes prompts and responses once it returns the response. No provider copy of your client communications, transcripts, or matter details is left behind. Superpractice may separately store workspace copies, such as AI assistant conversations, as explained below.
-
Never used to train model providers' models. The model providers serving these requests are contractually prohibited from training their models on your content.
-
Covers the text AI features that work with your data. These are:
- the assistant when you type
- meeting summaries and contact summaries
- call summaries and outcomes, including the summary written after an AI voice agent call ends
- email and SMS drafts
- executive assistant messages
- recommendations and reports
- content tools
- assistant memory
- the assistant's web search, in chat and by text: only a short keyword search goes out, never your message, and never who your firm acts for. Owners and admins can turn web browsing and search off for the firm under Settings > AI Personalization; then nothing is sent to search or browsing services.
-
Pseudonymized telemetry. Request metadata used for routing and billing uses hashed identifiers, never raw user or record IDs, and never message content.
-
Checked on every code change. Automated tests run on every code change and confirm three things:
- the shared AI connection turns zero data retention on by default
- it cannot be switched off without a registered exemption
- no code calls a model provider's software kit directly
A live check confirms that a request for a model with no zero-data-retention route is refused.
Features outside zero data retention
These features send data to outside providers without zero data retention. Each row says what is sent and how that provider handles it.
| Feature | What is sent | How the provider handles it |
|---|---|---|
| AI voice agent phone calls (calls your agents answer or place, including your executive assistant's calls) | The caller's voice and words, and everything the agent says. Also the agent's instructions (your firm's details, team, and hours) and what the agent knows about the contact on the call. Lookups the agent makes during the call, such as open times and booking results, are sent too. | Processed live by the real-time voice model provider under its standard API terms. The content is not used to train its models. The provider may keep it for up to 30 days for abuse monitoring. Superpractice leaves the provider's session storage off. The summary and outcome written after the call run under zero data retention. |
| Assistant voice mode, spoken dashboard brief, spoken setup guide | What you say, plus any workspace data the assistant reads to answer you. That can include contacts, matters, meetings, tasks, and your firm's metrics. | Same voice provider and terms as voice agent calls. Voice-mode turns are saved in your assistant conversation like typed ones. |
| Older voice agents (agents created on our previous voice platform, before the current one) | The same call content as above. | Handled by the previous voice platform's provider. That provider keeps its own copy of call recordings, transcripts, and call logs under its retention settings. New agents always use the current platform. Ask support about an older agent's data. |
| SEO article research, images, and audio | The target keyword, the article outline, your direction note, public pages you link, and the article text. Contact, matter, and communication data is never pulled in. | The research, image, and speech providers handle it under their standard API terms, which can include keeping request logs for a limited time for abuse monitoring. Anything typed into an article's direction note is sent too, so keep client details out of it. |
| Voicemail greeting audio | The greeting text you write. | Turned into audio by a speech provider under its standard terms. |
| SEO web search and page reading | Search questions written by the SEO tools, and the public web addresses the assistant or the SEO tools read. | Sent to web search and page-reading services under their terms. The assistant's own web search is not in this row: it runs under zero data retention. |
| Web browsing (the assistant looks things up on websites or works a web page for you, by chat, voice, or text) | What you asked it to look up, as the task, and the public web pages it visits. Contact, client, and matter details are left out of the task unless you asked for exactly that. | Sent to an outside cloud-browser service, whose own AI model works the page, and to a page-reading service that fetches page text (no AI). The cloud-browser service runs under its own terms, outside zero data retention. The AI that reads the results and writes your answer runs under zero data retention. Each task gets a new browser with no saved logins or cookies, and the browser is closed when the task ends. Superpractice keeps screenshots of the pages in its private storage, filed under your firm and the person who asked. Only that person can open them, through Superpractice while signed in. It also keeps a record of each task: what was asked, the pages visited, and the cost. |
| Contact enrichment (runs only when you ask for it, or when you turn on automatic enrichment) | The contact's name and company or email domain, as web search queries. | Sent to a web search provider under its standard terms. What it finds fills only empty fields on the contact (company, website, job title, LinkedIn); it never overwrites what your team typed. A low-confidence match changes nothing and is only shown as a suggestion. Test addresses, such as example.com, are skipped. |
| AI Avatars (Grow → AI Avatars, when your firm has it turned on) | For an avatar: the photos you upload and the voice recordings you make (including the spoken consent). For a video: the scene still, the avatar's face and wardrobe reference pictures, the spoken line as audio, and our written description of the scene and the person's look. Never contacts, matters or messages. | Handled by three outside providers under their standard API terms, outside zero data retention: an image model makes the scene stills from the reference photos; a voice provider clones the voice from the recordings, turns each line into speech and transcribes recordings to check them; a video provider makes the video. The video provider fetches a render's pictures and audio through private links that expire after 2 hours. The photo checks and the quality checks run under zero data retention. Superpractice keeps the photos (with location and camera details removed), recordings, stills and finished videos in private storage, filed under your firm; finished videos are in Grow → Media and are marked AI-generated. No face templates or other biometric identifiers are made or kept. Deleting an avatar deletes its photos, recordings, stills and line audio, and the cloned voice at the voice provider (optionally its videos too); the record of consent is kept as evidence. |
| Your own AI tools (connected through MCP or the Clio assistant) | Whatever your AI tool reads through Superpractice. | Handled by your AI tool's provider under your own account and plan with them. Check that plan's data and training settings. |
What lives in your workspace
Zero data retention governs processing by third-party AI model providers. It does not mean Superpractice discards the data in your workspace. Superpractice stores the data that makes the product your firm's system of record:
- contacts and matters
- communications you sync
- call and meeting recordings and transcripts
- AI assistant conversations
- AI outputs you keep, like a saved meeting summary or an approved draft
The AI assistant can use its conversation history and other data in your organization's workspace to answer your requests. That workspace copy stays stored by Superpractice and scoped to your organization. When workspace content goes to an AI model provider over the zero-data-retention connection, the provider processes it in passing and does not keep its own copy. Voice features are the exception described above.
Workspace data is scoped to your organization and under your control. Records you delete are removed from the active database, and you can request deletion of all your workspace data at any time. We process that request within 30 days. Encryption and access explains how the data is protected.
Application logs are content-free by policy: prompts, message bodies, and transcripts are excluded from runtime logging.
Encryption and access
-
In transit. Your browser reaches Superpractice over HTTPS only: plain HTTP requests are redirected, and browsers are told to use HTTPS for the next two years. Superpractice calls the services you connect over HTTPS.
-
At rest. Your workspace database and stored files are hosted on Amazon Web Services in the United States. Our database and storage provider encrypts them at rest with AES-256, and it encrypts the backups too.
-
Field-level encryption. Some items get a second layer: Superpractice encrypts them with AES-256-GCM before saving them, under a key held outside the database. They are:
- API keys and passwords you give us to connect CRMs, call tracking, email sending, ad conversion reporting, payments, e-signature, and website publishing
- your Clio and Zoom connections
- webhook signing secrets
- phone call transcripts from call transcription
-
Hashed, never stored readable. Passwords use bcrypt. MCP keys are stored only as a one-way hash. Mobile verification codes are checked against a keyed hash.
-
Held by an integration partner. Gmail, Outlook, calendar, Search Console, and Meta Ads connections are held by an integration partner, and Superpractice stores only a reference to the connection.
-
Private storage, opened only through Superpractice. These are kept in private storage:
- call and meeting recordings
- message attachments
- engagement documents
- task files, and files added to the assistant chat
- the assistant's browsing screenshots
- voicemail greeting and hold music previews
- knowledge files
Recordings, attachments, engagement documents, task and chat files, screenshots, and greeting previews open only through Superpractice, for signed-in members of your firm, checked each time. A copied link asks anyone else to sign in. Two exceptions use a link that expires after an hour: the recording on a client recap page you chose to share, and a signed engagement letter for the client who signed it.
-
Access controls. Every table in the workspace database has row-level security, and the database's public client roles have no table access. Every request is scoped to your organization in the application. Superpractice staff can open a firm's account only through a signed support session, and changes made in it are recorded with the staff member's identity.
-
What is not field-level encrypted. Voice agent transcripts, meeting transcripts, emails, text messages, notes, contact details, and AI conversations are not encrypted a second time. They are protected by encryption at rest and the access controls above.
Retention schedule
| Data | How it is handled | Retention |
|---|---|---|
| Text AI requests | Processed in passing by AI model providers under zero data retention, and not stored there | The provider deletes its copy once it returns the response. Model providers never use the content to train their models. |
| Voice AI requests | Processed live by the real-time voice model provider under its standard API terms | The provider may keep the content for up to 30 days for abuse monitoring. It does not use the content to train its models. See Features outside zero data retention. |
| AI assistant conversations | Stored securely in your organization's Superpractice workspace | Stored while your account is active, so the assistant can use conversation history and other workspace data to answer your requests. You can delete a chat yourself at any time: it is removed permanently with its messages and the files added to it. Included in workspace deletion requests. |
| AI usage records | Stored by Superpractice as metadata only | Feature, model, token counts, and cost are kept, without prompt or response content. |
| AI outputs you keep | Stored in your workspace | Summaries, drafts, and recommendations saved into your workspace live with the records they belong to. Deleting the underlying record removes them. |
| Synced email bodies | Stored in your workspace | Email message content is removed automatically 60 days after syncing. Metadata (sender, recipient, subject, timestamps) is kept for activity history. Opening an older email loads its content live from the connected mailbox it came from, which can be a teammate's, while that person is still at the firm and connected. Otherwise only the kept details show. The original always stays in the email account it came from. See Who on your team sees your emails. |
| Meeting recordings & transcripts | Stored in your workspace. The meeting capture partner and, for transcription, the transcription partner process them temporarily. | Recording and transcription are optional and controlled by your team's settings. Recordings and transcripts in your workspace are kept while your account is active, and deletion is available on request. The capture partner holds its working copy for at most 48 hours. It is typically deleted within the hour, once the recording is verified and archived into your workspace. |
| Phone call transcription (tracked numbers, and calls you place or receive in Superpractice) | Stored in your workspace. The transcription partner processes the audio in passing and does not store it. | On by default. Turn it off under Settings → Calling & Messaging → Transcribe Calls. Full transcripts are stored field-level encrypted and deleted automatically 60 days after the call, along with Superpractice's copy of the recording. The short call summary and logged outcome are kept as the record of the call, and are written to leave out sensitive specifics. With transcription off, recordings stay in your workspace and are not deleted automatically. The telephony carrier keeps its own copy of recordings of calls placed or received in Superpractice, and that copy is not removed automatically. |
| AI voice agent calls (current voice platform) | Recording and transcript stored in your workspace | Kept while your account is active, and not deleted automatically. Deletion is available on request. The telephony carrier's copy of the recording is deleted once it is saved in your workspace. The agent's step-by-step call log (what it looked up and decided during the call) is deleted automatically after 60 days. The summary and outcome are kept as the record of the call. |
| Text messages | Stored in your workspace with the conversation | Kept while your account is active. Attachments are kept with the message in private storage. |
| AI Avatars photos, voice recordings and videos | Stored in your workspace's private storage | Kept while the avatar exists. Deleting the avatar removes its photos, recordings, stills and line audio, and the cloned voice at the voice provider; its videos stay in Grow → Media unless you delete them with it. The consent record (who agreed, to which statement, when) is kept permanently as evidence, as with other consents. |
| Contacts, matters, and attribution | Stored in your workspace | Kept for the life of your account as your firm's system of record. Full workspace deletion is available on request and is processed within 30 days. |
Backups exist for disaster recovery and expire on a rolling window, so deleted records can persist in encrypted backups briefly before aging out.
Limits and exceptions
Honesty matters more than marketing here. These are the limits worth knowing.
- Voice. Live voice is outside zero data retention today, as described above. We will update this page when zero data retention is available for the voice model we use.
- Safety and legal retention. Model providers may keep content flagged by their automated trust-and-safety systems, or where the law requires it, even under a zero-data-retention agreement. Every provider's zero-data-retention terms carry this condition.
- Call and meeting capture. Specialized processing partners handle telephone connections and meeting recording. They operate under their own data-processing agreements, and recordings are stored in your Superpractice workspace. Meeting capture is time-boxed:
- The capture partner keeps its copy of a recording for at most 48 hours.
- In the normal flow, that copy is deleted within about an hour of the recording being verified and archived into your workspace.
- Transcription. The transcription partner transcribes call and meeting audio in passing and does not store it. Every transcription request carries the partner's model-improvement opt-out, so the partner never keeps the audio and never uses it to train its models. The resulting transcript lives only in your workspace, and the summary step runs on the zero-data-retention connection.
- Phone call transcription setting. Transcription of phone calls (tracked numbers, and calls placed or received in Superpractice, inbound and outbound) is optional and controlled by the Transcribe Calls setting. When it is off, recordings are kept in your workspace and never sent for transcription. This setting does not apply to AI voice agent calls. Those are recorded and transcribed unless someone on the call asks not to be recorded, or the firm turns on Don't Record Calls With Clients for calls with clients. In those cases only the call summary is kept. See Recording and the AI notice.
- Legal process. No retention policy prevents a valid subpoena or court order. Our approach is to minimize what exists to produce: content that was never retained cannot be disclosed.
This page describes our technical controls. The binding commitments are in your customer agreement and data processing addendum.
Questions
Ask us directly
Send questions about data handling for your firm, including deletion requests, through Contact support.
Security reviews
Running a vendor security review? We can provide our subprocessor list and documentation of the controls on this page. Use Contact support to start.
Superpractice Zoom app (coming soon)
Connect each meeting host's Zoom account so Superpractice can create booking rooms and send an authorized Meeting Agent into the host's Zoom meetings.
Superpractice support
Get help with account access, integrations, booking workflows, Meeting Agent sessions, and product questions.