Security and privacy FAQs

A. The meeting notes, transcripts and account information held in Pulse are stored in a Japanese region as a rule. Stored data is held encrypted, and communication between devices and servers is encrypted too.

Meeting notes are also cached on your own device so they open and edit instantly. Protect the device-side cache with disk encryption and screen locking.

A. Not at present, on a per-customer basis. If you have a requirement here, speak to your account representative.

A. Some processing, such as generating summaries, may be delegated to providers located outside Japan. In that case personal data is transferred abroad.

There are three points worth understanding.

1. The cross-border rules apply even where the provision accompanies delegation. Delegation within Japan is analysed as not constituting provision to a third party, but that exception does not operate where the recipient is a third party in a foreign country.
2. The test is not where data is stored. Saying “the servers are in Japan, so there is no cross-border transfer” is not accurate; what matters is whether personal data is provided to a third party in a foreign country. Sending data to an inference API can be such a provision.
3. UNCHAIN, Inc. relies on having arrangements in place, not on consent. Obtaining individual consent from every meeting participant is impractical, so we provide data only to providers that have put in place arrangements meeting the standards set by Personal Information Protection Commission rules.

A comparison of the approaches, how often we verify destinations, what happens if we stop providing data, and the scope of information provided to individuals are set out under “Provision to third parties in foreign countries” in our Privacy policy. To request that information, contact privacy@the-unchain.com.

A. The names of the destination countries, and the measures taken in the light of an understanding of those countries' regimes, are listed in our Privacy policy. For how UNCHAIN, Inc. goes about that, see the “Understanding the external environment” section of Our security standards.

A. Pulse can be used from outside Japan. This article and the related ones are, however, written on the basis of Japanese law. If you need to address regulation specific to a location outside Japan, speak to your account representative.

A. Write to privacy@the-unchain.com with documentation confirming your identity. We accept requests from statutory representatives and from authorised agents.

Disclosure is made by provision of an electromagnetic record as a rule — either a download within Pulse or an email attachment. Tell us if you would prefer it on paper.

For requests for notification of the purpose of use and for disclosure, we may charge a fee reflecting our actual costs. No fee is charged for correction or cessation-of-use requests.

A. The app's export feature writes out notes, summaries and transcripts in a machine-readable format. Much of a disclosure request can be handled by yourself through it. The steps are in Exporting notes.

Where you need disclosure of personal data not included in an export, write to privacy@the-unchain.com marking it as a disclosure request.

A. You can change it yourself in account settings. The steps are in Changing your account and email address. For fields you cannot change yourself, contact privacy@the-unchain.com. No fee is charged for correction requests.

A. Delete the block from the transcript panel, or delete the whole note. The steps are in Deleting notes.

Note that for data held under business plans, the authority to decide on deletion rests with the customer (the contracting company). A request from a meeting participant should as a rule be made to the organisation that created the record.

A. In the app, go to Settings → Profile → Delete account. If you cannot reach the app, contact tharada@the-unchain.com and we will process it. For details see Deleting your account.

A. Where a leak, loss or damage of personal data occurs (including where it may have), UNCHAIN, Inc. follows the Act on the Protection of Personal Information and its Enforcement Regulations.

• For personal data handled under delegation from a customer on a business plan: we notify the customer promptly after becoming aware (as a guide, within roughly three to five days). That notification relieves UNCHAIN, Inc. of its own duty to report to the Commission. A contract can also provide that UNCHAIN, Inc. reports on the customer's behalf.
• For personal data UNCHAIN, Inc. handles on its own account: we make a prompt initial report to the Personal Information Protection Commission and submit the full report within 30 days of becoming aware (60 days where the act was for an improper purpose). Affected individuals are notified of the outline of the event, the categories of personal data involved, the cause, any secondary harm or risk of it, and other relevant matters.

“Promptly” for the initial report is a guideline benchmark; the 30 and 60 days for the full report are deadlines set by the Enforcement Regulations.

A. Yes. Meeting transcripts can pick up sensitive personal information such as medical history or a criminal record. A leak of personal data containing sensitive personal information is reportable to the Commission even if it affects a single individual. That is what lowers the reporting threshold compared with other business SaaS. Encrypting data at rest is, among other things, a practical measure for managing that threshold.

A. We publish, of our own accord, the cause and preventive measures for outages and security incidents affecting Pulse. See Security reports.

A. UNCHAIN, Inc. has a basic policy and handling rules for personal data in place, and implements measures following the categories set out in the guidelines under the Act on the Protection of Personal Information (organisational, personnel, physical and technical security measures, and understanding the external environment). The main ones are encryption in transit and at rest, access control limiting permissions to what the work requires, capturing and retaining access records, and continuous checking for vulnerabilities.

The specifics for each category are collected in Our security standards. You can use that page as-is for processor assessments and security questionnaires.

A. Where UNCHAIN, Inc. delegates the handling of personal data externally, we do three things.

1. set criteria for selecting a processor and confirm the standard of their security measures before selecting them
2. enter into a contract covering security measures, the conditions for sub-processing, and reporting duties in the event of an incident
3. review periodically how the processor handles personal data

Equivalent conditions are imposed on sub-processors.

A. We provide a list of the sub-processors used to deliver Pulse. Request it from tharada@the-unchain.com. We may require a non-disclosure agreement first. How advance notice of changes to the list is given is set out in our Data processing addendum.

A. On business plans, UNCHAIN, Inc. acts as a party to whom the customer (the contracting company) has delegated the handling of personal data. Provision accompanying delegation is not provision to a third party, so the customer does not need to obtain third-party provision consent from meeting participants. Instead, the customer supervises us as a processor.

By contrast, where you use Pulse's integrations to send a note to another service, the destination is not UNCHAIN, Inc.'s processor but a separate provider. That send can constitute provision to a third party. For details see Integrations overview.

A. We have a standard addendum. Its content is published at Data processing addendum. To enter into it, contact your account representative.

A. The position on each scheme is collected in one place, in the “Certifications and third-party assessments” table in Our security standards. Please check that table for ISMS certification (ISO/IEC 27001), ISO/IEC 27017, ISO/IEC 27018, the Privacy Mark, a SOC 2 Type II report and ISMAP.

The schemes differ in nature. ISO/IEC 27001 is a third-party certification; ISO/IEC 27017 is an add-on to ISMS certification; ISO/IEC 27018 is a code of practice; the Privacy Mark is a domestic accreditation scheme run by JIPDEC; SOC 2 Type II is an audit firm's report, not a certification. ISMAP is an assessment scheme for government procurement, and anyone can check registration on the public list at the ISMAP portal. Pulse is not currently on the ISMAP cloud service list.

We never describe ourselves as “compliant with”, “equivalent to” or “meeting the criteria of” a scheme we do not hold. Whatever the certification position, the controls we implement are described specifically in Our security standards.

A. Yes. Email tharada@the-unchain.com with the form and the deadline. We will tell you what we can answer and whether a non-disclosure agreement is needed first.

Material you can pass to your IT department includes this article, Our security standards, the Data processing addendum and Network troubleshooting.

A. Network troubleshooting lists the destinations that need adding to an allowlist, and the symptoms that appear when traffic is blocked or rewritten. Pass that page to your IT department.

It also helps, when explaining the service in a review, that Pulse sends no recording bot into meetings, runs on the user's own device, and encrypts its traffic.

A. tharada@the-unchain.com. The scope of testing and the conditions are set out in our Vulnerability disclosure policy. We do not run a formal bug bounty, but we may pay a gratuity depending on severity and impact.

For vulnerabilities found in Japan, we also accept reports through the Information Security Early Warning Partnership run by the Information-technology Promotion Agency (IPA).

A. Pulse's website, desktop app and browser extension may send some information from your device to servers operated by providers other than UNCHAIN, Inc., for analytics and error detection. The information sent, the names of the providers handling it at the destination, and the purposes of use are listed on our “Disclosures regarding external transmission” page. If you would rather it were not sent, you can opt out by the method given on that page.

Meeting audio, transcribed text, and the body of the notes Pulse generates are not part of that analytics transmission. They are handled only to the extent needed to provide Pulse.

A. The Pulse desktop app captures the meeting audio playing on your computer and your microphone audio inside the computer itself. It is not a mechanism by which UNCHAIN, Inc. sits in the meeting service's communication path intercepting the call. The audio captured is sent to Pulse's servers for transcription and summary generation.

We treat the parts of Pulse that mediate exchanges between users — sharing and notification features — as subject to Article 4 of the Telecommunications Business Act (protection of secrecy). UNCHAIN, Inc.'s officers and employees do not acquire, use or disclose information subject to the secrecy of communications learned in the course of their work, except where required by law or where there is other justifiable cause. That obligation continues after employment ends.

A. The Penal Code contains no provision punishing the recording of a conversation as such. Article 133 (opening sealed letters) covers opening a sealed letter, and Article 134 (disclosure of secrets) covers disclosure by members of a limited list of professions such as doctors and lawyers; neither applies to recording a meeting.

The Act on Wiretapping for Criminal Investigation likewise governs interception carried out by investigative authorities under a warrant issued by a judge, and does not apply to recording by a meeting's participants.

For the full analysis, see How far you can rely on AI meeting notes.

A. Japanese law contains no provision generally requiring consent from everyone present to record a meeting. The legal obligations that do arise are: notifying or publishing the purpose of use of the personal information acquired; obtaining the individual's consent where sensitive personal information is acquired; and obtaining the individual's consent where the case amounts to provision to a third party.

That said, UNCHAIN, Inc. strongly recommends telling participants that recording and transcription are taking place, even where there is no legal obligation. Wording you can use as-is is in How far you can rely on AI meeting notes. For automatic posting to meeting chat and watermark settings, see About the transparency features.

A. No. Pulse runs on the user's own device and captures audio directly from the microphone and system audio. No unfamiliar account appears in the participant list for others to see, and the meeting host does not need to allow a bot to join.

A. The desktop app (macOS / Windows) transcribes audio in real time and does not store the meeting audio itself. What is stored is the transcript text. Where audio is held temporarily during processing, it is deleted from UNCHAIN, Inc.'s and its processors' systems once transcription completes.

A. Pulse starts transcribing from the act of opening a note. A meeting you have not acted on is never recorded by itself.

Transcription can, however, continue where a meeting overruns or you forget to stop it. Press [End] when the meeting finishes to close the session. The conditions for starting and stopping are explained in How transcription works.

A. A note is private by default. Unless you share it, other members of the same workspace cannot see it either. There are three levels of sharing scope.

• Private: only you can see it
• Within the workspace: only people signed in with a workspace email address can see it
• Anyone with the link: anyone who has the link can see it

These levels are the same on every plan. The steps are in Sharing controls.

A. No. Even an administrator cannot view an individual member's private notes. A note becomes visible to others only when it is added to a folder in the team space, or shared directly with someone.

Enterprise administrators can set a ceiling on the sharing scope permitted across the organisation — prohibiting the creation of public links, for instance. That setting only narrows sharing; it does not make private notes viewable.

A. The MCP integration goes through browser authorisation (OAuth) and reaches only notes you have permission to view. A colleague using the same product cannot reach your notes through it. For details see MCP integration.

A. A moved note stays private. Unless you share it, members of the destination workspace cannot see it. The steps are in Transferring notes between workspaces.

A. It depends on your plan.

• Free and Personal plans: on by default. You can switch it off at any time under Settings → Preferences → Data and sharing.
• Team and Enterprise plans: not used for training. It would go beyond the scope of the delegation, so it is off by default and there is no setting for users to enable it. Administrators can check the workspace-wide setting.

In neither case does an external model provider use customers' data to train their own models. UNCHAIN, Inc. has it in its contracts that data sent is not used in the provider's machine learning. For details see AI models and training data.

A. Yes. Because data is not used for training on the Team and Enterprise plans, there is nothing for an administrator to switch off. The current state can be seen under Data security in Settings → Workspace → General, and what is displayed can be used in answering internal security reviews.

A. This applies to the free and Personal plans. We cannot retrospectively determine on an individual basis whether data from before the change was used for training. Notes and transcripts created after you switch it off are not used for training. If you plan to use it for a meeting involving anything sensitive, switch the setting off before recording that meeting. On the Team and Enterprise plans the question does not arise, because data is not used for training at all.

A. Automatic transcript deletion is off by default (no automatic deletion). Unless you set it, notes and transcripts are kept until you delete them. If you enable it, the retention period can be one day, one week, one month, three months, six months or one year. The steps, and what remains after deletion, are in Automatic transcript deletion.

The Act on the Protection of Personal Information requires businesses to endeavour to erase personal data without delay once there is no longer a need to use it. We recommend deciding how long the business actually needs a record and setting the retention period accordingly.

A. It disappears from the screen immediately, but remains for a period in recovery backups and audit logs. Backups are overwritten generation by generation and erased as the retention period passes. Audit logs are held separately for investigating misuse; they contain only a record of who did what and when, not the body of deleted notes or transcripts. This is also explained under “What remains after deletion” in Automatic transcript deletion.

A. It is available on the Enterprise plan. For the requirements and setup, contact your account representative. Sign-in with a Google account or a Microsoft account is supported on every plan.

A. Pulse does not have multi-factor authentication of its own. Authentication is delegated to your identity provider (Google, Microsoft, or your organisation's SSO), so enable multi-factor authentication there. How sign-in works is explained in Signing in and connecting your calendar.

A. Pulse does not manage passwords directly. Whatever policy your identity provider applies — complexity requirements, expiry and so on — applies to signing in to Pulse.

A. Enterprise administrators can configure the following.

• a ceiling on the sharing scope permitted across the organisation (Sharing controls)
• a transcript retention period applied across the workspace (Automatic transcript deletion)
• requiring single sign-on (SSO)
• reviewing usage

As for use for model training, data is not used for training on the Team and Enterprise plans, so there is nothing to switch off centrally. The current state can be seen under Data security in the workspace settings. Where to find the settings screen is covered in Workspaces.

A. How sector-specific regulation and guidelines apply is covered in Use in healthcare, finance and professional services. It explains that clinical information is sensitive personal information, and that healthcare institutions are subject to the three-ministry, two-guideline framework, financial institutions to the FISC security guidelines, and the professions to confidentiality obligations.

A. UNCHAIN, Inc. does not hold any certification or assessment specific to education. Information about enrolment and grades is personal information, so judge it against your school's personal data handling rules and the requirements of its governing body. We suggest starting with records of staff meetings and training, and drawing a line against using it where pupils' information is involved.