← Back

Security Policy

Version 4 · published November 2, 2026

SAMMURAI

Security Policy

Last updated: 2 November 2026

This page explains how Sammurai, Corp. ("Sammurai", "we", "us") protects your account and your Sit Downs, what we do if something goes wrong, and how to report a security problem to us. It describes the controls we actually run today, at a level that is useful to you without giving attackers a map.

1. Where Your Data Lives

Sammurai runs on Amazon Web Services (AWS) in the United States, in one region (us-east-1, Northern Virginia). Your account, your Sit Down recordings and transcripts, and what Sammy learns about you are all stored there. Sammy's own AI, speech recognition and voice run on servers we operate in that AWS account. The text we send to Amazon Bedrock, described in our AI Policy, is also processed by AWS in the United States.

2. Encryption

In transit. Our website, web app and the apps' connections to our servers use HTTPS with TLS 1.2 or newer, and plain HTTP requests are redirected to HTTPS. During a live Sit Down, the audio and video travel over WebRTC, which encrypts them (DTLS-SRTP).

At rest. These are encrypted, using keys managed by AWS:

  • our database;

  • Sit Down recordings and the still frames used for thumbnails;

  • database backups;

  • server disks and file storage;

  • our cache.

The sign-in tokens we keep from Apple, and the Google Calendar token if you connect your calendar, are also encrypted by our own application (AES-256-GCM) before they are stored.

What this is not. Sit Downs are not end-to-end encrypted. Our servers need to hear and see a Sit Down to run Sammy, record it and write the transcript. That is why the rest of this page is about who and what can reach that data.

3. Signing In

You sign in with Sign in with Apple or with your Google Account. Sammurai never receives or stores your Apple or Google password. If you use Apple's Hide My Email, we see only the relay address.

In the web app, your sign-in is held in cookies that scripts on the page cannot read. The access cookie lasts 15 minutes and is renewed while you use the web app; the renewal cookie lasts 30 days or until you sign out. In the apps, your sign-in is kept in your phone's secure storage.

Your Apple ID or Google Account is the key to your Sammurai account, so protect it with a strong password and two-factor authentication, and set a screen lock on your phone. If you think someone else has used your Sammurai account, email info@sammurai.ai with the subject "Account security".

4. Who Can Reach Your Data

  • Other people see a Sit Down only if you share it, as the Terms of Service and Privacy Policy describe. Each Sit Down is private unless you choose otherwise. Recordings are kept in private storage with all public access blocked, and are played back only through links that expire.

  • Our team. A small number of named Sammurai staff can reach the systems that hold your data. Every sign-in to our AWS console requires multi-factor authentication, and actions in our AWS account are logged. Staff look at a person's content only to answer that person's request, to review a report, to investigate a security problem or abuse, or to meet a legal obligation.

5. Protecting the Service

  • A web application firewall sits in front of our website, web app and API. It blocks requests from addresses on known-bad lists and known attack patterns, and limits how fast any one address can send requests.

  • Audit logging of actions in our AWS account is on in every AWS region, with log-file integrity validation.

  • AWS GuardDuty threat detection runs on our account.

  • Alarms on security-relevant changes in our AWS account, such as use of the root account, a console sign-in without multi-factor authentication, or changes to access rules, and on service failures, are emailed to our engineers.

  • Container images are scanned for known vulnerabilities, and our servers are scanned by Amazon Inspector.

We do not claim round-the-clock staffing.

6. Backups

  • Our database is backed up automatically. We can restore it to any point in the last 14 days, and a daily backup is kept for 35 days, encrypted, in a separate backup vault.

  • Sit Down recordings are stored once and are not copied into backups. When a recording is deleted, it cannot be brought back.

  • Sammurai runs in one AWS region. A region-wide AWS outage would take Sammurai offline until it ends.

7. Deletion and Backups

When you delete a Sit Down or your account, we remove data from our live systems as the Privacy Policy describes. Copies already in our database backups are removed as those backups expire, within 35 days.

8. Logs

Our servers' application logs and firewall logs are kept for 30 days. Load-balancer access logs and AWS account audit logs are kept for 90 days. Some of these logs include IP addresses.

9. Service Providers

These providers handle data for us, each only for its own job:

  • Amazon Web Services: hosting, storage, email delivery (Amazon SES) and the Amazon Bedrock AI service;

  • Google: Google sign-in, the optional Google Calendar connection, Google Analytics for Firebase in the Android app, and delivery of notifications to Android phones;

  • Apple: Sign in with Apple, App Store purchases, and delivery of notifications to iPhones;

  • Expo: passes notifications from our servers to Apple's and Google's notification services;

  • Stripe: payments on the website;

  • Microsoft and Google: our email (the info@sammurai.ai mailbox is run by Microsoft; our team's mailboxes, which receive reports, are run by Google).

Browser notifications from the web app are delivered through the push service of your browser's maker.

The Privacy Policy says what each one receives. We do not sell personal information.

Google user data

Sammurai's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy and the Google Workspace User Data and Developer Policy, including the applicable Limited Use requirements. You can remove Sammurai's access to your Google Account at any time at https://myaccount.google.com/permissions. If you disconnect Google Calendar in Sammurai, we stop reading your calendar; the encrypted token stays stored, marked as disconnected, until you delete your account. Disconnecting in Sammurai does not remove our access on Google's side, so to do that, use the Google page above.

10. If Something Goes Wrong

If we learn of a security incident, we work to contain it, find out what happened and whose information was involved, and fix the cause. Where a security incident affects personal information, we will notify the people affected, and regulators, as required by applicable law.

11. Reporting a Vulnerability

If you think you have found a security problem in Sammurai, please tell us. Email info@sammurai.ai with the subject "Security". Please include what you found and where (the web address, app screen or API endpoint), the steps to reproduce it, and what an attacker could do with it.

Please test only against your own account, do not access, change or keep other people's data, do not disrupt the service for others, and give us reasonable time to fix the problem before you disclose it publicly. Denial-of-service testing, spam, social engineering of our staff, and attacks on services we do not run, such as AWS, Apple, Google, Expo and Stripe, are out of scope; report problems in those services to those companies.

12. Responsible Disclosure and Safe Harbor

Sammurai appreciates good-faith security research. Sammurai will not pursue legal action against researchers who report promptly and in good faith, do not access or exfiltrate data beyond what is minimally necessary, do not disrupt services or users, do not publicly disclose before reasonable investigation and remediation, and comply with applicable laws. This safe harbor does not apply to intentional misuse, unauthorized data access, attacks on users, extortion, disruption, or use of a vulnerability for personal gain.

13. Bug Bounty

Sammurai does not operate a paid bug bounty program. Responsible disclosures are still welcome.

14. What This Page Does Not Claim

  • Sit Downs are not end-to-end encrypted.

  • This page does not claim any security certification or independent audit.

  • No system is perfectly secure.

15. Changes to This Policy

We update this page when our security practices or how to reach us change. The date at the top shows the last change.

16. Contact Us

Sammurai, Corp., 10 Maple Street, Port Washington, NY 11050, United States.

Security reports and everything else: info@sammurai.ai