Security & Architecture

1. How the system is put together

Your content lives in one place. A single application, backed by a single database, holds your account, your interviews and their transcripts, your drafts and your team's shared briefs.

Two supporting services of our own sit alongside it. Content Engine does topic and question research, and VideoTrim turns a recorded interview into short clips. Both are built and run by us, in the same EU region as the main application, and each receives only what its job needs. Everything on this page, and everything in our privacy policy, applies to them as much as to the application itself.

The AI models are the one thing we do not run. Section 4 lists exactly what is sent to whom.

Solid lines are reached from our servers. The dashed line is the browser's own: PostHog loads in the page, with your consent, and so does VideoTrim's clip editor when you open it.

2. Where your data is stored

The application and its PostgreSQL database run on Railway, in Amsterdam, the Netherlands (the europe-west4 region). Your account, your transcripts, your drafts, your team's shared briefs and your session records all live in that single database. Content Engine and VideoTrim, the two supporting services we operate ourselves, run in the same region.

Your data is not replicated to other regions, and we do not copy production data into development environments as a matter of routine.

Several of the AI, payment and identity providers in section 4 are established in the United States, so using Outerview does involve transfers there. Those transfers run under the European Commission's Standard Contractual Clauses, and under the EU-US Data Privacy Framework where the provider is certified. Section 14 of the privacy policy covers this in legal terms.

3. Encryption

In transit

TLS everywhere, with HTTP Strict Transport Security set to a year across the domain and its subdomains, so a browser that has seen us once will refuse to connect over plain HTTP. Calls to every provider in section 4 are made over TLS as well.

At rest

The database and its storage volume are encrypted at rest by our hosting provider. On top of that, two categories get their own application-level encryption because they are the ones that would let someone act as you somewhere else:

• Passwords are never stored, encrypted or otherwise. We keep a bcrypt hash at cost factor 12. It is a one-way function that cannot be reversed into your password, and it is deliberately slow to make bulk guessing impractical.
• Third-party access tokens, such as your LinkedIn token or your team's Slack bot token, are encrypted with AES-256-GCM before they are written to the database, using a key held only in the server's environment and never in the database beside them. They are never sent to your browser.

Magic-link invitation tokens are stored as SHA-256 hashes, not as the link itself, so the database does not contain a working credential. Re-issuing a link replaces the hash, which is what makes a copied link revocable.

4. What leaves our servers

Outerview is built on models we do not operate ourselves, so being precise about what goes where matters more than a general assurance. These are every party that receives data, and why:

Provider	Region	What it does
Railway	EU (Amsterdam)	Application hosting and the production database
OpenAI	US	Real-time voice interviews, speech-to-text, image generation
Anthropic	US	Written interviews, insight extraction, drafting and refinement
Tavily	US	Public web search for pre-interview background research
Stripe	US / Ireland	Subscriptions, invoicing and VAT. Card data never reaches us
Mailjet (Sinch)	EU	Transactional email for invitations and password resets
Google	US / Ireland	Sign-in with Google; Analytics only with cookie consent
PostHog	EU	Product analytics, EU region, only with cookie consent
LinkedIn	US / Ireland	Publishing and post metrics, only if you connect it
Slack	US	Team assistant, only if your team connects a workspace
Discord	US	Team assistant, only if your team connects a server
Google Gemini	US	AI-assistant visibility checks on your company's field
TypeSafe	—	Fact checking of interview answers (Jev model)
DataForSEO	—	Search keyword and ranking data for company websites. No personal data
GetResolved	—	Support chat on the website and in the app
Gravatar	US	Profile picture lookup from a hash of your email, if you have none
Google Fonts	US	Typefaces, loaded by the browser
Content Engine	EU (Amsterdam)	Our own content research service. Receives your profile, writing samples and transcripts
VideoTrim	EU (Amsterdam)	Our own video service. Only used if you record video. Sends the audio to OpenAI and the transcript to Anthropic

Nothing you produce trains an AI provider's model. Our agreements with OpenAI and Anthropic are commercial API agreements under which inputs and outputs are not used for training. We do not train models of our own on your interviews or content. The only thing that learns from your edits is Outerview's picture of how your own team writes. We do not sell data or share it for advertising.

5. Application hardening

• Content Security Policy on every response, restricting where scripts, styles, fonts, images and network connections may come from. A script injected into a page has nowhere to send what it steals.
• Clickjacking is blocked. The application refuses to be framed by any other site.
• Standard hardening headers: no MIME sniffing, a strict referrer policy, isolated browsing context, and upgrade-insecure-requests.
• Parameterised database access. Queries are built through a typed query builder rather than assembled as strings, which removes the ordinary route to SQL injection.
• Request bodies are capped at 1 MB, and uploads are size-checked and written outside the web root.
• Webhooks are cryptographically verified. Stripe and Slack callbacks are checked against the raw bytes each provider signed; an unsigned or altered request is rejected rather than trusted.
• Audit logging of security-relevant events such as sign-ins, failed sign-ins, administrative actions and support sessions, retained for up to 12 months.

6. Voice, video and transcripts

Voice is not recorded. During a call your audio is relayed to OpenAI and transcribed as you speak. We keep the resulting text. No audio file of your voice is written to our storage at any point.

Video is off unless you turn it on, per interview, on the screen before the call starts. When it is on we capture your camera along with the call audio. When the call ends the file goes to VideoTrim, our own video service in the same EU region, which stores it, and the copy on the application server is deleted. VideoTrim sends the audio track to OpenAI for a timed transcript and the transcript text to Anthropic to choose clips; the footage itself never goes to an AI provider. The clip editor runs on a scoped token minted for that one project and expiring within the hour. Only you can reach your recording.

7. How we build and ship

We work the way a careful team is expected to. Changes are reviewed and tested before they are released, and they move through preview and release-candidate environments rather than going straight to production. Database changes are applied as versioned, ordered migrations, not as edits made by hand against a live system.

An automated test suite runs on every change, secrets live in the deployment environment rather than in the codebase, and dependencies are pinned so a build is reproducible and can be patched deliberately.

8. Retention and getting your data out

• Voice audio: never stored.
• Account, transcripts, drafts and generated content: kept while your account exists, or until you delete them. Erased within 30 days of account deletion.
• Audit and security logs: up to 12 months. Server logs: up to 90 days.
• Accounting and invoicing records: six years, as Finnish law requires.
• Sessions: 7 days, or until you sign out.

You can delete your account yourself, from your profile page in the app. It happens straight away: your account, interviews, transcripts, posts and images are erased from the application and from Content Engine, and your Stripe customer record is deleted. To export your data, or to have us delete it for you, write to info@outerview.app. We respond within 30 days. Deleting a team's shared brief deliberately does not delete the interviews people recorded against it. An interview belongs to the person who gave it, and it stays with them.

9. Incidents and reporting a vulnerability

If a breach affects personal data and is likely to risk people's rights, we notify the Finnish Data Protection Ombudsman within 72 hours and inform affected users where the law requires it.

If you have found a security problem in Outerview, we want to hear about it before anyone else does. Write to info@outerview.app with enough detail to reproduce it. We will acknowledge it, keep you updated while we fix it, and we will not pursue anyone who reports a genuine finding in good faith and does not access or alter other people's data while doing so.

10. Questions this page did not answer

We are a small company and we would rather answer a specific question than publish a certification badge we have not earned. If your review needs a data processing agreement, a sub-processor list in a particular format, a security questionnaire filled in, or detail we have not covered here, write to info@outerview.app and a person will answer.

My Dreams Are These Oy
Business ID 3622718-6
Finland, European Union