Security & Privacy

Who can reach your sessions

Your sessions are generally scoped to the account they were created under. We design the product so that another customer's account does not have access to your sessions, scores, or recordings.

Some features are designed to let other authorized participants on your account access session content. Live roleplay is one of them: when you record a live roleplay, other authorized people on that account can open its recording, transcript, and scorecard.

If you practice in an account owned by someone else, that account owner can view your activity, scores, session reviews, transcripts and recordings for sessions created in that account. This access does not include sessions in a separate personal account.

The exception is a session a member marks “Practice privately”. For those sessions the account owner does not see the scorecard, transcript or recording; the owner sees only that member's total minutes. A session marked “Coaching only” shows no score to anyone.

A limited number of authorized personnel and service providers may access data as reasonably necessary to operate, secure, support and troubleshoot the service, to enforce our terms, and to comply with law.

You practice on AI clients, not your real ones

Every persona you talk to is a fictional character. You're rehearsing against a simulation, so no real client's information is in the room unless you bring it, and the rule is simple: don't enter real client details.

We keep only what we need

Your transcripts and recordings are stored to generate your coaching and to let you review your own sessions. Where we can improve the product from patterns across many sessions rather than from individual ones, that is what we do.

How your sessions are processed

Turning a spoken conversation into coaching involves a couple of specialized AI services, one for the voice and one for the scoring. We choose providers that are themselves independently audited for security, and we work with them under commercial terms, not consumer ones. We do not sell personal information. We work with our AI and voice providers under commercial terms rather than consumer ones, and where a provider offers an opt-out from training its models on submitted content, we have taken it.

During a voice session, our voice provider sends the conversation to a language-model provider, which writes the practice client's replies. That provider is named in our Privacy Policy's provider list.

We also run automated quality checks on session transcripts with a classification model, which returns labels and scores rather than text. Automated tools strip names and contact details from each transcript first. Each request asks for zero data retention and no training. That provider is named in our Privacy Policy's provider list.

A language model also reviews each scored session and its scorecard for quality problems. Cadence's team uses these reviews to improve the product; they never change your scores or appear in your account.

When a practice session shows an animated client, a real-time avatar provider renders the client's face and lip movement from the AI client's speech: it receives the AI client's audio, not your microphone audio, your transcript, or your account details.

Phone calls and text messages are carried by Twilio. A call to our practice line is answered by an AI assistant through our voice provider, and the call is recorded and transcribed.

Who processes what

These service providers handle parts of the product. Our Privacy Policy has the details of what each one receives.

What Cadence doesn't do

• All practice is fictional. Every client you talk to is a simulated character.
• Cadence does not connect to your client email, CRM, phones or other client systems.
• Cadence is not used on real client calls.
• We tell advisors not to enter real client details. The scrub that removes names and contact details is best-effort and can miss things, so please keep real details out.

What we measure, and what we don't

We measure how the product gets used so we can fix what gets in the way. That measurement is tied to an internal account identifier rather than your name, and we do not send your email address or your name to our analytics provider.

We never record your screen inside your account or your practice sessions, and we do not automatically capture the text of things you click. On our public website pages only, and only when you are not signed in, a masked session recording and heatmap show how visitors use those pages (form text and practice transcripts masked, no audio, kept for 30 days; the Privacy Policy says how to turn it off). Inside the app we record a fixed list of named events (that a session started, that a scorecard was opened), and practice run by our own team is marked so it stays out of the numbers. Events are kept for up to seven years (our analytics provider's retention period on our plan), and when you delete your account we also try to delete your record and its events with the provider (best-effort, with that expiry as the backstop).

We also measure page delivery and speed with Vercel Web Analytics and Speed Insights, which report traffic and performance without cookies. Our Privacy Policy lists what is stored in your browser, and by whom.

Encryption and infrastructure

Your data is encrypted both in transit (TLS) and at rest (AES-256). Cadence Coach runs on cloud infrastructure that is independently audited and certified to SOC 2 Type II and ISO 27001, recognized standards for security, availability, and confidentiality.

We use reasonable administrative, technical and organizational safeguards designed to protect information. No system can guarantee absolute security.

Real client details

When you practice against a scenario you wrote yourself, our Service runs an automated scrub that replaces names and removes emails, phone numbers, and account numbers before the transcript is stored. The scrub is best-effort and it can fail; when it does, we store the transcript as it was spoken rather than lose your session.

You are responsible for not entering real client names, account numbers, or other confidential information into a practice conversation.

Retention and deletion

We retain information for as long as reasonably necessary to provide the service, meet legitimate business needs, resolve disputes, maintain security, and comply with law. You can delete individual sessions in the product and can ask us to delete your account. Deletion may be subject to legal obligations and to limited backup or operational retention.

To ask us to delete your account, email support@cadencecoach.ai. Records we are required to keep (basic billing and tax records, and anything needed to resolve a payment or legal dispute) are retained separately from your practice content. Your card details are held by our payment processor, not by us.

For signed-in practice, our voice provider retains conversation data (audio and transcripts) for up to 30 days under our agreement with them, after which it is removed from their systems. The free landing trial has separate retention described in our Privacy Policy.

The avatar provider states that it does not retain session data in the mode we use.

For compliance and security teams

If your firm requires vendor documentation, we're glad to help. On request we can provide our subprocessor list, a description of how your data flows through the product, and a summary of our infrastructure provider's security certifications. Reach us at support@cadencecoach.ai.

If practice won't connect on a work computer, open our network check on that computer. It tests each connection the practice room needs and gives your IT team the exact domains to allow.

Questions

Email us at support@cadencecoach.ai. We'd rather answer a hard question than leave you wondering.