Trust Center

Security, compliance and where the video lives.

The free recorder keeps every take in the browser. In a workspace, a take goes to EU-hosted storage or to a bucket you own, and nobody sees it until it is sent. The subprocessors, the TOMs and the document for the works council are on this page, and the security questionnaire is on request.

Security questionnaire

The free recorder keeps every take in the browser
EU hosting, or your own bucket
TOMs and subprocessors on this page, the DPA a click away
No passwords: a code by email, or your single sign-on

4 documents 1 on request security@capme.app

Overview Subprocessors TOMs Works council & DPO Security questionnaire

What Capme holds, and where the video is

On Capme's servers

Accounts: email address, name, job title, sign-in times, language
Workspaces: members, roles, settings, branding, billing details, single sign-on setup
Meetings: titles, agendas, audience, watch progress
Recording metadata: title, length, size, status
Audit log for 365 days; legal acceptances
The database is Capme's own instance in Nuremberg, Germany, operated by Elestio on netcup

The video itself

Free: in the browser only, never uploaded
Solo, Team, Business, Enterprise: EU hosting on Bunny Stream, stored in Germany
Business and Enterprise: your own S3 bucket instead, if you choose
The video is never on Capme's servers; its poster image passes through them

Capme does not transcribe, summarise or analyse recordings and trains nothing on them. The full description of the processing is Annex II of the DPA.

Where a recording goes

Every take is written to the browser's own storage on the device first. In the free recorder it stays there until somebody uploads it. In a workspace it starts uploading as soon as recording stops, so that sending it is instant. Nobody sees it until it is sent. A discarded take is deleted. After a retake, the earlier take is removed from the host and stays in this browser until its list of recent takes is full. It lands where the workspace chose: EU hosting, or a bucket the customer operates. It plays for the person who recorded it and, once it is in a meeting, for that meeting's organiser, speakers and audience and the workspace's admins. A public link, if the workspace has turned them on, lets anyone who has the link watch, and a customer who serves its bucket publicly makes the files public.

Start recording

Your device. The free recorder stops here unless you upload.

Encoded in the browser

Blur and branding on the device

Saved to browser storage

In a workspace, as soon as recording stops

EU hosting

Bunny Stream, stored in Germany, played only by the people it was shared with. Solo, Team, Business, Enterprise.

Your own bucket

Browser to your S3-compatible storage. The video never passes through Capme. Business, Enterprise.

Capme's servers hold the metadata in either case and pass the poster image through, never the video.

Watch progress and the works council

The meeting product records how far each viewer got in each topic. By default the organiser and the workspace's admins see, per person, whether a meeting was watched, partly watched (how many of its topics), only opened or not opened; an admin can switch the workspace to totals only. The admin overview shows workspace totals and names up to ten people who still owe recordings. There are no scores and no performance ratings. In Germany a system that can show who watched what is subject to works-council co-determination (§87(1)(6) BetrVG). The document for the works council describes exactly what is measured and who sees it, so that a Betriebsvereinbarung can be written from it.

The document for the works council and the data protection officer

Certifications and assessments

SOC 2ISO 27001Capme has neither. The hosts have their own: Hetzner ISO 27001; netcup ISO 27001 and ISO 27701.

No independent security test yet. Capme has not had an independent penetration test or security assessment. Until it has, the TOMs and the security questionnaire describe the controls as they are built.

Legal & resources

Data Processing Agreement Privacy Notice Terms of Service Imprint Set up single sign-on Connect your own bucket Is video messaging GDPR compliant? What secure video messaging needs, and where the recording lives The sovereign productivity stack: five European tools, checked against four questions

Status & security

System status & uptime

Report a vulnerability