“Your data is safe” is the cheapest sentence you can write on a website. It costs nothing, it can’t be checked from outside, and everyone writes it.
So instead of repeating it, here is what we went to look at, what came back, and where we ran out of things we can prove.
01Where they are, literally
In the European Union, in Ireland. And not “mostly”: we counted the pieces one by one —the databases, the file stores, the programs that answer when you talk to Saelyx— and every one of them is there. Not a single stray one on another continent.
We checked it that way on purpose. It is easy to put the bulk in Europe and leave one piece outside without noticing, because nothing breaks when it happens: it keeps working exactly the same. The only way to know is to count.
The one case apart, said here and not buried: the Apple Watch. Its microphone connects straight to the provider, so that audio does not pass through our servers. It does stay in Europe: since 9 August 2026 it goes to Amazon (Transcribe) in Ireland. It is spelled out, with names, in the privacy policy.
Corrected on 26 August 2026. Until today this paragraph called the Apple Watch «the exception» to everything being in Europe. That stopped being true on 9 August, when we changed that path: the audio still does not pass through our servers, but it no longer leaves Europe. We are leaving this note rather than rewriting it quietly.
02Encrypted, and what that actually means
Your memory is encrypted in transit and at rest. The second one with our own key, which rotates by itself, not the one that comes switched on by default. The difference matters: a key of your own can be disabled —and then nothing decrypts again—, it leaves a trace of every use, and it renews without anyone remembering to do it.
And now the part almost nobody tells you. Having your own key does not mean few people can decrypt. That is decided by who has permission, which is a separate thing handled separately. Saying “encrypted” and letting it sound like “nobody can see it” is the most common sleight of hand in this industry. We say them apart because they are two separate questions.
03What deletes itself
- The raw transcript of a meeting: 30 days.
- Videos and their transcripts: 30 days.
- The exports you generate: 30 days.
- What you import: 7 days.
That is what is configured. But a deletion rule that is set and a deletion rule that is working are two different things, and we have learned that by running into the gap. So we went to look at the oldest file still alive. It was 36 days old, against a rule of 35. That extra day is not a fault: deletion runs in batches, not the second the deadline passes. What it proves is the thing that matters: the rule isn’t declared, it is deleting, and that is why nothing older is left.
We write the exact number instead of rounding to “exactly the age it should be” because the first version of this paragraph said that, and it was wrong by a day. A figure rounded towards the picture that suits you stops being a figure.
04What does not delete itself, on purpose
Your memory. The facts you decide Saelyx should remember do not expire, and that is a decision, not an oversight: a memory that evaporates on its own is worth nothing.
The consequence has to be said in full, even though it sounds worse: if you stop using Saelyx and don’t delete your account, your things are still there. The cleaning up is yours. That is why the memory is a list you can open, read, edit and empty —and the account can be deleted whole, cascading—. We cover it at length in your memory in Saelyx.
The same goes for the documents you attach: they don’t expire. Checked —the oldest one still there is over two months old— and it matches what the policy says, which keeps them while your account is active. If you showed it a contract in June, that contract is still there.
05Our favourite proof: what doesn’t fit
We say audio and screen are processed on the fly and not stored in our systems. You can check that by reading configurations… or you can check it by counting.
A conversation session takes up under 300 bytes on average in our databases. For scale: 300 bytes is about fifty words of this article. Identifiers and timestamps fit in there. A second of audio or a single frame weigh thousands of times more.
And here we have to be exact, because the first version of this paragraph said “does not fit”, and that promises more than the measurement supports: a single record could reach 400 KB, so a frame would fit. What the average shows is not that it is impossible —it is that they are not there; if they were, the number would be entirely different—.
We give a ceiling rather than an exact figure, and it is worth explaining why. The first version of this paragraph said “262 bytes”. Measuring it again a few hours later gave 268: the size the database reports is an estimate that refreshes itself every few hours, so the exact figure expires without warning. “Under 300” is still true tomorrow. Three exact digits sound more rigorous and are less true.
We like this proof more than the others because it doesn’t depend on anyone having configured anything correctly. A retention rule can be set wrong. A setting can be changed tomorrow. But the measured size is what it is: the audio isn’t there, and you can see that in the number without trusting any setting.
06Three things we can’t prove to you from here
This section is what makes the rest worth anything.
- That the voice engine provider holds up their end. We configure what can be configured and we name them in the policy. But what happens inside their house is guaranteed by their contract, not by our word.
- That deletion takes absolutely everything. The buttons exist and they work. That the cascade doesn’t miss a corner can only be shown by deleting a real account and going to look for the leftovers. It is a check that needs doing, not one we can show you yet.
- None of the above, if you don’t believe us. All of this is claims about servers you have no access to. You can believe them or not; you cannot verify them from outside. That is why we prefer them specific and falsifiable —dates, figures, exceptions— rather than reassuring.
07Frequently asked questions
Is everything in Europe?
Saelyx infrastructure is, in Ireland, checked piece by piece. The Apple Watch audio goes straight to the provider, without passing through our servers, but it also stays in Europe as of 9 August 2026. The only data that may be processed outside the European Economic Area is with some external providers. Both cases are in the policy.
What does “encrypted” mean exactly?
In transit and at rest, with our own key that rotates by itself. It does not mean that few people can decrypt it: that depends on permissions, which is a different thing.
Is my audio stored?
Not in our systems. A session takes under 300 bytes on average: if the audio were there, the number would be entirely different.
What if I stop using it?
Your memories are still there. They don’t expire, on purpose. You can empty them one by one or delete the whole account.
When does meeting data get deleted?
The raw transcript after 30 days, on its own. The summary stays until you delete it or close your account.