Data processing and hosting
Cue can process recordings and transcripts using services operated within your organization's environment. Whether everything stays there depends on the actual configured services, not simply on the use of Cue.
Data flow
| Operation | Information processed | Processing boundary |
|---|---|---|
| Browser recording or upload | Audio/video and recording metadata | Browser to Cue backend and recording storage |
| Transcription and speaker separation | Audio and generated transcript | Configured transcription worker |
| Translation | Transcript text and translated text | Configured translation service |
| Generated analytics | Transcript text and generated findings | Analytics worker and configured model service |
| Supervision | Comments, replies and session references | Cue application database |
| Sign-in and email | Identity information and delivery metadata | Configured identity and email providers |
The existing self-hosted processing setup uses Whisper-based transcription, LibreTranslate for translation and Ollama for optional generated analytics. These services can run privately. A configured remote translation or model endpoint changes the processing boundary: confirm its location and operator before enabling it for sensitive sessions.
Local processing has limits
Keeping workers within your network does not make recordings anonymous or end-to-end encrypted. Authorized backend services need to process the media or text. People who can read a session can also read its supervision discussion.
Downloading model files during installation is different from sending session data to a model service at runtime. Ask which outbound connections are enabled in the deployed configuration.
Operating responsibilities
For customer-operated installations, the customer manages infrastructure, network protection, storage encryption, backups and recovery unless separately agreed. For hosted installations, responsibilities and processing regions must be recorded in the service agreement and applicable supplier list.
Use HTTPS in production. Disk and backup encryption, log retention and recovery commitments are deployment settings. Application deletion does not determine how long every backup or downloaded copy remains.
What to confirm before use
- Locations and operators of recording storage, workers, translation and analytics services.
- Enabled features and the information each sends to other services.
- Identity and email providers, administrator access, and incident contact.
- Retention, backup removal and recovery procedures.
- Applicable data-processing agreements and organizational recording/consent procedures.
Self-hosting alone does not establish legal compliance or security certification. Use your organization's review process and request evidence for the specific installation.