Security

How Goose is built

Goose runs on managed cloud services. Your workspace data is stored in the United States, and background work runs in the United States.

Workspace isolation

Every workspace’s data is kept separate at the database level. Each record carries its workspace, and database-level access rules let a signed-in person reach only the workspaces they belong to. A record can’t be moved to another workspace.

Automated tests check these rules against a real database before changes ship.

Encryption

Data travels between your browser, the Goose Mac app and our servers over encrypted connections. Our database, file storage and backups are encrypted at rest by our providers.

Recordings on your Mac are stored encrypted, with the key kept in your Mac’s Keychain.

Sign-in and connected accounts

You sign in with Google or GitHub, so Goose never sees or stores your password.

When you connect a service such as Google, Slack or Salesforce, its access token is kept in an encrypted vault in our database. Only database functions that check you belong to the workspace can read it, and tokens are never shown in the product.

Disconnecting a service stops Goose using its token at once. Goose asks the service to cancel its access and deletes the token when the service confirms. If the service is down, Goose deletes the token after 7 days without that confirmation, and you can remove Goose in the service yourself. Deleting a workspace stops every token at once and deletes them within a day.

What leaves your Mac

The Goose Mac app records the meetings you choose to record. Before you record, it reminds you to get consent from the people in the meeting.

Recordings are saved on your Mac. To transcribe one, the app uploads the audio over an encrypted connection to private storage that only Goose’s servers can read. Each upload link works for one file only.

Goose sends the audio to a transcription provider and deletes the uploaded audio from its storage once transcription finishes. A copy can remain in our encrypted backups for longer. The transcript is stored in your workspace.

What we keep

Goose keeps your workspace data, including meeting transcripts, notes, tasks, signals, drafts and Goose Brain, until you or an admin deletes it or the workspace is deleted.

Goose reads email to find what matters for a deal, then removes the message text from processing. It keeps what it found, short quotes and drafts Goose wrote. If Goose Brain is on, it also keeps passages from external email threads matched to a deal or account.

Backups. We keep encrypted backups of our database and file storage so we can recover from failure. Data you delete can remain in a backup for longer than in our live systems.

Session replays sent with a bug report or feedback are kept for our error-monitoring provider’s standard retention period.

Deletion and export

The workspace owner can export all workspace data from Settings as a download. You can delete individual items in Goose, and an admin can ask us to delete Goose Brain.

The owner can also delete the workspace. Goose disconnects every service right away and keeps the workspace restorable for 30 days, then permanently deletes its data from our live systems. Copies can remain in our encrypted backups for longer.

Access controls

In your workspace, owners and admins decide who has access. Exporting or deleting the workspace is limited to the owner.

At Goose, access to production systems is limited to a small number of named people. Our services’ credentials are never in our code. Every change is reviewed and must pass automated tests, including the workspace-isolation tests, before it ships. We scan our code for leaked secrets and outdated dependencies.

People at Goose don’t look at your content unless you ask us to, we need to investigate a security issue or abuse, or the law requires it.

AI processing

Goose calls AI providers only from our servers, never from your browser. Each request is checked against your workspace’s access first and recorded against your workspace.

We don’t train or fine-tune models on your data. We may change AI providers, and we update our subprocessor list before a new provider handles your data.

Compliance

Goose has not yet completed a SOC 2 audit and holds no security certification. Our hosting and database providers maintain their own SOC 2 reports.

We’ve started preparing for SOC 2. We plan to complete a SOC 2 Type I audit in the first half of 2027, followed by a Type II audit. Until then, we’re happy to share our security overview and answer questionnaires — contact security@getgoose.ai.

The controls on this page are the ones we run today.

Goose is not designed for health information covered by HIPAA, and we don’t sign business associate agreements.

Subprocessors

We use service providers for hosting, database and file storage, backups, AI processing, transcription, payments, email delivery, error monitoring and team notifications. They work under contract, only to provide Goose.

Our language-model providers don’t train on your data under their commercial terms.

Customers can request our current subprocessor list at privacy@getgoose.ai.

Services you connect, such as Google, Slack, Salesforce, Granola and Clari, hold your data under your own agreement with them. Goose reads from or writes to them only as you allow.

Subprocessor changes

We update our subprocessor list before a new subprocessor starts handling customer data. For a material change, we also email workspace admins 30 days in advance. If you object to a change, tell us at privacy@getgoose.ai.

Monitoring and backups

We monitor errors and uptime. Our database has point-in-time recovery, and we keep daily backups with a separate provider.

Reporting a vulnerability

Email security@getgoose.ai with enough detail for us to reproduce the issue. We will confirm we received it and keep you updated until it is fixed.

Safe harbor: if you make a good-faith effort to follow this policy, we will consider your research authorized, work with you to resolve the issue and won’t pursue legal action over it.

We don’t run a paid bug bounty. When you test, please:

• test only against accounts you own or have permission to use;
• stop as soon as you confirm a problem, and don’t access, change or delete other people’s data;
• don’t degrade the service, run high-volume automated scans or target our staff or customers;
• give us reasonable time to fix the issue before you disclose it.

Incident notification

If a security incident affects your data, we will tell your workspace owner without undue delay after we confirm it. We will explain what happened and what we are doing, and help you meet your own obligations.

Changes to this page

We update this page when our controls change, and we change the date at the top.

Contact

Security reports and incidents: security@getgoose.ai. Other questions: support@getgoose.ai.