Security

Recallio uses Google sign-in, per-user data access checks, and server-side authorization for app, admin, billing, and AI routes.

Dodo webhook events must pass signature verification before they can update subscription access.

AI generation is rate-limited before any OpenAI request is made. Admin actions are recorded in an audit log.

Do not store highly sensitive information if you are uncomfortable with AI processing.