Nova Intelligence
Trust & Transparency Center
How DebriefCore handles your knowledge, your voice, and your data.
Human-Approved AI Workflow
Nova prepares knowledge drafts. Every AI output remains in draft status until a human reviewer reads, edits if needed, and approves it. Approved knowledge is the only output that reaches your organization's source of truth.
Voice Identity Consent
Voice Identity is off by default and requires your workspace admin to enable it. Enrollment requires 3 explicit checkboxes and recording 3 phrases. You can disable or permanently delete your voice profile at any time from Settings.
Biometric Template Handling
Voice embeddings are AES-256-GCM encrypted server-side before storage. The encryption key never reaches the browser. Raw audio is never stored. Embeddings are never returned to the client. Voice Identity is never used as sole authentication.
Chain of Custody
Every approved knowledge article records who contributed it, how they were identified (account login or voice match), and what confidence level applied at the time of capture. This chain is visible in the article detail view.
Audit Logs
DebriefCore maintains an audit event log for key platform actions: enrollments, approvals, exports, role changes, and voice identity events. Logs are append-only and written via the service role — they cannot be modified through the application.
RLS & Access Controls
Row-level security is enforced at the database layer. Organization data is isolated by organization ID. Members can only see their own organization's knowledge. Encrypted embeddings have no browser-readable RLS policy — they can only be accessed via server-side API routes.
Data Export & Recovery
You own your knowledge. Approved articles are exportable in JSON format from the admin area. Deleted articles enter a soft-delete recovery queue before permanent removal. Your data does not train DebriefCore's models.
Session Listening
Session Listening is opt-in and session-scoped. It starts only when you press 'Start Listening' and stops the moment you press 'Stop Listening' or leave the Boardroom. Nova never listens in the background. The browser's SpeechRecognition API is used only for wake-phrase detection ('Nova' / 'Hey Nova'); actual questions are recorded by the same MediaRecorder pipeline as Push-to-Talk. No continuous audio is sent to DebriefCore servers.
Compliance Disclaimer
DebriefCore helps you organize governance evidence and supports audit-readiness workflows. It does not certify legal or regulatory compliance with SOC 2, ISO 27001, HIPAA, FAA SMS, or any other framework. Compliance certification requires independent qualified assessment.
AI Governance Alignment
Built with AI security and governance guidance in mind.
DebriefCore is designed around AI governance principles that support human review, access control, transparency, and accountable knowledge workflows. We use OWASP LLM guidance to identify application-level AI risks such as prompt injection, sensitive information disclosure, overreliance, and excessive agency. We also align our internal AI governance process with NIST AI RMF concepts such as Govern, Map, Measure, and Manage.