Data flow
What is captured, where it is processed, and the short list of what crosses the network.
Security and privacy documents
The documents your reviewers need, in one place. During the paid 90-day set-up, we walk your security team through them.
Encryption
SQLCipher whole-database encryption, AES-256-CBC with HMAC-SHA512, keyed from the platform secure store: the macOS keychain, or Windows Credential Manager.
Sub-processors
The complete list is below. Neon stores account records, attached feedback diagnostics and content consultants explicitly publish. Connected cloud AI apps send queries and returned excerpts to their provider. The personal Microsoft 365 Copilot connection relays them through Overshow's gateway on Cloudflare.
Identity model
Magic link or SSO, one active device per user, and explicit confirmation before moving access to another device. Captured data stays on the original computer.
Capture controls
Pause, ignore lists, exclusion categories, and built-in rules for sensitive surfaces.
Operational health
Signed releases, a documented update channel, and separate deletion boundaries for the local store and shared organisation content.
Who can use which knowledge
Personal history, shared engagement content and connected AI conversations have separate access and retention boundaries.
Teams transcripts into private history
We agree selected eligible Teams meetings and the required Microsoft permissions and administrator consent at set-up. Saved transcripts go into the consultant's private history. They are never shared automatically. Microsoft controls the original transcript's storage and access; its policies may restrict access or speaker attribution.
Shared content for the engagement
The consultancy decides who can access each engagement and which AI connections it allows. Authorised colleagues and organisation agents can retrieve only what was shared for that engagement, with its source excerpts. This access does not include unshared history or the original messages and transcripts behind an excerpt.
The consultant's own Copilot
A personal connection the consultant turns on lets their Copilot retrieve permitted excerpts from their local history, including content they have not shared. Those excerpts leave the computer through the gateway. Granting a colleague engagement access does not grant this personal access.
On either Copilot route, questions, returned source excerpts, answers and citations are processed and retained in your organisation's Microsoft 365 under its policies. Authorised compliance administrators may access those conversations. Disconnecting stops future retrieval; it does not erase earlier Copilot conversations.
Microsoft 365 Copilot needs the relevant Microsoft licence and administrator consent. Your consultancy controls permitted AI connections. Personal AI connections through AI apps in the desktop app are Mac only. Read the Privacy Notice for the data flows and retention boundaries.
Sub-processors, the whole list
These suppliers run Overshow's hosted services. Neon holds content from capture only when you attach a feedback diagnostic or explicitly publish content, with its source excerpts. Microsoft and other AI providers also receive content through the connections you allow, under your consultancy's provider agreements. The wider local capture index is not replicated to the organisation repository.
ServiceWhat it holds
NeonAccount and entitlement records, Microsoft 365 Copilot connector authorisations and security events, attached feedback diagnostics, and content consultants explicitly publish, with its source excerpts, in managed Postgres, UK (London)
StripeBilling and payment details, held by Stripe, not by us
VercelWebsite and account hosting, cookieless analytics, and speed insights; transiently processes submitted feedback diagnostics, explicit organisation-repository publication and retrieval requests, and Microsoft 365 Copilot connector authorisation requests before persistent records are stored in Neon
MailjetTransactional email, including magic links and account messages
CloudflareApp download and update delivery (R2), serving release artefacts with standard request metadata. Also runs the personal Microsoft 365 Copilot connector gateway: queries and returned excerpts pass through Cloudflare, which can read them in transit because they are not end-to-end encrypted. The gateway does not store them. Its routing object sits in Cloudflare's EU jurisdiction, while edge processing and operational metadata can be outside the UK and EEA
SlackOperational alerts for enquiries, admitted-account activity, subscriptions, and existing affiliate obligations; receives the submitted details plus request metadata (page, time, IP address, browser)
CalendlyWalkthrough booking, on Calendly's own pages under Calendly's privacy notice; our booking link also carries the page source and any affiliate-referral tag
Analytics and cookies, per surface
Three surfaces, three postures. The desktop app sends no analytics at all.
Desktop app: No telemetry
No analytics beacons leave the app. Routine account traffic carries sign-in, billing, device registration and aggregate licence state. Publication sends only content a consultant has approved and chosen to share, with its source excerpts. Exports, submitted diagnostics, URL enrichment and connected cloud AI apps have separate sharing controls.
Marketing site: Cookieless analytics
Vercel Web Analytics and Speed Insights use no cookies or cross-site identifiers. Conversion events never include form values.
Web app: First-party cookies only
Sign-in and security cookies plus short-lived legacy-journey compatibility cookies, with the same cookieless analytics. Nothing is used for advertising.
A paid 90-day set-up on one engagement.
We agree engagement access, eligible Teams meetings and permitted AI connections with your consultancy. Standard Teams and Microsoft 365 Copilot set-up and a security walkthrough are included. Your consultancy arranges Microsoft licences and administrator consent. Additional bespoke systems are agreed separately.
- Length
- 90 days, paid
- Scope
- One engagement
- Connections
- Standard Teams and Microsoft 365 Copilot set-up
- Review
- Security walkthrough included