TopLine Enterprise security summary

Version: 2026-10-23

This page is for the IT or security person at a company that is deciding whether to let TopLine connect to calendars, mailboxes and a CRM. It says what TopLine reads, what it keeps, who can see it, and how to turn it off. Where we cannot prove a statement from our own records, we say so in the last section instead of claiming it.

What TopLine reads

TopLine reads three kinds of things. It reads them only for the people who connect them.

• Calendar events. Time, title, attendees, place and video link of the rep's meetings. Access is read-only. A separate, opt-in permission lets TopLine add or move events. The workspace must switch that on first, and the rep must ask for it.
• Mailbox headers and thread structure. Who an email is from and to, the subject, the time, and which messages sit in the same thread. TopLine asks for the narrowest mail permission each provider offers. On Google that is gmail.metadata; on Microsoft it is Mail.ReadBasic. Both are built so that they cannot return the message text or attachments. TopLine also asks to send mail (gmail.send, Mail.Send). It sends only when the rep presses send.
• CRM records. Accounts, contacts and deals from the CRM the company already uses. TopLine writes a note, task or deal change back only after a person approves it.

TopLine also records and transcribes a meeting when a rep starts a recording or sends a meeting bot. Each workspace has a recording consent policy, set by an admin. The rep must confirm it on screen before a live recording starts, and nothing is transcribed before that.

What we keep, and for how long

• Sign-in tokens. The tokens that let TopLine use a connected calendar, mailbox or CRM are stored encrypted. We keep them until the rep or an admin disconnects, or the provider cancels them.
• A record of each email TopLine sends. One row per send: the recipient address, a one-way fingerprint (hash) of the subject and of the body, the length of the body, and reply status. We do not keep the text of mail in a rep's mailbox. The drafts TopLine writes for a rep stay in the workspace as drafts.
• Meeting audio, transcripts, summaries and notes. Kept until the workspace's own retention window runs out. An admin sets a window, in days, for each of these: audio, transcripts, summaries, intel notes, and voice profiles. A nightly job removes what is older. A workspace that sets no window keeps the data until it deletes it.
• Calendar events. They age out with the shorter of the transcript and summary windows. With no window set, they stay.
• Sign-in records. New workspaces start with 730 days. Admins can change it.
• Inbox assistant previews. If a rep gives the wider mail permission that the inbox assistant needs, previews it reads are deleted after 30 days. With the default permission this feature is off.
• A person can ask to be erased. An admin can file a request. A second person approves it before the erasure runs.

Who can see it

• Your own people. Every record belongs to one workspace, and every query is limited to that workspace. A rep sees their own work. A manager sees team patterns and deal risk. Admins manage connections and settings. Managers see what each seller was given and what got done. They don't see feedback a seller gives TopLine, or cost.
• Other customers. No one at another company can see your data. Tenant isolation is tested on every code change.
• Futuri staff. Staff reach a workspace only through a support sign-in tied to a ticket. Each one is written to the audit log, and your admins see a notice on their Today page that support signed in.
• Company-wide approval. If your IT team approves TopLine once for the whole company, TopLine reads mail headers and calendars for the people it can match in your own directory. Your admin can leave people out, and can switch company-wide reading off at any time. Microsoft also lets you limit the app to one group of mailboxes with an Exchange access policy. We give you the commands.

Encryption

• Sign-in tokens and stored secrets use AES-256-GCM, with a key that is kept outside the database. The production service will not start without that key. We can rotate the key and re-encrypt everything with a script.
• Traffic to TopLine uses HTTPS. Our hosting providers end the secure connection for the public web and API addresses.
• The database and file storage run on our providers' managed services. We list what we cannot confirm about their disk and connection settings in the last section.

Audit log

Every change an owner, admin or Futuri staff member makes to a workspace is written to an audit log: who, what and when. Each row is chained to the one before it with a hash, so a changed or removed row shows up. Admins can export the log. We can also keep a second, write-once copy in a separate storage bucket that no one can edit or delete before its lock runs out.

How to turn access off

• One rep. The rep removes the calendar or mailbox on their Connections page. TopLine deletes the stored sign-in. For Google it also asks Google to cancel the token. For Microsoft the rep cancels it at myaccount.microsoft.com.
• Company-wide approval. An admin switches the mode back to "reps sign in themselves", or disconnects. Reading stops at once and the stored tokens are deleted. The approval itself stays in your Microsoft or Google admin console until you remove TopLine there.
• Your own provider. You can always cancel access from the provider side: remove TopLine in Microsoft Entra enterprise apps, or in Google Workspace Admin under domain-wide delegation and connected apps. That ends every token at once.
• The CRM. An admin disconnects it on the Integrations page. TopLine deletes its stored connection. It does not call the CRM to cancel the token, so remove the app in the CRM as well.
• Leaving. On request, Futuri produces a full export of the workspace: every table as readable files, plus audio, in a private storage bucket, with download links that last seven days. After you confirm you have it, deletion follows a written runbook.

Where it runs

TopLine runs in the United States. The web app runs on Vercel. The API and the database run on Railway. Meeting audio is transcribed on GPU servers at Modal. Audio files and sign-in run on Amazon Web Services. We do not offer a European region today.

Who else handles data for us

These companies handle data for TopLine. Only the ones a workspace turns on receive data from that workspace.

Certifications and testing

SOC 2: a Type I audit is in progress with an outside firm. No report has been issued yet.

Our automated tests run on every code change and every night. They include tests that one customer's data cannot reach another customer.

What we cannot promise on this page

We left these out on purpose. We cannot prove them from our own code, so we will not state them until someone with the facts confirms each one. Ask us for the current answer.

• Whether Google has finished its security review of our sign-in screen for the restricted mail permission. Until it has, Google limits an unreviewed app to 100 users.
• Whether multi-factor sign-in is required for Futuri staff, and for customers who sign in with a password.
• Whether the database disks and the file storage buckets are encrypted at rest, and whether the database connection must use TLS.
• Whether the write-once audit-log copy is switched on for your workspace.
• Backup restore testing: how often we restore a backup to prove it works.
• Results of an outside penetration test. No report is on this page.
• The address for security reports and questionnaires. The data handout lists privacy@futurimedia.com and the trust page lists sales@futurimedia.com.

Questions, questionnaires and the signed data processing addendum: privacy@futurimedia.com.