Trust & security

By design, Xpanion uses the network for four things, and none of them carries meeting content — no audio, no transcript, no minutes, no board, no ledger.

1. License validation. Xpanion checks your license over the internet when you activate it, re-check it or change your plan, when you return to Xpanion shortly after opening the payment page, and periodically after that. The license check sends your license key, an identifier derived from your machine, and the version of Xpanion you are running; our license service also sees your IP address. It carries nothing about your meetings, your recordings or your project data. Details: Privacy Policy, section 4.1.
2. Your plan's limits. Xpanion also asks our license service before it adds a project, and from time to time for the projects you already have, so that the limit on active projects holds across everyone under your plan. For each project the app sends a random identifier it made up for this purpose, and a counter. It does not send the project's name or anything in it, and we cannot tell from the identifier which project it stands for. If you start Xpanion Free from inside the app, it sends the email address you type. If you own a plan for several people and invite someone, it sends the address you enter for them. Details: Privacy Policy, section 4.1.
3. Updates. Xpanion checks for a newer version shortly after it starts and every six hours while it runs, with or without an active license. The update check and the update download go to our update storage at Vercel and carry no license key, no machine identifier and no account data; Vercel sees your IP address. A newer version is downloaded from the same storage, and its signature is verified before it is installed.
4. Models. After you activate a license, Xpanion downloads the speech and language models it runs from Hugging Face and keeps them on your Mac. If a model is missing later, Xpanion downloads it again the same way. The model download carries no license key, no machine identifier and no account data; Hugging Face sees your IP address. On macOS 26 or later, the same step asks macOS to download Apple's speech-recognition assets for English and German, which macOS fetches from Apple. Details: Privacy Policy, section 4.4.

With the company hub, Xpanion can use the network for one more thing. Where your license includes the company hub and Xpanion is connected to your organization's own hub, Xpanion signs in to that hub with the enrollment token your organization gave you and exchanges with it the projects and cards you share with your team — with their comments and activity — your team's member list, and the output-folder settings of your team and your organization; private cards are never sent, and the hub is run by your organization, not by us. Whether that connection is encrypted depends on the hub address your organization sets: an https address is, an http address is not.

There is no analytics, no telemetry, no crash reporting and no session recording inside the application.

You do not have to take our word for it. Put an outbound firewall on the app — Little Snitch or LuLu — or watch it with nettop in Terminal, and record a meeting. You may see the license check, the check for room in your plan when you add or delete a project, the update check and, after you activate a license, the model download, each at the moments described above. If you start Free or manage the people under your plan from inside the app, you will see that request too — and where Xpanion is connected to your organization's own company hub, that hub. If you see anything else, write to hello@xpanion.com with the subject "Network" and tell us what you saw. We will answer, and we will publish what we find on this page.

Account, plan and license records — who holds which plan, which machine it is bound to, and whether the license is active; for a plan with several people, the email addresses of the people invited to it; and for each active project a random identifier and a counter, without the project's name or anything in it. The database runs on Supabase in the United States. No meeting content ever reaches it, because the application has no code path that sends any.

The service providers involved, what each one receives, and where each one processes it are listed on the Sub-processors page.

Xpanion is signed with Valinorsk's Apple Developer ID and notarized by Apple. The only system entitlement the app carries is the microphone. Third-party components and their licenses are listed in LICENSE-3RD-PARTY.txt inside the application bundle.

xpanion.com sets no cookies and loads nothing from a third party — no fonts, no scripts, no images. It counts page views only if you allow it, with our hosting provider's measurement served from our own origin; until you decide, none of it loads, and you can change your choice at any time under Cookie settings in the footer. Details: Privacy Policy, section 5.1. Every page is served with a Content Security Policy that forbids outside origins, and with the usual hardening headers. You can inspect them in your browser's developer tools, or with curl -I https://xpanion.com/.

If you believe you have found a security issue in Xpanion or on this site, write to hello@xpanion.com with the subject "Security". We read every report ourselves, we will acknowledge it, and we will not take action against anyone who reports in good faith.