Security
What is encrypted, and by whom
A straight answer to the question every security review asks first.
In transit
- Signalling
- TLS 1.3, HSTS preloaded
- Media
- DTLS-SRTP, AES-128-GCM
- Optional E2EE
- Insertable streams, per-participant keys
- Certificate pinning
- Desktop and mobile apps
At rest
- Recordings
- AES-256, per-tenant key
- Transcripts
- AES-256, same key scope
- Key custody
- Our KMS, or your HSM on Enterprise
- Backups
- Encrypted, 35-day retention
Residency
- Media regions
- 11, pinnable per meeting
- Recording storage
- EU, US or AU, chosen per account
- Metadata
- Follows the recording region
- Sub-processors
- Published, 30-day change notice
Compliance
- ISO/IEC 27001
- Certified, annual surveillance audit
- SOC 2 Type II
- Report available under NDA
- GDPR
- DPA and SCCs available unsigned
- Penetration test
- Annual, summary published
Security review questions
Yes, and we say so. With E2EE on, the server cannot decrypt media, so cloud recording and live transcription are unavailable. Local recording by a participant still works.
Nobody by default. Support access requires a customer-initiated grant, is time-boxed to four hours, and is logged in the audit trail you can export.
Deleted recordings are unrecoverable within 24 hours; encrypted backups age out within 35 days.
The executive summary is public. The full report is available under NDA, along with the remediation status of every finding.