Security at LivingMeeting

Meetings are some of the most sensitive data a company produces. LivingMeeting is built so that your transcripts, recordings, and documents stay private to your workspace. This page summarizes the technical and organizational measures we use to protect customer data.

Encryption

• In transit: all traffic between your browser and our services — including real-time meeting media and transcription streams — is encrypted with TLS 1.2 or higher.
• At rest: application data, transcripts, and meeting content are stored in Neon Postgres, encrypted at rest with AES-256.

Authentication

Sign-in is available through Google OAuth, Microsoft OAuth, or a one-time email link. We never store end-user passwords.There is no password database to breach. When you use Google or Microsoft, your organization’s identity controls, such as MFA and session policies, carry over to LivingMeeting. OAuth tokens are stored encrypted and scoped to the minimum permissions needed.

Tenant isolation and access control

• Per-workspace isolation:every workspace’s data is segregated by tenant, and isolation is enforced in the data layer — every query is scoped to the requesting user’s workspace.
• Role-based access:permissions are enforced by role (host, member, admin). Meetings are invite-only; only invited participants and authorized workspace members can access a meeting’s transcript and artifacts.
• Internal access: employee access to production data is restricted, logged, and limited to what is needed for support and operations.

Infrastructure

We build on established cloud providers, each with its own strong security program:

• Vercel — application hosting and edge network.
• Neon — managed Postgres (US region).
• Fly.io — real-time meeting and WebRTC servers.
• OpenRouter — AI transcription and language-model processing.
• Stripe — PCI-DSS-compliant payment processing; card data never touches our servers.

The full list of subprocessors and the data each one touches is published at livingmeeting.com/subprocessors.

Secrets management

Credentials, API keys, and signing secrets are managed through environment-level isolation: production secrets live only in the production environment, are never committed to source control, and are rotated when personnel or providers change.

Backups and recovery

Our database layer (Neon) provides continuous backups with point-in-time recovery, letting us restore data to a precise moment in the event of an operational incident. Backups are encrypted and stored in the US.

Meeting audio handling

Meeting audio is streamed for transcription and then discarded — audio is not retained after processing. Transcripts and meeting artifacts are retained under your workspace’s control; see the Privacy Policy for retention details.

Compliance

A SOC 2 program is underway. Our security policies (access control, incident response, vendor management, business continuity) are available on request to customers and prospects under NDA — email security@livingmeeting.com.

Responsible disclosure