Security at Meeting Room 365.
Meeting Room 365 collects only the minimum data necessary, encrypts all sensitive data at rest, and encrypts every connection in transit.
We keep as little data as we can and encrypt what we keep.
The less we hold, the less there is to protect.
Minimal Data Collection
We store only room configuration settings and admin email addresses. No calendar content, meeting details, attendee lists, or user passwords are ever stored on our servers, outside of opt-in Room Finder & Analytics snapshots.
Encrypted Credentials
Microsoft and Google logins are never stored. For OAuth customers we keep only the access and refresh tokens needed to read calendar data, all encrypted at rest with AES-256.
Encryption Everywhere
Data in transit is protected with TLS/SSL (HTTPS enforced). Data at rest is encrypted with AES-256. Security headers are enforced via a strict Content Security Policy.
What happens on every calendar request?
Meeting Room 365 sits between your display tablets and your calendar provider, and does nothing more.
Display Tablet
Connects to Meeting Room 365 over HTTPS to retrieve room status and calendar data.
Meeting Room 365 API
Proxies calendar requests to Microsoft Graph or Google Calendar using OAuth tokens granted by your organization.
Calendar Provider
Microsoft Graph / Google Calendar. Data is rendered in real-time on the display and never persisted.
- Calendar data is never persisted. It is fetched in real-time and rendered on your room tablets.
- Only room configuration (display preferences, admin contact) is stored server-side.
- For Room Finder & Analytics, ephemeral occupancy snapshots are captured at 15-minute intervals, optionally including meeting subject and organizer.
Where Meeting Room 365 runs
Our systems span multiple cloud providers with no single point of failure. Our providers carry their own compliance certifications, ISO 27001, SOC 2 and PCI DSS among them. These are provider-level certifications, not our own.
OVHcloud
Primary cloud infrastructure for application services, distributed across US, Canadian and European regions.
DigitalOcean
Managed databases and SSD VPS hosting in Amsterdam.
Google Cloud
Authentication via Cloud Identity and Firestore database services.
Encrypted in transit and at rest.
Data in transit
- TLS 1.2+ enforced on all connections
- Cloudflare Full (Strict) SSL to origin servers
- Outbound calls to Microsoft Graph & Google APIs are TLS-encrypted
- Database connections secured over private VNet
- Email authenticated with DMARC, DKIM and SPF
- Strict Content Security Policy enforced via Helmet
Data at rest
- AES-256 encryption for all sensitive data
- Encrypted daily backups on separate physical servers
- Minimal footprint: only room config and admin contact
- No calendar content, attendee data or credentials stored
- Databases hosted on DigitalOcean managed databases
Sign-in stays with Microsoft and Google.
We delegate authentication to them, and hold internal access to least privilege.
End-User Authentication
OAuth 2.0 delegated auth with Microsoft (Entra ID) and Google Workspace. We never handle or store passwords; users authenticate directly with their identity provider.
Internal Access Controls
Production access follows least privilege. MFA is required for all production systems, cloud consoles and internal tools. Internal credentials are managed in a password manager.
SSO by Default
Every customer authenticates through their existing Microsoft or Google identity provider. There is no separate Meeting Room 365 password to manage.
Domain Verification
You can verify domain ownership so only authorized users within your tenant can manage room displays and configurations.
IP Filtering
Lock any display down to your network. Optional per-display IP filtering restricts all web-based resources, including calendar and display APIs, to the addresses you approve.
Native Apps, Less Attack Surface
Native iOS and Android apps add a layer of defense: the calendar connection can live on the device itself, with a service user signed in on the device and nothing extra exposed to the web.
How we build and run Meeting Room 365
Development Lifecycle
Code changes go through review before deployment, with separate development, testing and production environments. Application code lives in a private, access-restricted repository.
Patch Management
Dependencies are regularly reviewed and updated. Security patches are prioritized and applied promptly; providers manage OS-level patching for managed services.
Vulnerability Scanning
Automated dependency scanning flags known vulnerabilities in third-party packages. Cloudflare WAF protects continuously against the OWASP Top 10.
Environment Separation
Development, testing and production are fully separated. Production credentials and data are never used in development or testing environments.
Incident Response
We maintain a plan covering detection, containment, eradication and recovery. Customers are notified of incidents affecting their data; status is published publicly.
Logging & Monitoring
Application and infrastructure logs are collected and monitored. Access to production systems is logged, and anomalous activity triggers alerts for investigation.
Support Access
Remote in-app screenshots (Meeting Room 365 UI only) assist support, with tight automatic retention and per-display opt-out. Customer data is never accessed for any other purpose.
Status Transparency
Live system status is published at status.meetingroom365.com. We tell customers openly about incidents that affect them, and no failure passes quietly.
How we protect the network and our devices
DDoS Protection
All traffic is proxied through Cloudflare for automatic DDoS mitigation, rate limiting and bot management, covering volumetric, protocol and application-layer attacks.
Web Application Firewall
Cloudflare WAF is configured to block common attack patterns including SQL injection, cross-site scripting and other OWASP Top 10 threats.
Network Security
Production servers are firewalled with only necessary ports exposed. SSH access is key-based only; providers manage physical network and facility controls.
Endpoint Security
Employee devices use full-disk encryption. Operating systems and software are kept current, and access to production systems requires MFA.
Compliance, payments and disaster recovery
GDPR
Our main databases are hosted in the EU, with established data-request processes and documented processing partners. See our GDPR page for full details.
Payment Security
All payment processing is handled by Stripe, a PCI Level 1 Service Provider. We never process, store, or access credit card numbers.
Privacy
We minimize PII collection, primarily admin email addresses and local IP addresses, and never sell or share user data for marketing.
Disaster Recovery
Automated daily backups with quarterly integrity testing. A minimal data footprint and multi-provider deployment support recovery.
Every vendor that sees your data.
We use a small set of partners to run the service, and we evaluate each one's security and privacy practices.
| Partner | Region | Purpose |
|---|---|---|
| OVHcloud | EUUSCASGAU | Application hosting and logs |
| DigitalOcean | EU | Primary database |
| Cloudflare | EUGlobal | Network security, content delivery and file storage |
| Bunny.net | EUGlobal | Content delivery |
| Microsoft | US | Company email and support inbox |
| US | Admin sign-in, Wallet passes and some app data | |
| Stripe | US | Payment processing |
| Postmark | US | Transactional email |
| Twilio | US | Text message notifications |
| Crisp | EU | Customer support chat |
| Anthropic | US | AI features, and AI tools for our support and engineering team. Our only AI subprocessor. |
| Backblaze B2 | US | File storage |
| GraphJSON | EU | Display uptime monitoring |
Answers for security reviews.
The questions that come up most in enterprise security assessments and vendor reviews.
Microsoft and Google logins are never stored. For OAuth customers, authentication is delegated directly to Microsoft or Google, and we store only the access and refresh tokens needed to read calendar data. For EWS customers, service-account credentials are stored. In all cases, stored credentials and tokens are encrypted at rest with AES-256.
- Configuration files describing admin portal settings
- Account administration email addresses
- Meeting-room email addresses paired with display configurations
- For Room Finder & Analytics: ephemeral 15-minute snapshots (display name, online status, occupancy, and, where enabled, meeting subject and organizer). No full calendar content, attendee lists or passwords.
Systems are distributed across OVHcloud (US & EU datacenters, primary infrastructure), DigitalOcean (AMS region, managed databases) and Google Cloud (Cloud Identity & Firestore). This multi-cloud architecture avoids a single point of failure and supports failover.
Yes. All network traffic uses TLS/SSL with HTTPS enforced across endpoints. Data at rest is encrypted with AES-256, including all stored credentials and tokens. Daily backups are stored encrypted on separate physical servers.
All payment processing is handled entirely by Stripe, a PCI Level 1 Service Provider. Meeting Room 365 never processes, stores, or has access to credit card numbers; we are a card-not-present merchant.
Yes, but you don't need a signature. Our Data Processing Agreement is part of our Terms, so it already applies. For a countersigned copy, sign the last page of the PDF and email it to support@meetingroom365.com. We'll sign it and send it back.
Room configuration data is retained while your account is active. On account deletion, all associated configuration data is removed. Backups rotate on a regular schedule, and calendar data is never persisted.
Email support@meetingroom365.com with details. We commit to acknowledging all reports within 48 hours. Live system status is published at status.meetingroom365.com.