Security built in,
not bolted on.
Meeting Room 365 runs on a security-first architecture. We collect only the minimum data necessary, encrypt all sensitive data at rest, and encrypt every connection in transit.
Store less. Handle less. Encrypt everything.
Our architecture minimizes risk by design: the less we hold, the less there is to protect.
Minimal Data Collection
We store only room configuration settings and admin email addresses. No calendar content, meeting details, attendee lists, or user passwords are ever stored on our servers, outside of opt-in Room Finder & Analytics snapshots.
Encrypted Credentials
Microsoft and Google logins are never stored. For OAuth customers we keep only the access and refresh tokens needed to read calendar data, all encrypted at rest with AES-256.
Encryption Everywhere
Data in transit is protected with TLS/SSL (HTTPS enforced). Data at rest is encrypted with AES-256. Security headers are enforced via a strict Content Security Policy.
A secure intermediary, nothing more.
Meeting Room 365 sits between your display tablets and your calendar provider. Here's exactly what happens on every request.
Display Tablet
Connects to Meeting Room 365 over HTTPS to retrieve room status and calendar data.
Meeting Room 365 API
Proxies calendar requests to Microsoft Graph or Google Calendar using OAuth tokens granted by your organization.
Calendar Provider
Microsoft Graph / Google Calendar. Data is rendered in real-time on the display and never persisted.
- Calendar data is never persisted. It is fetched in real-time and rendered on your room tablets.
- Only room configuration (display preferences, admin contact) is stored server-side.
- For Room Finder & Analytics, ephemeral occupancy snapshots are captured at 15-minute intervals, optionally including meeting subject and organizer.
Distributed by design.
Our systems span multiple cloud providers with no single point of failure. Our providers carry their own compliance certifications, ISO 27001, SOC 2 and PCI DSS among them. These are provider-level certifications, not our own.
OVHcloud
Primary cloud infrastructure for application services, distributed across US and European regions.
DigitalOcean
Managed databases and SSD VPS hosting, with EU-resident data for database operations.
Google Cloud
Authentication via Cloud Identity and Firestore database services.
Encrypted in transit and at rest.
Data in transit
- TLS 1.2+ enforced on all connections
- Cloudflare Full (Strict) SSL to origin servers
- Outbound calls to Microsoft Graph & Google APIs are TLS-encrypted
- Database connections secured over private VNet
- Email authenticated with DMARC, DKIM and SPF
- Strict Content Security Policy enforced via Helmet
Data at rest
- AES-256 encryption for all sensitive data
- Encrypted daily backups on separate physical servers
- Minimal footprint: only room config and admin contact
- No calendar content, attendee data or credentials stored
- Databases hosted on DigitalOcean managed databases
Identity stays with your provider.
We delegate authentication to Microsoft and Google, and lock down internal access to the principle of least privilege.
End-User Authentication
OAuth 2.0 delegated auth with Microsoft (Entra ID) and Google Workspace. We never handle or store passwords; users authenticate directly with their identity provider.
Internal Access Controls
Production access follows least privilege. MFA is required for all production systems, cloud consoles and internal tools. Internal credentials are managed in a password manager.
SSO by Default
Every customer authenticates through their existing Microsoft or Google identity provider. There is no separate Meeting Room 365 password to manage.
Domain Verification
Organizations can verify domain ownership so only authorized users within their tenant can manage room displays and configurations.
IP Filtering
Lock any display down to your network. Optional per-display IP filtering restricts all web-based resources, including calendar and display APIs, to the addresses you approve.
Native Apps, Less Surface
Native iOS and Android apps are part of our defense-in-depth story: the calendar connection can live on the device itself, with a service user signed in on the device and nothing extra exposed to the web.
Disciplined from commit to deploy.
Development Lifecycle
Code changes go through review before deployment, with separate development, testing and production environments. Application code lives in a private, access-restricted repository.
Patch Management
Dependencies are regularly reviewed and updated. Security patches are prioritized and applied promptly; providers manage OS-level patching for managed services.
Vulnerability Scanning
Automated dependency scanning flags known vulnerabilities in third-party packages. Cloudflare WAF protects continuously against the OWASP Top 10.
Environment Separation
Development, testing and production are fully separated. Production credentials and data are never used in development or testing environments.
Incident Response
We maintain a plan covering detection, containment, eradication and recovery. Customers are notified of incidents affecting their data; status is published publicly.
Logging & Monitoring
Application and infrastructure logs are collected and monitored. Access to production systems is logged, and anomalous activity triggers alerts for investigation.
Support Access
Remote in-app screenshots (Meeting Room 365 UI only) assist support, with tight automatic retention and per-display opt-out. Customer data is never accessed for any other purpose.
Status Transparency
Live system status is published at status.meetingroom365.com. Incidents affecting customers are communicated openly, without quiet failures.
Hardened at every edge.
DDoS Protection
All traffic is proxied through Cloudflare for automatic DDoS mitigation, rate limiting and bot management, covering volumetric, protocol and application-layer attacks.
Web Application Firewall
Cloudflare WAF is configured to block common attack patterns including SQL injection, cross-site scripting and other OWASP Top 10 threats.
Network Security
Production servers are firewalled with only necessary ports exposed. SSH access is key-based only; providers manage physical network and facility controls.
Endpoint Security
Employee devices use full-disk encryption. Operating systems and software are kept current, and access to production systems requires MFA.
Covered, and built to recover.
GDPR
Databases are hosted in the EU region, with established data-request processes and documented processing partners. See our GDPR page for full details.
Payment Security
All payment processing is handled by Stripe, a PCI Level 1 Service Provider. We never process, store, or access credit card numbers.
Privacy
We minimize PII collection, primarily admin email addresses and local IP addresses, and never sell or share user data for marketing.
Disaster Recovery
Automated daily backups with quarterly integrity testing. A minimal data footprint and multi-provider deployment support recovery.
Every third party, accounted for.
We rely on a small set of trusted partners to operate the service. Each is evaluated for security and privacy practices.
| Partner | Region | Purpose |
|---|---|---|
| OVHcloud | EUUS | Primary cloud infrastructure (US & European datacenters) |
| DigitalOcean | EU | Managed databases (AMS region) |
| Cloudflare | US | CDN, DDoS protection and Web Application Firewall |
| Stripe | US | Payment processing (PCI Level 1 Service Provider) |
| PostHog | EU | Product analytics (EU-hosted) |
| Crisp | EU | Customer support chat |
| Postmark | US | Transactional email delivery |
| Sentry | US | Error tracking and monitoring |
| Google Cloud | US | Authentication (Cloud Identity) and database (Firestore) |
| Bunny.net | EU | CDN and EU-based object storage |
| Backblaze B2 | US | Object storage (supplemental) |
Answers for security reviews.
The questions that come up most in enterprise security assessments and vendor reviews.
Microsoft and Google logins are never stored. For OAuth customers, authentication is delegated directly to Microsoft or Google, and we store only the access and refresh tokens needed to read calendar data. For EWS customers, service-account credentials are stored. In all cases, stored credentials and tokens are encrypted at rest with AES-256.
- Configuration files describing admin portal settings
- Account administration email addresses
- Meeting-room email addresses paired with display configurations
- For Room Finder & Analytics: ephemeral 15-minute snapshots (display name, online status, occupancy, and, where enabled, meeting subject and organizer). No full calendar content, attendee lists or passwords.
Systems are distributed across OVHcloud (US & EU datacenters, primary infrastructure), DigitalOcean (AMS region, managed databases) and Google Cloud (Cloud Identity & Firestore). This multi-cloud architecture avoids a single point of failure and supports failover.
Yes. All network traffic uses TLS/SSL with HTTPS enforced across endpoints. Data at rest is encrypted with AES-256, including all stored credentials and tokens. Daily backups are stored encrypted on separate physical servers.
All payment processing is handled entirely by Stripe, a PCI Level 1 Service Provider. Meeting Room 365 never processes, stores, or has access to credit card numbers; we are a card-not-present merchant.
We're happy to discuss your specific data-processing requirements. Contact [email protected] to request a Data Processing Agreement or discuss your organization's needs.
Room configuration data is retained while your account is active. On account deletion, all associated configuration data is removed. Backups rotate on a regular schedule, and calendar data is never persisted.
Email [email protected] with details. We commit to acknowledging all reports within 48 hours. Live system status is published at status.meetingroom365.com.