Security & Data Handling
Least privilege
The Zoom Meeting SDK app requests only what it needs to let the Owner's assistant join the Owner's meetings and, for externally-hosted meetings, to mint an On-Behalf-Of token attributed to the Owner. No broad account-management or data-export scopes are requested.
Credential handling
- The Zoom Client ID / Client Secret and any Server-to-Server OAuth credentials are stored only in server-side environment configuration on the Operator's host.
- The Meeting SDK JWT is generated server-side and is short-lived (≤ 48 hours, and used per session).
- On-Behalf-Of (OBF) tokens are minted server-side immediately before a join and expire quickly.
- Credentials are never rendered in the browser, never shown to meeting participants, and never committed to source control.
Data in transit and at rest
- This website and the application's callback endpoints are served over TLS (HTTPS).
- Meeting audio, transcripts, and notes are stored on the Operator's own infrastructure (object storage + database) and are accessible only to the Owner.
- Internal service-to-service calls use a shared internal secret and run on a private container network.
Recording transparency
The assistant always joins as a clearly named, visible participant with a branded video tile. It does not attempt to hide its presence. If recording permission is revoked, or a host removes it, it stops capturing and leaves.
Access control
Only the Owner can trigger joins (via their private calendar or private chat channel) and only the Owner can access stored transcripts and recordings. There is no public or multi-tenant access to meeting content.
Data minimization & retention
Only data needed to produce the Owner's notes is processed. Content is retained at the Owner's discretion and can be deleted on request. Meeting content is never sold, shared with third parties (beyond the processors listed in the Privacy Policy), or used to train models.
Reporting a vulnerability
Please report any security concern to ronnie@ronniesamuel.com.