Two-factor sign-in for every workspace user
Every workspace user must complete multi-factor authentication before reaching workspace data. There is no per-workspace opt-out.
Last updated October 26, 2026
Security and compliance, stated plainly.
What is in place today, what is still being built, and where MeetSwift should not be used. Meetings can carry sensitive business information — read this, your workspace settings and our provider list before importing confidential material.
SOC 2: program in progress — audit not yet started
The security program is in progress; an audit has not yet started. Gathering evidence is not an audit. MeetSwift also makes no ISO 27001 claim.
HIPAA: not ready — do not use MeetSwift for PHI
MeetSwift is offered for general business meetings only. It is not configured, contracted or reviewed for health information.
Keep health information out.
- 01
Do not upload, record, transcribe or otherwise process Protected Health Information (PHI) with MeetSwift — this includes audio uploads, transcript uploads, bot recordings, microphone recordings and transcription.
- 02
No software setting, toggle, workspace plan or Company arrangement establishes HIPAA readiness. The in-product HIPAA mode stays locked.
- 03
Agreements with the vendors that process meeting content have not been verified for health information, and no external security or legal review of MeetSwift has been completed.
Controls in the product today
Each item below is checked against current application behavior, not a roadmap.
Workspace isolation in the database and the server
Workspace records are tied to their company through database foreign keys and relationship constraints, and every request is checked by server-side authorization. Isolation relies on those two layers together; database row-level security policies are not in use.
Meeting content follows attendance or capture ownership, not role
Meeting content — summaries, decisions, transcripts and recordings — is limited to recognized attendees and the connected calendar owners whose eligible events requested that capture, even if those owners did not attend. Each requesting owner of a shared capture has this access; an invitation alone grants none. Being a workspace owner or administrator alone does not grant meeting access. Owners and administrators can see workspace tasks; members see tasks from meetings they can access or tasks assigned to them, without exposing other private meetings.
Application audit trail for sensitive actions
Sensitive administrative actions, including security exports, are appended to an audit log by the application. The log is not immutable or tamper-proof, and deleting a workspace can remove its audit history.
Capture is off until someone turns it on
Bot capture is disabled by default. Dispatching a bot requires an explicit consent acknowledgement, and calendar auto-join cannot be enabled until an administrator records one. That acknowledgement does not notify attendees or prove each attendee consented.
Configurable retention and legal hold
Workspace retention settings and legal holds are implemented. Company-plan administrators can configure the period, place a legal hold that pauses the retention action, and run that action. Free meeting access is limited to 30 days; hidden content is not proof of deletion. Automatic deletion coverage and cleanup of external-provider copies and backups remain under review. We do not promise immediate deletion.
Private storage with authorized reads
Retained recordings and audio uploads are kept in private object storage. The server checks meeting access before granting recording downloads; staging uploads are restricted to their uploader.
Encryption and backups: evidence pending
Encryption-at-rest and backup evidence is still being collected across our hosting, storage and processing vendors. Until that review is finished, MeetSwift does not make universal encryption or backup promises beyond HTTPS in transit and encrypted storage of integration credentials.
Our security program
None of these processes has been audited, and we do not describe any review cycle as completed. This page will change as evidence is gathered.
- Named responsibility
- A Security Officer and a Privacy Officer are designated within MeetSwift and own the program described here.
- Written risk assessment and policies
- A written risk assessment and security policies have been established and are being put into operation.
- Quarterly access reviews
- A quarterly access review process for production systems has been established and is being put into operation.
- Incident response and vendor reviews
- An incident response plan and a vendor review process have been established and are being put into operation.
Who processes your data
Every provider, what it does, what it receives and where.
Report a vulnerability
security@meetswift.app- Email security@meetswift.app privately with a description of the issue.
- Include the minimal steps needed to reproduce it, using only accounts and data you own.
- Give us reasonable time to investigate and fix before discussing it publicly.
Please don't
- Do not access, modify or keep other people's data beyond what proves the issue.
- Do not use or submit PHI or other sensitive personal data while testing.
- Do not run denial-of-service, spam, social engineering or anything that disrupts the service or other customers.
We appreciate good-faith reports and will respond as quickly as we can. This page does not grant legal authorization or a safe-harbor commitment.
Other limits to know
- Summaries, decisions and suggested actions are AI-generated drafts. Review them against the source evidence before relying on them.
- Source transcripts can remain available alongside summaries for evidence review. Do not assume they are deleted immediately after analysis.
- Users are responsible for meeting applicable notice and consent requirements and for having permission to process recordings or transcripts they upload.
- Assess data-processing, retention and residency requirements with your organization before adoption. No regional availability or regulatory outcome is promised here.
Need a vendor security questionnaire or a custom DPA before adoption? Contact our team.