Security

Access control

Every meeting, transcript and artifact is scoped to the account that created it, enforced at the database level with row-level security. Server-side operations verify the signed-in user owns a record before touching it.

Authentication

Sign-in supports Google and email/password. Sessions are managed by our auth provider.

Data in transit

All traffic to MeetMigo and to our providers is served over HTTPS/TLS.

Webhooks

Incoming notifications from the recording provider are signature-verified and processed exactly once; every delivery is logged so failures can be inspected and replayed.

Retention and deletion

You can set an auto-delete window per account. Deletion propagates to the recording provider, not just our database, and a full export is available before you delete. Audio recorded without a bot is kept in private storage tied to your account and is deleted with the meeting, on redaction, or when your retention window ends.

Sub-processors

• Supabase — database, sign-in, file storage and live updates.
• Recall.ai — meeting bots, recording and transcription for calls the notetaker joins.
• Deepgram — transcription of audio you record without a bot.
• Our AI model provider — generating summaries and notes from transcript text.
• Resend — sending team invitations and notification emails.
• Stripe — payments, when paid plans are switched on.
• Google Calendar / Microsoft Graph — calendar events, only with your explicit consent.
• HubSpot and Slack — only if you connect them, and only the notes you choose to send.
• Our hosting provider — application hosting.

Shared responsibility

We secure the application and our processing. You are responsible for who you invite, which meetings you record, and obtaining any consent your jurisdiction requires.

Reporting a vulnerability

Email the MeetMigo team at the support address on our site. We will acknowledge reports and respond with a remediation plan.