When someone asks you to sign a meeting NDA, the implicit assumption is that what's said in the call stays between the people on it. In most video conferencing setups, that assumption is wrong — not because of a data breach, but because of the default architecture.
Your meeting transcript, in most configurations, is stored by a vendor you pay for a service. Their privacy policy governs what they can do with it, their security practices govern how well it's protected, and their infrastructure (and the infrastructure of their sub-processors) determines where it actually lives.
For most consumer and SMB use cases, this isn't alarming. For teams handling regulated data, sensitive client information, or IP that represents genuine competitive advantage, it's worth understanding before it becomes a problem.
The three-layer data question for meetings
When evaluating where your meeting data goes, there are three distinct questions:
1. Where does the media go?
Audio and video during a call travel through a media relay server — a Selective Forwarding Unit (SFU) in modern WebRTC implementations. In most hosted platforms, this is the vendor's infrastructure. In self-hosted deployments, it stays on infrastructure you control. The distinction matters: your team's audio and faces traverse this infrastructure in real time.
2. Where does the transcript go?
Speech-to-text requires compute — the audio has to be sent somewhere for processing. In most platforms, this means a cloud AI provider (often one of a few major US or EU services). The privacy policy governs data retention and usage for training. Not all policies are equivalent.
3. Where does the summary/recap go?
Summary generation is an additional AI processing step on top of the transcript. If the platform uses a third-party LLM API for this, the text of your meeting — decisions, action items, discussion content — is sent to that API under that provider's terms.
What makes this concrete
Most organizations couldn't immediately answer these questions about the meeting platform they use today:
- Which country are meeting recordings stored in?
- Does the vendor use your meeting content to improve their AI models, and can you opt out?
- If the vendor has a data breach, what was exposed — video files only, or transcripts and summaries?
- Are transcripts automatically deleted after a retention period, or stored indefinitely?
Under GDPR, HIPAA, and similar frameworks, these aren't abstract questions — they're due-diligence requirements for organizations handling data subject to those regulations. Many companies discover the gap when a compliance review asks for a data processing agreement with their video platform and the vendor can't produce one quickly.
Architecture choices that reduce exposure
Separate media from application logic. Meeting platforms where audio/video flows through a dedicated media engine — rather than through the same infrastructure that handles authentication and data storage — have a smaller attack surface. A compromise of the application layer doesn't necessarily expose media content.
Self-hosting. Keeping media and transcripts on infrastructure you own and control is the highest-assurance option. It's operationally heavier, but for regulated industries it's often the only viable path.
Explicit data retention controls. Transcripts and recordings should have configurable retention — automatically deleted after 30, 90 or 180 days, or on request, rather than stored indefinitely as a default.
Audit trails. For regulated environments, knowing who accessed a meeting transcript, when, and from where is as important as knowing where it's stored.
Platforms like MeetOye are designed with these considerations as defaults rather than enterprise add-ons: media runs through a dedicated, separable engine; transcripts are visible only to meeting attendees; self-hosting is available for teams that need full data sovereignty; and deletion is attendee-controlled rather than vendor-determined.
The practical steps for any team
If you're not ready to switch platforms, there are things you can do with your current tooling:
Read the DPA (Data Processing Agreement). Most major platforms have one. It tells you exactly what they can do with your data. If you can't find it, ask — the response time tells you something.
Audit your recording defaults. Many platforms enable cloud recording by default. Verify whether your meetings are being stored when you don't intend them to be.
Turn off AI features for sensitive calls if needed. If you don't need a transcript for a particular call — legal discussion, HR conversation, M&A discussion — check whether your platform lets you disable it per meeting.
Include meeting data in your data classification policy. If your organization classifies data by sensitivity, meeting transcripts should be in that taxonomy. Right now, most organizations treat them as unclassified by default.
The meeting room is where decisions get made, sensitive topics get discussed, and confidential information gets shared. Treating its data residency and retention as an afterthought is increasingly hard to justify — and increasingly hard to explain to regulators when it comes up.
Author bio:
The MeetOye Team covers data privacy and enterprise security. MeetOye (meetoye.com) is an AI-native video meeting platform with privacy-by-architecture: media flows through a dedicated engine separate from the application layer, transcripts are visible only to attendees, and self-hosting is available for regulated environments.
Top comments (0)