Thoughtful by design.
Careful with your data.
Access controls and clear permission boundaries are part of the experience, from a private note to a guest invitation.
Your identity stays yours
Account sessions use the authentication service’s cookie model. Signing into meetings.day is distinct from connecting a calendar. Calendar credentials are never required in a note or support message.
Private by default
Workspace reads and changes are checked against the authenticated account. Private notes stay private when linked to a person. Guest invitations are scoped to the meeting information necessary for a response.
A deliberate action before sharing
Guest responses, account deletion requests, and data exports require clear user actions. Provider permissions are shown in context. AI-generated drafts must be reviewed before they create an external commitment.
Honest about verification
We do not claim SOC 2 or ISO certification, completed penetration testing, or end-to-end encryption for server-readable content. Production access, backup recovery, and provider behavior require their own verification evidence.
Report a concern
Use the contact form in Help, select “Account support”, and begin your message with “Security report”. Include the affected page and steps to reproduce without other people’s records, access tokens, or sensitive screenshots. The form stores a private support reference.