Security · Trust
Security at Meetzy.
What we do today to protect your data, described as it is. If you need more detail for a vendor assessment, we'll answer your security questionnaire.
Compliance
GDPR + LOPDGDD
We act as Data Processor under Article 28 GDPR. See our DPA.
Hosted in Spain
Platform and database on AWS, region eu-south-2.
Certifications
Meetzy does not currently hold ISO 27001 or SOC 2 certification.
01
Encryption.
- — Database and file storage encrypted at rest (AES-256)
- — TLS 1.2 or higher on every public endpoint; the database only accepts encrypted connections
02
Access control.
- — Every customer account is isolated from the others; users only see the accounts and workspaces they belong to
- — Three user roles: owner, admin and member
- — Sign-in with email and password, Google or Microsoft
- — Support access to a customer account is recorded
03
Infrastructure.
- — Platform and database hosted on AWS in Spain (region eu-south-2)
- — Network split into public, application and data tiers across three availability zones; the database is not reachable from the internet
- — Database replicated across two availability zones
- — Automated daily backups with point-in-time recovery, kept for 7 days
- — Web application firewall in front of our public APIs
- — Our core call services scale automatically and roll back on a failed deployment
04
Logging.
- — Application logs centralised in AWS
- — Records of key actions in the platform, such as support access to an account
05
Responsible disclosure.
Found a vulnerability? Email borja@meetzy.io. We acknowledge every report and prioritise fixes by severity.
06
AI-specific safeguards.
- — Meetzy does not use customer data to train or fine-tune models
- — Calls are processed by the AI providers listed in our DPA, under their API terms
- — The model used by each agent is chosen per agent
- — Webhooks and URLs called by agents go through an outbound filter that blocks internal and private addresses
- — Call recording and retention can be configured per agent
07
Incident response.
- — Automated monitoring of the call platform, with alerts to our on-call team
- — If an incident affects personal data, we notify the affected customer without undue delay, as required by Article 33 GDPR
08
Sub-processors and data flow.
See our DPA for the full sub-processor list, including where each one processes data.
Frequently asked
Security questions, answered.
Can we audit Meetzy?
Yes. We answer security questionnaires and support audits by our customers, as set out in our DPA.
Where is my data stored?
Our platform and database are hosted on AWS in Spain. Some sub-processors, such as the voice engine and AI model providers, process data outside the EU. Our DPA lists each one and where it processes data.
Do you train on customer data?
No. Meetzy does not use customer data to train or fine-tune models.
What's your incident notification SLA?
We notify affected customers without undue delay when an incident affects their personal data.
Do you support SSO?
Not yet. Users sign in with email and password, Google or Microsoft.