Security

1. Isolation architecture

The application user is the ownership boundary. Zoom connections, meetings, jobs, recordings, reports and Telegram delivery targets carry both user and connection ownership. Database constraints prevent a record from being attached to another tenant.

A Telegram identity can be merged with an existing application user only after the same exact Zoom account and Zoom user identity is verified through OAuth.

2. OAuth credentials

• Provider passwords are never collected.
• Access and refresh tokens are encrypted at rest using AES-256-GCM.
• OAuth state is random, short-lived, stored only as a hash and consumed once.
• Refresh-token rotation is protected by database leases and optimistic token versions.
• Invalid grants disable only the affected connection.

3. Webhook verification

Zoom webhook signatures and timestamps are verified before processing. URL-validation challenges use the configured secret. Telegram webhook requests are checked against a secret token, and update identifiers are deduplicated before queued processing. Unknown or ambiguous events are redacted and quarantined rather than processed.

4. Web management sessions

Personal archive and management links use high-entropy credentials bound to the correct user. Browser sessions are short-lived, use secure cookie settings and cannot substitute another user or connection in the request body.

5. Data protection

• Private host URLs are never posted to a shared conversation.
• Public reports use unguessable capability URLs separated from management credentials.
• Local files are isolated by user and provider connection.
• Cloud-recording deletion occurs only after verification of locally saved assets and transcript requirements.
• Provider deauthorization deletes data only for the exact verified connection.

6. Operational practices

The service uses least-privilege scopes, HTTPS, restrictive browser security headers, dependency lockfiles, automated tests, bounded network timeouts, retry limits and health checks. Secrets are provided through deployment secret management and are not committed to the repository.

Security controls are reviewed when adding providers, scopes, webhook types or new data flows.

7. Responsible disclosure