Security at Taiega

Verified email, current account-state checks, row-level data authorization, scoped organization roles, and exact invitee claims limit who can see or change a meeting. Administrator access requires a current password session and authenticator step-up.

Provider credentials are encrypted before storage. OAuth state, callback origins, webhook signatures, and connection ownership are validated. Calendar and conference operations use idempotency, revision checks, and recovery states to reduce duplicate or uncertain writes.

Taiega applies input validation, rate controls on exposed operations, audit evidence for important lifecycle changes, automated tests for authorization and concurrency, and monitored delivery queues. New meeting attachments are released only after file-type validation and a hash-bound clean verdict from the configured malware scanner; uploads remain unavailable when that scanner cannot be verified. No internet service can promise absolute security.

Use a unique password, protect invitation and management links, review connected providers, and remove access you no longer need. Report a suspected vulnerability privately to security@taiega.com with reproduction steps and potential impact; do not access other people’s data or disrupt the service.