Private by default
Meeting details, messages, notes, attachments, availability, and provider connections are scoped to the account and participants authorized for that record.
Taiega trust center
Privacy is an access boundary
Our standard is designed to keep a person’s schedule and conversations out of routine administration, while preserving a narrow, visible way to solve a support case when the customer chooses to allow it.
CURRENT PRODUCT STANDARD
Customer content is not an administrator feature.
Account administrators may manage sign-in access, configuration state, delivery health, and security operations. Those responsibilities do not confer a right to read private meeting content.
No support content browser
The administration console exposes account health and access state. It does not include a screen for staff to browse customer meetings, conversations, notes, or files.
Customer-controlled exception
When content is indispensable to solve a support case, access must name the purpose and data categories, receive customer approval and a second administrator’s approval, and expire after 15, 30, or 60 minutes.
Visible evidence
The customer can review the request, its approvers, expiry, revocation, and each recorded data category used under the grant.
How exceptional access works
Taiega uses a customer-controlled support lockbox for product support access. It is intentionally separate from account suspension, deletion, and routine service administration.
- 1Named request
A staff member records the customer, support purpose, ticket, exact data categories, and a short duration.
- 2Customer decision
The customer approves or denies from Privacy controls. Silence never counts as approval.
- 3Independent review
A different administrator approves or denies. The requester cannot approve their own request.
- 4Bounded use
Only the requester, approved categories, named customer, and active time window qualify. Each use writes evidence.
- 5Automatic end
Expiry, denial, cancellation, or customer revocation closes the grant. Reuse requires a new request.
Infrastructure operators with direct database privileges remain technically capable of operating the service. Those privileges are governed separately through least privilege, strong authentication, restricted production roles, change review, and audit logs. Taiega does not claim that ordinary server-processed meeting data is zero-knowledge or end-to-end encrypted.
Encryption and credentials
Taiega encrypts network traffic with TLS and relies on managed storage encryption for production databases and object storage. Connected-provider credentials are encrypted at the application layer with authenticated encryption before storage. Secrets are kept out of browser code and are not returned in account exports or administration pages.
- Passwords are handled by the authentication provider and are not stored as readable application data.
- Invitation tokens and API credentials use scoped, revocable access paths.
- Production credentials must be rotated, inventory-tracked, and limited to the worker or integration that needs them.
- A temporary privileged runtime credential remains during migration of older background jobs. It is explicitly excluded from the support lockbox, cannot use the lockbox tables, is allowlisted to existing jobs, and is scheduled for removal rather than treated as a permanent architecture.
Who can see what
| Information | Normal access | Retention principle |
|---|---|---|
| Account and preferences | The account holder and required service operations | Account lifetime, then deletion rules |
| Meeting content and messages | Authorized organizers and participants | Meeting or account lifecycle, subject to shared-record obligations |
| Availability | Scheduling computations and people the user permits | Only as needed for scheduling and connected-calendar refresh |
| Provider credentials | Server-side integration workers | Until disconnection, rotation, expiry, or account deletion |
| Security and audit evidence | Restricted security and compliance functions | Long enough to investigate abuse, prove access decisions, and meet legal duties |
Meeting participants can see the shared information needed to participate. A record shared with another participant may remain in that participant’s history after one account is deleted. Private account data is removed under the account-deletion flow; limited anonymized shared or security evidence can remain where deletion would damage another person’s record or an immutable audit trail.
Connected services and delivery
Calendar, conferencing, email, and future messaging providers receive only the information needed to perform the action the user selected. Their processing is governed by their own privacy terms. Taiega records delivery status and provider identifiers so users can tell whether an invitation was accepted for delivery, delivered, bounced, or responded to.
Disconnecting an integration stops new use of its credential and starts the applicable revocation and deletion process. It cannot recall data already delivered to an email inbox, calendar, conferencing provider, or another participant.
Customer controls
- Review, approve, deny, and revoke support access under Settings → Privacy controls.
- Manage password, verified email, data export, and account deletion under Account security.
- Manage calendar and meeting-provider connections under Apps & Connections.
- Report a suspected privacy or security issue to security@taiega.com or a privacy question to privacy@taiega.com.
Standards and assurance
This architecture follows principles used in established privacy and security programs: least privilege, separation of duties, explicit purpose limitation, short-lived access, data minimization, revocation, and auditable events. Our engineering controls are informed by the NIST Privacy Framework, NIST SP 800-53, and the privacy principles in the GDPR.
These references describe the standard we are building toward; they are not a claim of certification. Formal assurance reports, penetration-test summaries, encryption key isolation, production access reviews, incident exercises, and regional retention controls will be published here as they are completed. Taiega will label planned controls separately from controls operating in the product.