Secure Video Conferencing: How to Vet It for Client Calls

Key Takeaways

• The encryption badge tells you less than the exceptions list. Every large platform documents features that break once real end-to-end encryption is on. Read that list first.
• Access control is where client calls leak. Waiting rooms, join rules and dial-in paths decide who ends up in the room.
• Recording turns a conversation into a retained record. Settle consent, retention and deletion before the first recorded session.
• Jurisdiction outlives certification. Hosting location, the subprocessor list and the signed DPA matter longer than any badge.

Secure video conferencing gets shortlisted from the padlock on a vendor's homepage, close to the least informative thing on it. On every major platform, switching on genuine end-to-end encryption disables what client work depends on: recording, transcription, dial-in, browser access. Five checks replace the badge.

What Does Secure Video Conferencing Mean in Practice?

Security in a video meeting splits into three independent layers, and a vendor can be strong in one and weak in the others. Media protection covers how audio and video are encrypted and whether the provider's servers can read the stream. Access control covers who gets into the room, who admits them, and which join paths bypass those rules. Data handling covers where recordings, transcripts, chat logs and attendee details sit, for how long, under whose law, and which third parties touch them.

A tool can encrypt everything in transit and still hand you a room anyone with the link can walk into. It can run on ISO 27001 certified infrastructure and still store transcripts of privileged conversations under a legal regime you cannot control. Test the three layers separately.

Scope note: this covers software selection. Room hardware, endpoint patching and account takeover are separate problems, and CISA's advisory for critical infrastructure operators covers those.

What Do the Major Platforms Actually Document?

The table below reflects each vendor's current public documentation rather than its marketing copy.

Two patterns fall out of that table: strong encryption is a licence upgrade or an admin project, and it rules out recording.

Step 1: Read the Encryption Claim Backwards

Start at the vendor's limitations list rather than its feature list. End-to-end encryption means the provider cannot decrypt the media, which mathematically rules out every server-side feature that needs to read it. A vendor advertising end-to-end encryption and cloud recording in the same breath is stretching one of those words.

The documentation makes this concrete. Zoom's E2EE turns off cloud recording, transcription, polls, Zoom Apps, Notes and Whiteboard, and limits joining to the desktop app, mobile app or a Zoom Room, so the web client and phone and SIP endpoints are out (checked 2026-10-14). Teams requires a Teams Premium licence for the organiser of an E2EE meeting, removes recording, captions, transcription, breakout rooms, dial-in and Copilot, blocks web and virtual-desktop clients, and caps attendance at 200 (checked 2026-10-14). Google documents its meetings as cloud-encrypted, and the Additional Encryption toggle it offers for calls is unavailable to business and education accounts (checked 2026-10-14).

None of that makes these platforms unsuitable. It means a flat claim of end-to-end encryption cannot survive contact with a client workflow that includes a transcript. Decide per meeting type, then write the answer down.

Ask the vendor this: which features are unavailable in your end-to-end encrypted mode, and which licence tier includes it? A vendor that cannot answer in writing has not shipped it.

Step 2: Who Can Actually Get Into the Room?

Check the join path before the crypto, because most real incidents involve an uninvited attendee rather than a broken cipher. Four settings decide it: whether a waiting room is on by default, whether the link alone grants entry, whether anonymous guests are allowed, and whether a dial-in number bypasses the controls you set in the app.

CISA's advisory on securing video meetings recommends waiting rooms, meeting passwords and restricted screen sharing, and notes that these protections are frequently not on by default. That default gap is the finding worth acting on: an evaluation scored against a capability list will pass tools your staff then run wide open.

Run the test during the trial. Create a client-style meeting, send the link to a personal address with no account, and see what happens. If you land in the room with no admission step, the tool's posture is whatever your least careful colleague configures. A 10-comment r/sysadmin thread is a good model here, since its requirement list reads as hard constraints rather than wishes.

Pro tip: test the dial-in number separately. Phone paths often sit outside the lobby rules and sometimes outside the encryption mode entirely.

Step 3: Who Owns the Recording Once You Press Record?

Recording is where a client conversation becomes a retained document with a legal basis, a retention clock and a deletion duty. Three questions settle it: who is told and when, where the file and transcript live, and what deletes them.

Consent comes first. The GDPR requires a lawful basis, and where that basis is consent, the UK regulator's guidance on lawful bases sets out that it must be freely given, specific and as easy to withdraw as to give. A platform that records on the host's click behind a silent banner does not deliver that. One that prompts every participant before capture starts does. US rules vary by state, and CISA's guidance tells meeting owners to inform participants in advance and check with counsel.

Then follow the file. NIST's post on virtual-meeting eavesdropping recommends encrypting recordings, requiring a passphrase to open them and deleting the copy the provider keeps. Ask for the retention period in writing, per plan. meetergo publishes its own on the meetergo security page: recordings delete automatically at the 180-day mark on the Suite plan, at twelve months on Premium, at twenty-four months on Enterprise, while transcripts are kept (checked 2026-10-14).

AI summaries need their own question, because they add a processor and often a model provider. Our write-up on GDPR rules for AI meeting notes covers that chain, and the local-processing route in meetergo's AI notes app keeps the transcript off a third-party server.

Step 4: Where Does the Meeting Data Live?

Ask for three artefacts in this order: hosting location, subprocessor list, data processing agreement. Hosting tells you which law applies. The subprocessor list tells you who else touches the data, since a vendor hosted in Frankfurt with a US transcription provider carries a US exposure it never advertised. The DPA tells you what it has agreed to be liable for.

A 10-comment r/privacy thread works through this for three household-name tools, and a 10-comment r/BuyFromEU discussion shows how fast the shortlist narrows once EU hosting is a hard requirement.

Corporate structure is the part no certification covers. A provider with a US parent can be reached by US legal process wherever its servers sit, the mechanism we unpack in our explainers on the CLOUD Act and on data sovereignty for EU buyers. For regulated client work, compare each candidate's published security documentation on specifics rather than adjectives: our breakdowns of Google Meet's privacy posture, GDPR-focused Zoom alternatives and EU alternatives to Microsoft Teams are built for that.

Step 5: Audit the Booking Link in Front of the Call

The call is usually the best-protected part of the workflow. The scheduling layer in front of it is where meeting metadata escapes, and few security evaluations look there.

Three leaks are common. A scheduler granted full calendar read access sees meeting titles, attendee lists and attachments across your whole calendar, including entries unrelated to it. A public booking page with an open question field collects client details before any DPA-covered call begins, and those answers land wherever that vendor keeps form data. Confirmation emails and SMS reminders route through another processor, which belongs on the same subprocessor list as the video provider.

Scope each one. Ask whether the scheduler needs mailbox access or only free and busy blocks: meetergo ships a bridge component under AGPL-3.0 that runs inside the customer's own Microsoft 365 tenant, so only free and busy time reaches meetergo while titles, attendees and attachments stay put (checked 2026-10-14). Then check that the booking page can run without cookies, and that reminders and forms sit under the same agreement as the call. For vertical specifics, see our guides to scheduling software for lawyers and HIPAA-conscious scheduling.

How Do You Choose? Three Trade-offs You Cannot Avoid

Strong encryption or a usable record of the meeting

You can have provider-blind media, or recordings, transcripts and AI summaries. Pick per meeting type: encrypted and unrecorded for privileged conversations, cloud-encrypted and recorded for discovery calls where the client benefits from a transcript. Teams and Zoom both support that split, at the cost of teaching people when to use which.

One managed client or browser access for guests

End-to-end encrypted modes typically require everyone on an installed, supported client, which is why Zoom excludes its web client and Teams blocks web and virtual-desktop joins in E2EE meetings (checked 2026-10-14). If half your client base joins from a locked-down laptop, a browser-based room with a strict lobby will produce fewer workarounds than a strong mode nobody can enter.

Certification depth or jurisdictional distance

Large US platforms publish deeper audit evidence, including SOC 2 reports. Smaller European vendors answer the jurisdiction question more cleanly but carry thinner certification stacks. Decide which risk your clients and regulators actually ask about, and keep your shortlist, including the candidates in our roundup of video conferencing tools, honest about both sides.

Where meetergo Fits, and Where It Does Not

meetergo is a European scheduling and meeting platform covering consulting, legal, sales and other client-facing work, and its built-in video app is one piece of that rather than a standalone conferencing product. Verified from its own documentation on 2026-10-14: calls run in Chrome, Firefox, Safari and Edge with no install for guests, host controls cover waiting rooms and a close-the-room action, and recording asks participants to consent before capture starts. Data is encrypted with TLS 1.3 in transit and AES-256 at rest, storage sits in Germany in ISO 27001 certified data centres, two-factor authentication is on every plan and can be enforced company-wide, and the subprocessor list forms part of the DPA offered on all plans. Video booking pages tie the call to the booking record, which answers Step 5 in one place.

Two honest limits. The encryption wording is inconsistent across meetergo's own pages: the video app page states end-to-end encryption for all calls, the security page documents transit and at-rest encryption, and cloud recording with transcripts means recorded content is readable server-side. Get the current technical answer in writing before relying on either phrasing. There is also no published SOC 2 report, no documented HIPAA business associate agreement and no self-hosted deployment, so procurement that requires any of those should keep looking.

Run the Step 2 and Step 3 tests on a real call: start free on meetergo and invite an outside address. Live in 30 seconds, no credit card, with a 7-day trial on paid tiers if the test needs recording.

Common Mistakes When Evaluating Secure Video Conferencing

• Grading the capability list instead of the shipped defaults. A waiting room that exists but ships off protects nobody. Score what a new user gets on day one.
• Treating end-to-end encryption as one property. It varies by call type, licence tier and client platform inside a single product, so a yes or no column will be wrong.
• Accepting a certification in place of a jurisdiction answer. ISO 27001 describes how a provider manages security. It says nothing about which government can compel disclosure.
• Forgetting that transcripts outlive calls. The meeting ends in an hour; the transcript, summary and attendee list persist for the full retention period, which is why that number belongs in the contract.
• Skipping the scheduling layer. Calendar scopes, booking-form fields and reminder providers all handle client data before anyone joins.

100% GDPR compliant

Booking + video conferencing in one tool.

No downloads.No extra costs.Set up in 30 seconds.

Use for free

Sarah NowakManaging Director · Intro call · 30 min09:0010:3014:00

100% GDPR compliant

Booking + video conferencing in one tool.

No downloads.No extra costs.Set up in 30 seconds.

Use for free

FAQs

Do client video calls need end-to-end encryption?

Not always. Encrypted-in-transit media with a strict lobby, named participants and a short retention window is defensible for most commercial calls. Reserve end-to-end encryption for conversations you would not record anyway, such as privileged legal or medical ones.

Can you record an end-to-end encrypted meeting?

Not through the provider. Server-side recording needs the service to decrypt the stream, which end-to-end encryption prevents by design. Zoom and Teams both disable cloud recording and transcription in E2EE mode (checked 2026-10-14). Local recording on a participant device is the usual workaround, with its own consent duties.

Does a GDPR-compliant video tool have to be hosted in the EU?

No. Transfers outside the EU are lawful with a valid mechanism and documented safeguards. EU hosting shortens the argument and cuts the number of transfer assessments you maintain, which is why regulated buyers prefer it, not because the regulation demands it.

Do you need consent from everyone before recording a client meeting?

You need a lawful basis, and consent is the usual one for client calls. Where it applies, consent must be freely given, specific and as easy to withdraw as to give, so a prompt before capture starts beats a banner nobody reads. US state laws differ, so check locally for cross-border calls.

Is a browser-based video call less secure than a desktop app?

Not inherently. A browser room removes install friction for external guests, which means fewer people falling back to an unmanaged personal tool. The real difference is that several vendors exclude web clients from their end-to-end encrypted modes, so browser access and strong encryption can be mutually exclusive.

What should a vendor's security page contain before you shortlist it?

Named hosting locations, the encryption standards in transit and at rest, a dated subprocessor list with each entry's country and transfer basis, retention periods per plan, authentication options including enforceable two-factor, and a DPA you can read before signing.