vexa

Least-privilege permissions

• Limit bot credentials to read-only transcript access — Configure meeting platform tokens (Teams, Zoom, Google Meet) to transcribe only, blocking the bot from starting/ending calls or changing settings
• Isolate credentials by meeting type — Create separate bot accounts for Teams, Zoom, and Google Meet; if one credential leaks, attackers can only access that single platform
• Rotate credentials every 90 days — Regularly replace bot tokens before they're compromised; store old credentials in a locked archive for audit purposes
• Restrict AI agent access to necessary transcripts only — Don't grant agents blanket access to all meetings; only share transcripts they need to process

Network isolation

• Self-host the service inside your corporate network — Avoid the SaaS version if handling sensitive meetings; this keeps transcript data from leaving your infrastructure
• Encrypt transcripts in transit — Ensure all data moving to/from the transcription service uses TLS/HTTPS encryption (verify this is enabled in settings)
• Control outbound connections — If self-hosting, use a firewall to block unexpected traffic to external APIs; only allow intentional calls to Google, Microsoft, and Zoom services
• Separate AI agent networks — Don't let downstream AI systems access the raw transcription service directly; route all requests through an approval layer first

Monitoring

• Log all transcript access — Record who requested which meetings' transcripts and when; review logs weekly for unusual patterns
• Alert on credential usage anomalies — Set up notifications if bot tokens are used outside normal meeting hours or from unexpected locations
• Track transcript retention — Confirm old transcripts are deleted per your data policy (e.g., "delete after 90 days"); audit quarterly
• Monitor API call volumes — Watch for sudden spikes in transcript requests, which could indicate a compromised credential being abused

Red flags to watch for

• Unexpected meetings in transcript logs — If the bot joins calls you didn't schedule, a credential has likely leaked; revoke it immediately
• Transcripts appearing in unintended places — If meeting content shows up in chat channels, databases, or external systems you don't control, investigate data flow
• Meeting platform access warnings — If Zoom, Teams, or Google flags unusual bot behavior (multiple simultaneous calls, rapid joining), pause the service and verify your setup
• Delayed or missing transcripts — If transcription suddenly stops working, confirm the bot credential wasn't revoked by the meeting platform (often a sign of ToS violation)