DenwaysMeet security: 2FA, encryption and access control: Built to keep every
organization's data separate.
DenwaysMeet is multi-tenant from the ground up. Access control, session handling and data isolation weren't bolted on later. They're how every request is checked.
Sign-in
Proving who you are, properly
Argon2id password hashing
Passwords are hashed with Argon2id, the current recommended standard. They are never stored or logged in plain text.
Server-side sessions
Sessions are cookie-based and server-side, with hashed tokens. Nothing is bearer-style, so a leak gives nothing to replay.
TOTP two-factor authentication
Enable an authenticator-app second factor from Settings → Security, on top of your password.
Real Google OAuth 2.0
Google sign-in, where configured, uses the full PKCE flow with ID-token verification.
Isolation
Nothing crosses organization lines
Full multi-tenant isolation
Every row in the database is scoped to its organization. One customer's data is never reachable from another's session.
Two-axis role-based access
Platform roles are for us, running the service. They are entirely separate from organization roles, custom roles and room overrides.
Overrides, not just roles
A room, category or space can allow or deny any permission for one role. Denies always win, and the server enforces them.
Audit log
On Business, Enterprise and Education, a searchable history shows what changed and who changed it.
Your data
You control what you share, and can leave with it
Typed, sanitized errors
API errors are typed and sanitized before they reach the client. No stack traces or internal details leak out.
Card data never touches our server
You enter payment details directly into Stripe's own hosted fields, inside our billing screen. Card numbers never pass through our server.
Export your data, anytime
Settings → Security → Export my data downloads a JSON file. It holds your profile, memberships and the messages you’ve sent.
Delete your account
This permanently anonymizes your profile and signs you out everywhere. It also removes you from every organization you're a plain member of.
Dig deeper
Every part of our security, its own page
- Permissions & Roles Two-axis roles with per-room overrides
- Two-Factor Auth TOTP 2FA, with secrets encrypted at rest
- Audit Log A complete record of what happened, and who did it
- Call Security Every call encrypted in transit, with real host controls
- Data Protection Sanitized errors, and your data is always exportable
Found something?
If you've found a genuine security vulnerability, we want to know about it before anyone else does.
Report it by emailKeep reading
Bring the whole conversation together.
Set up a workspace in a couple of minutes. Free for up to 5 members, no credit card required.
