Security & Compliance Whitepaper

1. Executive summary

Magoven (Pty) Ltd designs MagMeet with defense-in-depth security appropriate for business communications. This document summarizes technical controls for security reviewers, procurement teams, and regulators. It does not modify contractual commitments unless incorporated into a signed agreement.

2. Architecture overview

• Multi-tier web application hosted on hardened Linux infrastructure with reverse proxy and WAF protections.
• Real-time media routed through encrypted SFU infrastructure with DTLS-SRTP encryption.
• Object storage for recordings and files on S3-compatible providers (e.g., Wasabi) in EU-capable regions.
• Relational databases for metadata with restricted network access.
• Background workers for email, webhooks, and media post-processing.

3. Encryption

In transit

TLS 1.2+ for all HTTPS and WSS connections. Media encrypted via SRTP between clients and media servers.

At rest

AES-256 encryption for stored recordings, transcripts, and backups. Database volumes encrypted at the storage layer.

4. Identity and access

• Email/password with bcrypt hashing, Firebase OAuth (Google), and phone OTP authentication.
• JWT access and refresh tokens with HttpOnly cookies and short-lived access tokens.
• Role-based access control for organization administrators.
• Meeting passwords, waiting rooms, and host moderation tools.
• Principle of least privilege for production access with MFA for administrators.

5. Network security

• Private networking between application and database tiers.
• Firewall rules restricting administrative ports.
• DDoS mitigation at CDN/reverse proxy layer.
• Regular patching and vulnerability scanning.

6. Application security

• Secure SDLC with code review and dependency monitoring.
• CSRF protections, input validation, and rate limiting on authentication endpoints.
• reCAPTCHA Enterprise on sensitive auth flows.
• Content Security Policy and security headers on web properties.

7. Logging and monitoring

Centralized application and security logs, anomaly detection on authentication failures, and alerting for service health. Logs retained per Privacy Policy.

8. Data residency

Primary operations are based in Republic of South Africa with media and storage options in EU-capable regions. Enterprise customers may discuss data residency requirements with [email protected].

9. Subprocessors (categories)

• Cloud infrastructure and CDN providers.
• Real-time media services.
• Object storage (S3-compatible, e.g., Wasabi).
• Email and transactional messaging.
• Telephony (Telnyx and related carriers).
• Payment processing.
• Optional AI inference (self-hosted Ollama or cloud APIs per configuration).
• Firebase/Google Cloud for authentication and security services.

10. Incident response

1. Detection via monitoring and user reports.
2. Triage and classification within security operations.
3. Containment and eradication.
4. Customer notification per DPA timelines for personal data breaches.
5. Post-incident review and remediation tracking.

11. Business continuity

Regular backups, redundant media paths where configured, and documented recovery procedures. Target RPO/RTO vary by tier and are specified in enterprise SLAs.

12. Compliance alignment

• POPIA: lawful processing, security safeguards, cross-border transfer mechanisms, data subject rights support.
• GDPR: DPA, SCCs, breach notification, privacy by design.
• ISO/IEC 27001: control framework alignment (certification roadmap).
• SOC 2 Type II: roadmap for enterprise customers.
• PCI DSS: card data handled by payment processors, not stored on Magoven systems.

13. Customer responsibilities (shared model)

• Strong passwords and MFA for administrators.
• Appropriate meeting security settings.
• Lawful recording and consent practices.
• Prompt removal of departed users from organization accounts.

14. Contact security team

Vulnerability reports: [email protected] · PGP key available on request · Trust inquiries: [email protected]