Security Best Practices

Protecting your meetergo account and your attendees' data is important. This guide covers security features available in meetergo and best practices for keeping your account secure.

Account Security

Turn On Two-Factor Authentication

The single biggest thing you can do for your account. Open Profile settings, find the Two-factor authentication card and add an authenticator app or a passkey, then save your recovery codes.

Included in every plan, Free included
Each user turns it on for themselves; there is no company-wide switch
If you sign in with Google or Microsoft, 2FA lives in that account instead

See How to enable two-factor authentication (2FA) on your account for the step-by-step setup.

Strong Passwords

When using email/password authentication:

Use a unique password not used on other sites
Include a mix of letters, numbers, and symbols
Avoid common words or personal information
Consider using a password manager

On the Enterprise plan we connect your identity provider (Okta, Microsoft Entra ID / Azure AD, Google Workspace, any OIDC or SAML 2.0 provider) so your team signs in through Continue with SSO. Authentication stays centralized, your own policies including enforced MFA apply before anyone reaches meetergo, sessions are managed by your provider, and every sign-in lands in your provider's audit trail.

See Single Sign-On (SSO) with Okta, Microsoft Entra ID and SAML for setup.

When signing in with Google or Microsoft:

Your password is managed by the OAuth provider
Benefit from their security features (2FA, etc.)
Revoke access anytime from your Google/Microsoft account

API Key Security

If you use the meetergo API, treat the key like a password: keep it in an environment variable instead of your source code, never commit it to version control or share it publicly, give it a short expiration when you create it, and revoke keys you no longer use. Secure Your API Keys covers the same ground with examples, along with the key format and the allowed expiration range.

Revoke Compromised Keys

If a key may be compromised:

Go to Admin Center → API for a Platform API key (ak_live…), or Integrations & Apps → Personal Access Tokens for a personal token
Find the key and revoke it
Generate a new key
Update your integrations

Team Security

Principle of Least Privilege

Give users only the permissions they need
Use team member roles for most users
Reserve admin access for those who need it
Review permissions periodically

See User roles and permissions: admin rights and who can see what.

Offboarding

When team members leave:

Remove their meetergo access immediately
Transfer ownership of their meeting types if needed
Review any integrations they set up

Joining Is Invitation-Only

Nobody can join your organization on their own: the only way in is an invitation from an admin, so there is no domain-based joining to switch off.

Integration Security

Calendar Permissions

meetergo asks each service only for the scopes it actually needs, which for calendars means reading events to check availability and creating or updating events for bookings. meetergo does not read your email, with one exception: if you explicitly enable CRM Email Sync, it uses read-only mail scopes and fetches messages on demand without storing their bodies. The permissions requested per service are listed in What meetergo Requests.

Review Connected Apps

Go through Settings → Integrations every few months and disconnect anything you no longer use. Disconnect an Integration walks through the steps, including how to revoke meetergo's access on the provider's side as well.

Webhook Security

When using webhooks:

Use HTTPS endpoints only
Validate webhook signatures if available
Don't expose sensitive data in webhook URLs

Data Protection

What Data meetergo Stores

Account information (name, email)
Calendar connection tokens (encrypted)
Booking data (attendee info, meeting times)
Integration credentials (encrypted)

Data Location

meetergo data is stored in the EU (Frankfurt) region with:

Encrypted storage at rest
Encrypted transmission (TLS)
Regular backups

Data Retention

Active account data: Retained while account is active
Deleted accounts: Data purged according to our retention policy
Booking history: Available for your records, or deleted automatically on a schedule you set

You set your own retention period under Admin Center → Privacy → Data retention. See what the deletion timer really deletes.

Custom Domain (Premium and above)

Booking pages can run on your own domain, with the SSL certificate included and renewed automatically. This needs the Premium plan or above and allows up to 10 domains per company, and a verified domain only starts serving your pages once you set it as the primary one.

See Custom Domains: Use Your Own Domain for Booking Links for details.

Booking Page Security

Bot Protection

meetergo includes protection against:

Automated spam bookings
Bot form submissions
Abuse prevention

Email Validation

Disposable email detection
Email format validation
Optional domain restrictions

Rate Limiting

API and form submissions are rate-limited:

Prevents abuse
Protects against automated attacks
Fair usage for all users

Monitoring Your Account

Check for Unusual Activity

Regularly review:

Recent bookings for unexpected entries
Team member list for unknown users
Connected integrations
API key usage (if applicable)

Notification Settings

Enable notifications for:

New bookings
Team changes
Subscription updates

Reporting Security Issues

If you discover a security vulnerability:

Email security@meetergo.com
Provide details about the issue
Don't disclose publicly until resolved
We'll respond promptly

Security Checklist

Use this checklist to secure your account:

Two-factor authentication enabled and recovery codes saved
Strong, unique password or SSO enabled
Reviewed team member permissions
Removed departed team members
API keys stored securely (if used)
Unused integrations disconnected
Regular activity review

FAQ

Does meetergo support two-factor authentication?

Yes. If you sign in with an email address and password, you can add an authenticator app or a passkey plus recovery codes in Profile settings, on every plan. If you sign in with Google or Microsoft, or through SAML SSO, your second factor is handled by that provider. See How to enable two-factor authentication (2FA) on your account.

How is my calendar data protected?

Calendar connection tokens are encrypted at rest. We access only the minimum data needed for scheduling.

Can meetergo employees access my data?

Access is limited and logged. We don't access customer data except for support requests or legal requirements.

Yes. See GDPR documents: download your DPA, privacy snippet and confidentiality agreement (NDA), which also covers the § 203 StGB confidentiality agreement for professions bound by professional secrecy.