server/tests/test_no_egress.py, which runs on every commit. If a claim below stops being true, that test fails.
The short version
Pay data never leaves
Not to this project — there is no “us” to send it to — and not to Google, Microsoft, or Zoom.
No cost figure sent to calendar vendors
Not the total, not a rate, not a per-person number. Not in any direction.
No vendor-operated endpoint
MeetCost has no servers. The software runs on yours.
No telemetry
No analytics, no crash reporting, no phone-home. Not optional-and-on-by-default. Absent.
Directory sync reads only
MeetCost holds no write scope to Google Workspace, Microsoft 365, or Zoom. It never modifies your directory.
Configurable destinations only
The egress allowlist is derived entirely from your configuration. Configure nothing and MeetCost connects to nothing but your database.
The honest caveat
Meeting metadata — the title, the attendee list, the start and end times — is already in Google’s, Microsoft’s, or Zoom’s cloud, because that is where the meeting was scheduled. MeetCost does not change that and does not pretend to. What MeetCost adds is the cost calculation, and that calculation happens entirely inside your own deployment. The add-ins send meeting details from the vendor’s client to your backend. Nothing travels in the other direction. So the accurate claim is not “MeetCost keeps your meetings private”. It is: MeetCost does not send anything additional to your calendar vendor, and never sends anything about pay to anyone.Every outbound connection
MeetCost maintains a runtime allowlist of hosts it may connect to. The list is derived entirely from your configuration — a host appears on it only because you supplied a credential or a URL that implies it. Any connection to a host not on the list is refused at the socket layer, before a packet is sent.
The last three entries are your own tenant’s APIs, reachable only because you supplied that tenant’s credentials. Nothing sent to Google, Microsoft, or Zoom contains a salary, a rate, or a cost. The requests are reads: “list the users in this account”, “what was the attendance for this meeting”.
What the add-ins send
The Meet, Teams, and Zoom clients talk to one host: the MeetCost backend address your administrator configured. They ship with no default address — if one is not configured they display a setup message rather than guessing. Each client sends:- The attendee email addresses on the meeting being viewed
- Its duration and recurrence
- The identity token the host platform already issued to the user
How pay is stored
The encryption key is yours. MeetCost does not generate one it retains, cannot recover your data without it, and has no key-escrow mechanism.
What MeetCost deliberately does not do
No per-person rankings
No “who spends most time in meetings” table, in the product or in exports. That is individual productivity scoring, which is out of scope by design.
No per-person breakdown by default
Because pay is stored per individual, a per-participant cost breakdown is a salary disclosure. It is off at every level below Admin and requires a deliberate change to enable.
No precise totals for small meetings
A two-person total minus your own cost is your colleague’s exact salary. Below the suppression threshold, non-admin viewers see a total rounded to two significant figures and labelled approximate.
No hard blocking
MeetCost shows a number and a prompt. It never prevents anyone from scheduling anything.
Verifying these claims yourself
You do not have to take this page’s word for it.- Test suite
- Config inspection
- Network capture
Run the residency test suite, which covers runtime enforcement, configuration, and a source scan: