Server-side tokens
LiveKit API keys and secrets are never delivered to the browser.
Security
Security and privacy as a technical foundation.
MeetWerk uses server-side authentication, short-lived LiveKit tokens and hardened web sessions. Actual data protection also depends on hosting, LiveKit operation and connected services – security starts with the architecture.
Security
Security starts with the architecture
Separation of application, database and credentials – with short-lived tokens and hardened sessions.
Secure sessions
PHP sessions use HttpOnly, SameSite and Secure cookies over HTTPS.
CSRF protection
State-changing forms and APIs are protected against cross-site request forgery.
Database access
PDO prepared statements reduce SQL injection risks.
Upload validation
Media files are checked by MIME type, size and file format.
Security headers
The Apache configuration sets CSP, Referrer-Policy and Permissions-Policy among other headers.
Protections
Technical and organisational measures
Privacy also depends on hosting and operation – the foundations are anchored here.
- LiveKit API secret stays exclusively on the server
- Short-lived, server-generated access tokens
- CSRF protection on all state-changing forms
- PDO prepared statements against SQL injection
- Hardened sessions (HttpOnly, SameSite, Secure)
- Security headers and restrictive upload validation
Learn more
Privacy also depends on operation
The web application, database and LiveKit credentials are separated; the API secret never leaves the server, and tokens are issued only briefly for participation. In addition, CSRF protection, PDO prepared statements, restrictive upload validation and security headers provide a resilient foundation. Before going live, the hosting location, data processing agreements and retention periods must be documented.
Request consultationDiscover MeetWerk
Ready for your next online meeting?
Start a meeting or talk to us about using MeetWerk in your company, school or organisation.