Security

Effective 11 September 2026

Security is not a feature we bolt on. It shapes how the product is built. Here is how we protect your data in plain words.

Encryption everywhere

All traffic to Gaurify Meet is served over HTTPS with modern TLS. Data at rest lives in managed cloud storage that is encrypted by the provider. Sensitive configuration is held as encrypted secrets, never in code or in the browser.

Credentials you can trust

• Passwords are hashed with PBKDF2 and a per user salt. We never store or log a readable password, and nobody at Gaurify can read one.
• Passkeys (WebAuthn) are supported as a first class sign in. The private key never leaves your device. We only ever hold a public key, which cannot be used to sign in on its own.
• Sign in also supports an emailed magic link and Google sign in with a CSRF protected flow.

Least privilege by design

A guest's data is only ever shown to the host they booked with. Team members see their team's data. Our internal support role can view account and booking data to help you, but never a password or passkey secret, because those are not readable by anyone. A change to a customer's own identity is confirmed by that customer through a link or one time code before it applies.

Safe by default in the platform

• We run on Cloudflare's global edge, which absorbs common network and denial of service attacks.
• Every write goes through the database, which acts as the source of truth, so a double booking cannot slip through a race.
• Per IP and per account rate limits guard the AI, sign in, and booking endpoints against abuse.
• Calendar access asks for the narrowest scope that makes availability and booking work.

AI handled with care

Flow uses a screenshot only when you drop one in, and only to pre-fill a meeting. We do not use your content, a guest's details, or your screenshots to train models. AI usage is rate limited per plan.

Payments

Card and UPI payments are handled by regulated payment providers (see Sub-processors). We do not store full card numbers on our servers.

Report a vulnerability

Found something? Please tell us before disclosing it publicly. Email hello@gaurifyhq.com with the details and steps to reproduce. We will acknowledge you, investigate, and fix genuine issues quickly. We welcome good faith research and will not pursue researchers who act responsibly.

Questions

For anything security related, write to hello@gaurifyhq.com. See also our Privacy Policy.