Recording and transcription in server-trusted meeting rooms

A recorded meeting is a data-protection event, not just a convenience. The moment a session is captured, transcribed, and stored, it becomes discoverable, subject to retention rules, and something a breach could expose. So the question is not only whether a platform can record, but whether it records in a way you can defend to a regulator. Here is how server-trusted recording should work.

Only a room the server can see can be recorded

Recording is a direct consequence of the encryption model. A server-trusted room, protected in transit, lets the media server read the streams, which is exactly what makes recording, transcription, and moderation possible. A room designed to keep the server blind to the media cannot be recorded by that server, by design. Which class a meeting is decides what can happen to it, so that choice has to be deliberate, not incidental.

Consent is a feature, not a checkbox

When a room is recorded, everyone in it should know, unmistakably and continuously. That means a start confirmation for the host, an always-visible recording indicator for every participant, and a notice at join time so no one is captured unaware. Clear notices help participants understand what is happening. They do not by themselves establish a lawful basis for recording; the organization must determine the applicable consent, retention, and access requirements.

Transcription that never leaves the building

A recording is far more useful once it is a searchable transcript, but sending audio of a sensitive government or financial meeting to a cloud speech service reintroduces exactly the residency problem you were trying to avoid. Transcription should run on an in-cluster speech model, fully offline, so the audio never leaves the boundary that the meeting itself was kept inside.

Then find the sensitive parts and mask them

A transcript of a real meeting will contain personal, payment, or health details in the clear. A responsible platform scans the finished transcript offline for those categories and masks the sensitive text on read for anyone who lacks an elevated view permission, so the transcript is useful without turning every recording into a fresh exposure.

How Dorbar does it

In a Dorbar Official room a host can record to in-cluster storage with a start confirmation, an always-visible badge, and a per-join notice; the recording is then transcribed by an in-cluster speech model that runs fully offline, and the transcript is scanned for sensitive categories and masked on read. Sealed rooms are the opposite class by design: the server is meant to stay blind to the media, so recording is refused outright. (The Sealed end-to-end path is built but dormant in the default deployment, and its browser implementation awaits external cryptographic review. It is not a live capability.)