Secure delivery
Deterrence and traceability, not a locked box.
This page says exactly what the secure profile does, what it refuses, and what it cannot do. Organizations are asked to read it before they promise anything to their own participants.
1. App-only join
Secure sessions never play in a browser. Each join asks the operating system to attest the app — Play Integrity on Android, App Attest on iPhone, iPad and Macs — and the platform hands the per-session key only to a join it accepted. A Mac can attest only from macOS 27 on Apple silicon, so older and Intel Macs cannot join a secure session. Supermeet can require an app update before anyone joins; companies that build on the SDKs set the minimum build of their own app and can revoke its registration.
2. The invisible mark
Every frame a participant sees in the app is marked on that participant's own device, in the app's render pass, just before it is shown — within a budget of 4 ms a frame (2.6 ms median measured at 1080p on an Apple M3 Max; phones are not yet measured). The mark carries a code that maps to one account in one session; the mapping lives on the server and expires after 12 months. It is embedded in the picture itself, invisible in normal viewing, and it changes pattern every ten minutes so that averaging frames does not remove it. Live classes also carry, by default, a mark added on our servers inside the stream, so a copy taken from any player — a browser or a modified app included — carries it too.
3. Capture protection
| Platform | Screenshots and screen recording | Notes |
|---|---|---|
| Android 8+ | Blocked (a secure window); Android 15+ also detects a recording | Casting or an external display blacks the session out; a rooted device can bypass the block — the mark remains |
| iPhone and iPad, iOS 16+ | iOS offers no block: recording and mirroring are detected, and the class blacks out and mutes (a secure meeting ends on that device) | Screenshots are not blocked — they carry the mark; external displays and AirPlay black the session out |
| Mac, macOS 27+ on Apple silicon | Not blocked: current macOS lets screen recorders capture a window | A second display or a virtual audio device blacks the session out; the mark carries attribution |
4. Leak cases
An organization opens a leak case with the clip. The extraction service resamples it, decodes the marks across frames and reports a confidence tier — match, probable or no match, or several sources when a clip combines copies. A match is never acted on automatically: a person other than the one who opened the case reviews the result before an account is named, the participant can appeal through Supermeet (privacy@supermeet.io), and every step is logged with who took it. Organizations only ever see resolutions for their own sessions.
5. Honest limits
A rooted or jailbroken device, a modified app, a screen recorder on a Mac, or a phone camera can capture a session cleanly. The mark travels with the pixels regardless, so attribution — not prevention — is the aim, and it has been tested on synthetic video and a simulated camera angle, not yet on real camera footage. Two or more colluding accounts averaging their streams can weaken the mark; the pattern rotation and the server-side mark on the broadcast path are designed against that, and extraction reports its confidence honestly rather than guessing. We do not claim more than this.
6. Data we keep, and for how long
| Data | Why | Retention |
|---|---|---|
| Join records (session, name, role, time) | Attendance; identifying the seat in a leak case | 12 months |
| Mark-to-account map | Leak tracing | 12 months |
| Recordings and replays | Replays, when the organization records | Organization setting, default 12 months, with an email to the organization 48 hours before erasure |
| Leak cases | Evidence, decisions, appeals | Duration of the case plus 24 months |
These are session-scoped integrity records. They are not used to build behavioural profiles, to score attention or engagement, or for advertising. The apps tell participants that what they see is marked to them; the session notice, the student notice, the privacy notice and the data processing agreement set out the rest.