Security and data residency
A3.Meet operates in five countries with different personal data requirements. Below is the status for each country, the deployment models and the controls the customer’s security team gets.
Data residency by country
The storage region is set for the organization: its recordings, transcripts and minutes do not leave the selected environment, however many countries the product serves.
| Country | Personal data localization requirement | A3.Meet delivery status |
|---|---|---|
| Kazakhstan | Storage within Kazakhstan | Done, primary environment |
| Russia | Initial collection and storage in Russia under Federal Law No. 152-FZ | Separate environment in Russia |
| Uzbekistan | Processing in databases located in Uzbekistan | Separate environment in Uzbekistan |
| Kyrgyzstan | A strict requirement is not confirmed; cross-border transfer is regulated | Under review with lawyers |
| Mongolia | The personal data protection law mainly concerns cross-border transfer | Under review with lawyers |
The table is updated as legal confirmation comes in. Rows marked “under review” do not mean readiness and are not stated as fulfilled in contracts.
General data storage rules in the A3 ecosystemEnd-to-end encryption
In end-to-end encryption mode the server forwards media streams but cannot decrypt them. The host turns the mode on before the meeting starts, and participants see it on the join screen.
A deliberate choice for confidential meetings
While the mode is on, features that need server access to the stream content are unavailable. In other meetings they work as usual.
- Server-side recording
- Transcription and live captions
- AI minutes and questions to the meeting
- Joining by phone and SIP
- Broadcasting to external platforms
Deployment models
The cloud suits most organizations. For banks, the public sector and companies with infrastructure requirements, A3.Meet is deployed at the customer’s site in full or in part.
Cloud
The main model. Organizations are isolated from each other at the data, storage and media room level, and isolation is verified by regular automated tests.
On-premises deployment
A separate installation in the organization’s infrastructure: a license key with offline validation, local passwords, and speech recognition and a language model on your own servers.
Hybrid deployment
Media servers run at the customer’s site while management stays in the cloud. Suitable when requirements cover meeting content but not schedules.
Air-gapped environment
A fully autonomous installation with no internet access on an alternative media server. Features that need external services are disabled by policy.
Access control
- Sign-in with A3.ID or corporate SSO, employee sync via SCIM 2.0
- Access only from allowed IP address ranges and allowed countries
- Trusted domains: external participants confirm their email with a code
- Session and device management, forced session termination
- Separate retention periods for recordings, transcripts, chats and minutes
Audit log and control
- The log records the action, initiator, object, time, address, device and result
- Sign-in and sign-out, changes to meetings and policies, access to recordings, downloads and AI access to content
- Log search, CSV export and a compliance report
- Delivery to a SIEM via webhook, syslog and syslog over TLS
- TLS 1.3 and DTLS-SRTP encryption in transit, encryption of recordings and transcripts at rest
Accessibility
- WCAG 2.1 level AA conformance for the admin dashboard and the meeting client
- Full keyboard control, shortcuts for microphone, camera, raised hand and chat
- Screen reader compatibility, clear roles and labels for elements
- Captions as an accessibility tool with adjustable size and contrast
- Reduced motion mode
Need deployment in your infrastructure or an NDA before we talk?
We will explain the deployment model and the storage region status for your country, and go through your security team’s questionnaire.