Secure Video Conferencing: A Practical Guide for Hosts

What secure video conferencing actually means

A video meeting is secure when only the people you invited can join, only they can see and hear it, and nothing is kept longer or in more places than you expect. Encryption is part of that, not all of it: a well-encrypted call can still admit a stranger holding a forwarded link.

Ask six questions before you pick a service:

Encryption: in transit only, or end to end?
Servers: who runs them, and what can they see?
Entry: can a link be guessed or reused, and can you lock the door?
Guests: what does an outsider need to join?
Recordings: who can record, who is told, and where does the file go?
Retention: what is kept after the call, and for how long?

Encryption in transit vs. end-to-end encryption

Most current services encrypt audio and video in transit, which protects a call from someone listening on the same Wi-Fi or along the network path. For browser calls built on WebRTC, the IETF's WebRTC security architecture requires media to be encrypted.

The difference is what happens at the servers. Group calls often pass through a media server that forwards each stream. With hop-by-hop encryption alone, that server can access what it forwards. End-to-end encryption adds a layer whose keys only the participants hold, so the server relays content it cannot read; the IETF's SFrame standard describes one way to do this.

Ask whether end-to-end mode is on by default, and what stops working in it. Features that need the server to handle the media, such as cloud recording or phone dial-in, are often unavailable.
Encryption does not protect the ends of the call. Anyone admitted sees and hears everything, and a screen recorder on a participant's computer captures it.

Who runs the servers, and what they can see

Even a device-to-device call needs servers: one to help participants find each other, and often a relay for people behind strict firewalls. The IETF's relay standard, TURN, exists because a direct path is not always possible. In a browser call that connects device to device, the relay passes along encrypted packets it cannot open.

Servers can still learn metadata: who met, when, for how long and from which network addresses. The FTC's privacy tips for businesses suggest reading the privacy policy to see what a service collects and whether it shares data with advertisers or other third parties. The same post warns that no conferencing service can guarantee the security of your information.

Meeting links, waiting rooms and locks

Most uninvited guests arrive through a link, not a hack. Treat the link like a key.

Use a unique link per meeting. The FTC suggests passwords or unique meeting IDs, with new ones for recurring meetings. A long random code is hard to guess; a personal room link reused for months is not.
Send links privately. Never post one on social media or a public calendar. CISA advises care in how, and to whom, you send invitations.
Turn on the waiting room (some services call it a lobby) so people wait until you admit them by name.
Lock the meeting once everyone has arrived, so a forwarded link stops working.
Know how to remove someone before you need to.
Keep names and case numbers out of titles; titles end up in invites, calendars and logs.

Guest access, recording and data retention

Guest access. Some services require every participant to have an account; others let a guest join from a browser with a display name. Browser joining spares guests an install, but it leaves the waiting room and lock in charge of who gets in.

Recording. Find out who can record, whether everyone sees a notice and whether the file lands in the provider's cloud or on the recording person's device. CISA suggests making sure participants know about a recording and considering saving locally rather than in the cloud. A screenshot or a separate screen recorder can capture a call with no notice, so the FTC advises assuming any call could be recorded.

Consent rules vary. Federal law generally allows recording when one party to the conversation consents (18 U.S.C. 2511(2)(d)), but some states require everyone's consent. Check your state's law or, as CISA suggests, ask your counsel.

Retention. Ask how long chat logs, recordings, transcripts, attendee lists and invite emails are kept, whether backups follow the same schedule and whether you can delete them yourself.

Secure video conferencing checklist for hosts

This list draws on the FTC's video conferencing tips and CISA's Guidance for Securing Video Conferencing. CISA has moved that page to its archive; the settings it describes are still common.

Update the app or browser, using only the provider's site or an official app store.
Create a new meeting with its own link and, if offered, a passcode.
Turn on the waiting room and any encryption settings; CISA notes these are not always on by default.
Send the link only to those who need it, and warn them it is coming so a fake invite stands out.
Check your camera and microphone before joining; they may be on by default.
Close windows you would not want seen, and share one window rather than your whole screen.
Admit people by name, then lock the meeting.
Say out loud if you are recording, and decide first where the file will be saved.
Use a trusted network. CISA advises against public hotspots and recommends WPA2 or WPA3 on home Wi-Fi.
End the meeting for everyone, then delete recordings and chats you do not need.

Self-hosted video conferencing: the trade-offs

Running meeting software on your own server answers the question of who runs the equipment: you do. Open-source options make that possible for a small organization, but every job the provider used to do moves to you.

What you gain: you choose where the servers are, what is logged and how long anything is kept.
What you take on: security updates, which CISA treats as a core control, plus certificates, backups, monitoring and someone to call when a meeting fails.
What you still need: a relay for participants behind strict firewalls and enough bandwidth for every stream through your server.
What it does not fix: self-hosting is not end-to-end encryption. If your media server can read the streams, so can anyone who breaks into it.

For a few people meeting now and then, a well-run hosted service with written retention terms is often less risk than a server nobody has time to maintain. Self-hosting fits better with IT staff, or when data must stay on equipment you control.

Choosing a private video conferencing service for small groups

For a therapist, lawyer, advisor or small team, the best private video conferencing setup is usually the narrowest tool that does the job. Look for these points:

Easy guest entry, with the waiting room, lock and remove button still in your hands.
A specific encryption claim: in transit, end to end, or end to end only in a special mode.
Recording that is off by default or saves where you decide, with a notice to everyone.
Written retention periods, in days, for chat, recordings, logs and invite details.
Support for the devices and browsers your guests actually use.
If health, legal or financial privacy rules apply, the written agreement they require, confirmed with your compliance advisor.
A room size that matches your calls.

Where ASL Meet fits

ASL Meet runs in the browser and hosts private video calls for up to four people, host included. The host signs in and gets a short link with a random code. A guest opens it, types a display name, allows camera and microphone, and joins with no account or install. Hosts can admit or turn away each waiting guest by name, lock the room, remove a participant and end the meeting for everyone.

Calls are encrypted in transit and go directly between devices when the network allows; otherwise a relay passes along the encrypted stream without being able to open or keep it. ASL does not market this as end-to-end encryption. ASL Meet stores no call audio, video, screen shares, chat, screenshots or recordings. A recording or screenshot saves to the participant's own device; starting a recording shows everyone a notice, but a screenshot does not.

A short administrative record of each meeting, including the code, times, any invite email address and host actions, is deleted 30 days after it ends. The interface is in English and Spanish.

Limits: four people per room; Chrome on Android and desktop browsers are the supported baseline, and Safari on iPhone, iPad and Mac is not officially supported. Pricing is quoted after a short conversation, and it is not for emergency use. See how ASL Meet works.

Frequently asked questions

What is the most secure way to hold a video call?

Use a new link per meeting, a waiting room and a lock, keep the app updated, and choose a service with written encryption, recording and retention terms. For the most sensitive topics, the FTC suggests asking whether video is the right channel.

Does secure video conferencing require end-to-end encryption?

Not always. Encryption in transit protects the call on the network; end-to-end encryption also keeps the provider's servers from reading it. Whether you need it depends on how far you trust the provider and which rules apply to you.

What is the difference between private and secure video conferencing?

Security keeps outsiders out and protects the stream. Privacy covers what the provider and others can learn or keep afterward, such as recordings, chat logs and attendee lists. A small group needs both.

Is self-hosted video conferencing more secure?

Only if it is run well. You control the servers and retention, but you also own updates, certificates, relays and monitoring. An unpatched server can be riskier than a well-run hosted service.

Can someone record a video call without me knowing?

Yes. A built-in recorder may show a notice, but a screenshot or a separate screen-recording app does not. Assume any call could be recorded, as the FTC advises.

Related guides

Explore the complete product

Read features, current access and limitations

Secure Video Conferencing: What Makes a Video Call Private and How to Set One Up