Refuse meeting recording for a tenant that handles PHI

FeatureMediaService
Shipped
August 24, 2026 at 11:16 PM UTC
Author
Kamo
Commit
27d4797

The capability split made ServiceType.MEET permitted — a live conference on self-hosted Meet never leaves the cluster — while MEETING_RECORDING stayed blocked, because this pipeline posts the entire transcript to the multi-provider AI router and then emails the result to every participant including external guests. That is an unrecallable third-party copy. The guard sits in the private ingest() both public entry points funnel through, so it refuses before any bytes reach MinIO, and again at the top of runSummaryPipeline, which is public and @Async. 200 tests green.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing