Security

Last updated: August 12, 2026

This page describes how TrymeetIQ, operated by Sinisys Software Pvt Ltd, protects your data and your invitees' data. We've kept this specific to what's actually in place, rather than generic claims.

Encryption

• In transit: every connection to TrymeetIQ — your browser, the API, and calls to Google's APIs — is encrypted with TLS/HTTPS.
• At rest: Google OAuth access and refresh tokens are encrypted at rest using AES-256 before being stored in our database — never stored in plain text.
• Passwords: if you use a password to sign in (as opposed to signing in with Google), it's hashed with scrypt, a memory-hard hashing algorithm — we never store or log the plain password.

Access control

• Every request is authenticated with a signed session token; sessions can be invalidated instantly (for example, on a password reset) without waiting for the token to expire naturally.
• Every database query is scoped to the authenticated user's own data — one host's bookings, contacts, and settings are never reachable by another host's account.
• Administrative access (the admin panel) is gated by a database-backed role check performed fresh on every request, not cached in the session token, so admin access can be revoked immediately.

Google OAuth & Calendar access

• We request only the Google Calendar scope needed to check your availability and create meeting events — never Gmail, Drive, Contacts, or any other Google service.
• OAuth tokens are encrypted at rest (see Encryption, above) and are deleted immediately when you disconnect Google Calendar, connect a different Google account, or delete your TrymeetIQ account.
• Google Calendar push notifications are verified with a constant-time comparison against a per-account secret token, so a spoofed notification can't trigger a sync for the wrong account.

Infrastructure

• TrymeetIQ runs on a dedicated virtual private server with an isolated database — your data is not co-mingled with other unrelated services.
• Database backups run automatically every night, retained for 14 days, in addition to whole-server snapshots taken by our infrastructure provider.
• TLS certificates are issued and auto-renewed via Let's Encrypt.
• Outbound webhook deliveries are protected against SSRF (server-side request forgery) — destination addresses are resolved and validated immediately before every dispatch, closing the gap a DNS-rebinding attack would otherwise exploit.

Data privacy

We do not sell your data or Google user data, use it for advertising, or use it to train or improve AI/ML models. Our use of Google APIs adheres to the Google API Services User Data Policy. See our Privacy Policy for the complete picture.

Deleting your data

If you're unable to log in, email privacy@trymeetiq.com and we'll complete deletion within 30 days. Full details are on our Data Deletion page.

Reporting a security issue

If you believe you've found a security vulnerability in TrymeetIQ, please email privacy@trymeetiq.com with details. We ask that you give us a reasonable opportunity to investigate and address any issue before disclosing it publicly.

Contact us

Sinisys Software Pvt Ltd
Chennai, Tamil Nadu, India
info@trymeetiq.com