4All Security and Privacy Production Checklist

Reduce unauthorized access and unnecessary exposure of participant audio, captions, translations, exports, and integration credentials.

Best for: Organization owners, security administrators, producers, and privacy leads.

Before you start

Owners/admins configure organization controls; operators should receive only the role needed for the event.

• Use the current production release and approved organizational policy.
• Record resource IDs, exact time zone, and accountable owner.
• Validate in a non-production environment when possible.
• Identify data controller/owner and applicable consent/notice requirements.
• Classify event sensitivity and approved retention/export locations.
• Inventory users, devices, BYOK credentials, share links, APIs, and vendors.

Checklist

1. Review organization/team membership and remove inactive users; avoid shared accounts.
2. Assign least-privilege roles and separate owner, billing, producer, and viewer responsibilities.
3. Require verified accounts and approved password/passkey practices.
4. Use private/controlled share links for sensitive events and validate access in a clean browser.
5. Limit transcript/export access to authorized roles and approved storage.
6. Store BYOK keys, stream keys, passphrases, webhook secrets, and API tokens in secrets management—not screenshots or runbooks.
7. Review desktop device licenses/sessions and revoke retired or lost devices.
8. Configure branding/privacy notices/consent where required and tell participants how audio/captions are processed.
9. At event close, stop sources, disable unnecessary links/outputs, secure exports, and follow retention policy.

Ready means: The event operates with documented data handling, controlled access, minimized secrets, and an accountable closeout.

Final readiness check

• User/device inventory is current.
• Share links were tested against intended access.
• Secrets are absent from artifacts.
• Retention owner and deadline are recorded.

Troubleshooting

• Unknown member: suspend/remove through approved owner process and audit activity.
• Public link used accidentally: disable/rotate it and assess exposure.
• Secret exposed: rotate immediately and follow incident response.
• Export copied to unmanaged storage: contain and notify privacy/security owner.

Security and operational notes

Important: This guide is operational guidance, not legal advice. Your organization must determine lawful basis, notice, consent, retention, and cross-border requirements.

Related guides

• Security Incident and Credential Exposure Response
• Manage Organization Members and Roles