Demio

The Security Officer

Screen sharing is genuinely covered — full screen, individual windows, or slides uploaded as PDF presented inside the room — and Chrome streaming leans on simulcast for stability, but the engineering claims stop there. We found no public information on participant capacity, host moderation beyond chat replies, breakout rooms, or behaviour on a constrained connection outside Chrome. The waiting room auto-redirects everyone the moment a session begins, so it is a courtesy lobby, not an admission control. 3 5 6

Report an error

The Security Officer

The security page documents HTTPS connections and encrypted disk storage and stops there — we found no public information on end-to-end encryption, key handling, or whether the vendor can technically access session media. Admission is a 16-character Unique Join Link held by anyone who registers, and the waiting room redirects the room automatically rather than letting a host vet arrivals. That link is a bearer credential, and with no public information on passcodes or single-sign-on gated joining, it is the whole lock on the door. 4 5

Report an error

The Security Officer

Browser joining is the design — desktop and mobile across the major browsers, attendees arriving through their Unique Join Link with nothing to install — and live captions run in six languages with automatic language detection. We found no public information on telephone dial-in, keyboard or screen-reader testing, an accessibility conformance report, or low-bandwidth behaviour beyond Chrome's simulcast. Captions earn real credit here; the missing accessibility posture caps it. 6 7

Report an error

The Security Officer

Every live session is recorded automatically, and we found no public information on switching that off, on notifying participants, or on an organisation-wide recording policy. Storage region is unstated, recordings are kept for as long as the account is active with no stated limit, and deletion is manual — an irreversible delete button, event deletion for registrant data, and a 30-day wipe after account cancellation. Transcripts follow the same indefinite path with no separate retention rule of their own. 4 8

Report an error

The Security Officer

The marketing stack is broad — Salesforce, Pipedrive, Mailchimp, Stripe and more, plus a documented API — and the vendor states integrations are push-only with no access to other data inside the connected CRMs. But this is a leads-and-registration picture, not an identity one: we found no public information on single sign-on, provisioning, calendar-suite sync for scheduling, or room systems, and no deployment option other than the vendor's own cloud appears in the captured pages. 4 10

Report an error

The Security Officer

Nothing here tells me where media and metadata are processed, who the contracting entity is, or which subprocessors carry the traffic — data residency is not confirmed on the vendor's own captured pages, and every sovereignty attribute we hold is unknown. Even the privacy contact points to a different corporate domain, banzai.io, so the chain is unmapped in the pages a buyer can read. I weigh this category heavily, and absence of an answer is an answer. 4

Report an error

The Security Officer

No price figure, billing period, capacity limit, dial-in rate or recording-storage cost appears anywhere in the pages we hold, and the front page steers to booking a demo. Plan tiers surface only in passing — transcripts and several integrations sit on the Premium plan — so a buyer cannot compute any invoice from what is public. That is a sales conversation, not pricing transparency. 1 8 10

Report an error