Whereby

The IT Administrator

Screen sharing, chat, whiteboard and transcription are confirmed, so the standard meeting works, and there's a real Group call vs Small meeting mode distinction. But participant capacity is published nowhere, there are no breakout rooms, no moderator controls in evidence, and "our infrastructure is scalable... including in low bandwidth scenarios" is a promise, not a number — and there is no diagnostics story for after a bad call. 1 2 3

Report an error

The Security Officer

Screen sharing, chat, whiteboard and transcriptions are listed, but the evidence gives no participant limits, no breakout rooms, no moderation controls, and only a homepage slogan about low bandwidth — nothing documented about behaviour under load. The default group mode explicitly trades away the E2EE small-meeting mode for 'quality and stability', so scale and privacy are in tension from the outset. 1 3

Report an error

The Works Council Advocate

Screen sharing, whiteboard and a homepage slogan that infrastructure is "scalable... including in low bandwidth scenarios and on mobile devices" is all the engineering substance I get — no participant limits, no breakout rooms, no mute-all or admission controls documented, and a Group-call default mode with nothing said about behaviour when a connection degrades. Missing evidence is information, and none of it is here. 1 3

Report an error

The Educator

Screen sharing, chat, whiteboard and transcription are listed, and the vendor claims quality holds up 'in low bandwidth scenarios and on mobile devices' — that claim matters to my dead-spot students. But there is no published participant capacity, no host moderation controls in evidence, and not one word about breakout rooms, which is how I actually run a class of thirty. 1 2

Report an error

The Accessibility Advocate

Screen sharing, chat, whiteboard and a low-bandwidth claim exist, but there is no published participant capacity, no breakout rooms, no moderation controls, no waiting rooms — the call works, the control room doesn't. 'Consistently high quality video call experience, including in low bandwidth scenarios' is a slogan, not documented degradation behaviour. 1 3

Report an error

The Skeptic

Screen sharing, chat, whiteboard and a low-bandwidth claim exist, but not a single participant number is published, and breakout rooms and host moderation controls appear nowhere in the evidence. The only modes documented are the 'Group call' default and a 'Small meeting' E2E mode, which tells me small meetings are the design target; scale and behaviour under load are asserted, not documented. 1 2

Report an error

The IT Administrator

Optional end-to-end encryption exists with a named mechanism — DTLS-SRTP, client-generated keys — and the trade-offs stated outright, which beats vendor-held keys. It falls short of the top anchors because E2EE is opt-in while Group call is the default, and the access half of the criterion is a blank: no lobby, no passcode policy, no SSO-gated joining, no per-meeting access controls anywhere on the evidence. 3

Report an error

The Security Officer

Small meeting mode is real end-to-end encryption — DTLS-SRTP, client-generated keys — with the trade-off at least named, which earns the encryption half. But rooms default to the non-E2EE group mode, permanent room links come with no documented lobby, lock, passcode or host admission, and the vendor never states plainly what it can see in group mode — 'never collect or record' is policy, not mechanism. 3 1

Report an error

The Works Council Advocate

Opt-in "Small meeting" mode with end-to-end encryption, DTLS-SRTP and client-generated keys is a real mechanism with a named trade-off, which earns credit — but it is not the default, and nothing documents who can get into a permanent room link: no lobby, no passcode, no SSO-gated joining, and no plain statement of what the vendor can see in default Group call mode. 3

Report an error

The Educator

There is a real mechanism behind the E2EE claim — 'Small meeting' mode with DTLS-SRTP and client-generated keys, and the trade-off named (quality and stability) — plus a statement that meeting media is never stored. But Group call is the default and I find no lobby, waiting room, passcode or host-admission control documented, so who can walk into my room is a blank. 3

Report an error

The Accessibility Advocate

The 'Small meeting' mode is genuine end-to-end encryption with the cryptography named (DTLS-SRTP, client-generated keys) and the trade-off admitted, which deserves credit. But it is off by default (rooms default to Group call mode), and I find no admission control of any kind — no passcode, no lobby, no SSO-gated joining — so who can get in is a question the evidence never answers. 3

Report an error

The Skeptic

The sentence I look for exists: 'Small meeting' mode gives end-to-end encryption via DTLS-SRTP with client-generated keys, with the trade-off named — quality and stability. But the default is Group call mode, the evidence never states what encryption that mode has or whether the vendor can technically access media there, and no lobby, per-meeting passcode or SSO-gated joining is documented. Optional E2E with named crypto earns above 5; silence on the default mode and on access controls keeps it well short of 8. 3

Report an error

The IT Administrator

Mobile devices and low-bandwidth performance are claimed and permanent room links plus a browser-first product mean guests can presumably join without an account. But there is no telephone dial-in at all — no fallback when the network dies — transcription is not live captions, and the evidence says nothing about keyboard navigation, screen readers, or any accessibility posture. 1 3

Report an error

The Security Officer

Mobile and low-bandwidth claims exist only as marketing and link-based rooms are stated, but there is no dial-in, no live captions (transcriptions are not captions), no accessibility statement, and browser-first joining is asserted in the provenance note rather than evidenced in the captured facts. 1 2

Report an error

The Works Council Advocate

Permanent room links and a stated low-bandwidth and mobile claim are a start, but there is no dial-in anywhere, no accessibility statement, and transcriptions are not live captions. Whether a guest without an account can actually join is never explicitly confirmed, so the page falls short of the anchor that requires a stated accessibility posture. 1 2

Report an error

The Educator

Mobile and low-bandwidth support is stated, transcriptions exist, and registration is framed as optional so guests plausibly join without an account. But there is no telephone dial-in for my dead-spot learners, no accessibility statement or screen-reader evidence anywhere, and the hard 16-and-over floor simply excludes younger students — an accessibility fail by policy, not by bandwidth. 1 3

Report an error

The Accessibility Advocate

My home turf, and it is thin: 'Transcriptions' is listed as a feature but never as live captions a deaf colleague could rely on in-meeting, and there is no dial-in, no accessibility statement, no conformance report and no screen-reader or keyboard testing anywhere in the evidence. Guests can join by permanent room links and mobile is supported, which is all the evidence can honestly claim. 1 3

Report an error

The Skeptic

Mobile and low-bandwidth support is a homepage claim and transcription exists, but the evidence has no dial-in, no accessibility statement, no confirmation that guests join by link without an account, and no keyboard or screen-reader testing. Registration requires an email or phone number, and nothing evidences that the browser path is full-feature rather than degraded. 1 3

Report an error

The IT Administrator

Recording exists but the vendor offloads consent entirely to the customer — "they are then responsible for collecting consents from all participants" — with no built-in notification or consent prompt in evidence, no storage region for recordings, no retention rule, and no organisation-wide admin policy. 3

Report an error

The Security Officer

Recording is plan-gated and consent is explicitly dumped on the customer to collect; nothing on who is notified when a recording starts, where recordings are stored, how long they live, or what an admin can switch off. The policy even claims no recordings are stored except transiently, which sits oddly against a shipping recording feature — I want to know which statement I'm buying. 3

Report an error

The Works Council Advocate

Whereby washes its hands of the room: whoever holds the Recording feature may record and "they are then responsible for collecting consents" — no in-product notification or consent prompt is evidenced, storage region for recordings is unstated (the policy only says Whereby itself will not store meeting media), and there is no retention rule or organisation-wide switch a works agreement could lean on. The Embedded admin dashboard exposing participant IDs, device information and call duration adds behavioural metadata with no documented off-switch or retention. 3

Report an error

The Educator

Recording is plan-gated, but consent is contractually shifted onto the customer rather than a built-in prompt or notification, and nothing says where recordings live, how long they survive, or what an organisation can switch off. The vendor's own pledge not to store meeting media is honest, but it leaves the governance a works council needs entirely unevidenced. 3

Report an error

The Accessibility Advocate

Recording is plan-gated and collecting consents is explicitly dumped on the customer — no built-in notification, no admin policy, no retention rule, no audit trail. The vendor says it stores no recordings itself, which limits exposure, but where a customer's recording actually lives is unstated. 3

Report an error

The Skeptic

Recording is plan-gated, but consent is outsourced: customers 'are then responsible for collecting consents from all participants' — no product-enforced notification or consent prompt is evidenced. Storage region for recordings, retention, and organisation-wide admin policy are all unstated, and the policy's claim of no meeting storage sits unresolved against an advertised Recording feature. 3

Report an error

The IT Administrator

The Embedded product is a genuine API/SDK story — programmatic room creation, developer tooling, transcription via API — plus in-room apps like Miro and Trello. But on the Meetings side I see no calendar integration, no SSO/SAML/OIDC, no SCIM, no webhooks, no room-system support and no self-hosted option — cloud-only — and the FAQ even has to ask whether the API is reachable on a Meetings plan. 1 2 3

Report an error

The Security Officer

The Embedded product has a genuine API and SDK with programmatic room creation — stronger than most — but the evidence is silent on SSO, calendar sync, SCIM, webhooks, and any self-hosted option. In-meeting widgets like Miro and Trello are not stack integration. 1 2 3

Report an error

The Works Council Advocate

The Embedded API and SDK with programmatic room creation is genuinely buildable, but there is no calendar integration, no SAML/OIDC SSO, no provisioning, no webhooks and no self-hosted or private-cloud option anywhere. The FAQ merely asking whether the API is even accessible on a Meetings plan, with the answer not shown, tells you how thin the enterprise stack story is; the in-room apps like Miro and Trello are conveniences, not identity or deployment integration. 1 2 3

Report an error

The Educator

The Embedded product is the strong card: API and SDK tooling with programmatic room creation, which is genuinely embeddable. But there is no calendar integration for the major suites, no SSO, no SCIM, no webhooks and no self-hosted option in evidence — the FAQ even has to ask whether the API works on a Meetings plan at all — and the in-room apps (Drive, YouTube, Trello, Miro) are not the stack integration I mean. 1 2 3

Report an error

The Accessibility Advocate

There is a real documented API and SDK with programmatic room creation and embedding, plus in-room apps like Miro and Trello — stronger than a scheduling-only API. But no calendar integration, no SSO, no SCIM and no self-hosting option appears anywhere, so the wider stack is a dead end. 1 2 3

Report an error

The Skeptic

The Embedded product is a genuine documented API with SDK tooling, programmatic room creation and transcription — more than a checkbox API. But no calendar integration, no SSO/SCIM, no room-system support and no self-hosted or private-cloud option appears anywhere; the in-room integrations are Google Drive, YouTube, Trello and Miro, not identity or scheduling. Cloud-only with a good SDK sits between rubric level 3 and 5. 1 2 3

Report an error

The IT Administrator

Account information is hosted in Ireland, but Usage information is hosted in Ireland and the United States under SCCs, offices span Norway, the UK and the US, media relay routing is unstated, and subprocessors appear only as categories with not one named provider. A Norwegian entity and ISO 27001 help, but "European owned and privacy-first" is marketing until the chain is named and the US piece of the metadata flow is explained with more than a boilerplate clause. 1 3

Report an error

The Security Officer

Account data sits in Ireland, but usage information is hosted in Ireland AND the United States, covered only by SCCs, and the contracting entity is Norwegian — EEA, not EU. Media routing is unstated, subprocessors appear only as unnamed categories, and ownership is unknown: that is rubric level 3 almost verbatim. 3

Report an error

The Works Council Advocate

Account data sits in Ireland, the US transfer of usage information is at least named with SCCs, and the contracting entity is Norwegian EEA — but usage information is hosted in the United States, subprocessors appear only as anonymous categories with none named, media routing is unstated, and even the country code carries an inference caveat. "Built in Europe" does not substitute for a named subprocessor list and a media region. 1 3

Report an error

The Educator

Account data sits in Ireland, but usage information is explicitly hosted in Ireland AND the United States, with SCCs as the named safeguard; the contracting entity is Norwegian — EEA, not EU — and subprocessors appear only as categories, never named providers. The homepage's 'GDPR compliant, ISO 27001' posture is welcome, but media routing is unstated, so this stays at the residency-with-gaps tier. 1 3

Report an error

The Accessibility Advocate

A Norwegian (EEA) contracting entity with account data in Ireland and US transfers named under SCCs is a start. But usage information is hosted in the United States, where media and relays are processed is unstated, and subprocessors appear only as categories — never as names — so I cannot verify who carries the traffic. 3

Report an error

The Skeptic

Account data sits in Ireland, but Usage information is hosted in Ireland and the United States, the contracting entity is Norwegian — EEA, not EU — and group companies sit in the US and UK. Subprocessors appear only as categories with no named entities, and the evidence says nothing about where media is relayed; SCCs and 'built in Europe' are a safeguard and a slogan, not a processing map. I weigh this heavily, and the core question — where the media goes — goes unanswered. 1 3

Report an error

The IT Administrator

A public pricing page demonstrably exists with two products, per-user licensing for Meetings and usage-based billing for Embedded, and a comparison table — so it's not a pure sales conversation. But no per-host price, no capacity limits, no storage allowances, no minimum term and no VAT treatment made it into the evidence, so I cannot compute an annual invoice for a given host count from public pages as captured. 2

Report an error

The Security Officer

Public pricing pages exist with billing models stated — per-user license for Meetings, usage-based for Embedded — but the evidence contains not one figure: no per-host price, no capacity limits, no storage or dial-in terms, and a FAQ on API access whose answer isn't shown. A buyer cannot compute an invoice from this. 2 1

Report an error

The Works Council Advocate

The public pricing page offers links, a product comparison, and the words "Charged per user license" and "Charged by usage" — not one figure, billing period, participant cap, dial-in rate or storage allowance anywhere in the captured evidence. A buyer cannot begin to compute an annual invoice from public pages. 2

Report an error

The Educator

A public pricing page exists and names the two products with their billing models — per-user licence for Meetings, usage-based for Embedded. But the evidence captures not a single figure: no per-host price, no capacity limits, no storage allowance, no term or VAT — so no teacher or buyer can compute an annual invoice from this evidence. 2

Report an error

The Accessibility Advocate

A pricing page exists and names the models — per-user licensing for Meetings, usage-based for Embedded — with a comparison, but no actual price, capacity limit, storage allowance, term or VAT treatment appears. A buyer cannot compute an annual invoice from these pages; this sits between a sales conversation and a headline price. 2

Report an error

The Skeptic

The pricing page links exist and the models are stated — Meetings 'charged per user license', Embedded 'charged by usage' — but the evidence contains not one figure: no per-host price, no billing period, no participant caps, no storage allowance, no minimum term. A buyer cannot compute even a rough annual invoice from this evidence, which puts it below the per-host-headline anchor. 2

Report an error