Video calls have gone from being an occasional thing to becoming a basic tool for working, studying and maintaining personal contactCompany meetings, online classes, medical appointments, interviews, or family get-togethers… everything is now done via video call. This reliance has a downside: any security breach or oversight in the settings can expose personal data, professional secrets, or images we'd rather not share.
At the same time, cybercriminals have seen in this boom an opportunity opportunity to steal information, spy on conversations, or sneak into private meetingsAttacks like Zoombombing, vulnerabilities in popular platforms, and the use of malware to control cameras and microphones have shown that simply "opening the room" isn't enough. You need to dedicate a few minutes to properly configuring privacy and security settings to ensure video calls are truly effective and secure.
Common risks and threats in video calls
Before we get into specific adjustments, it's important to understand What are the main privacy and security risks? when we use videoconferencing tools. Only then does everything we configure afterwards make sense.
One of the most talked-about problems has been the intrusion of uninvited people into private meetingsThis is what's become known as Zoombombing: someone gets the link or guesses the access code and logs in to insult others, display offensive content, or simply eavesdrop undetected. This phenomenon isn't limited to Zoom; cases have also been seen on Skype, Webex, and other platforms. To reduce risks, consult [website/link/etc.]. Zoom and Google Meet tips and tricks.
Another important threat is lack of end-to-end encryption or poorly implemented encryptionIf communications are not end-to-end encrypted, there is a possibility that a third party, the platform itself, or an attacker on the network could intercept and read audio, video, or chat. Reports such as the NSA's on videoconferencing tools make it clear that virtually no service is perfect and that all have some weakness.
We must add the risks derived from data storage and processingMany applications store recordings, chat histories, attendee lists, or even shared files. If these retention policies are unclear, if regulations like GDPR are not met, or if we don't control where the recordings are stored, we can end up with sensitive information lost.
Finally, there is the classic attack vector: the Malware that sneaks in by posing as a legitimate video calling appDuring peak demand, countless fake websites and downloads appeared that, instead of installing Zoom, Meet, or similar software, installed spyware, Trojans, or tools to take control of the device.
Criteria for choosing a secure video calling platform
The first critical decision is not how we configure the tool, but Which application should we choose to make video calls?Not all of them offer the same level of security or the same transparency in the use of data.
A key criterion is that the service offers true end-to-end encryption (E2EE) Or at least robust encryption in transit. This means that the communication can only be read or viewed by the people participating in the call, and not even the provider can decrypt it. Apps like Signal, WhatsApp, FaceTime, Google Duo, and some versions of Webex and GoToMeeting offer this type of protection or enhanced versions.
It is also important that the platform allows the use of Multi-factor authentication (MFA or 2FA) to access the accountThus, even if someone steals or guesses the password, they won't be able to log in without that second factor (SMS code, authenticator app, physical key, etc.). Some popular solutions, such as certain GoToMeeting plans, didn't offer this option for a while, making them more vulnerable to brute-force attacks or credential theft.
Another aspect to review is the privacy policy and compliance with data protection regulationsWe should check if the company complies with GDPR in Europe, CCPA in California, or other laws, and exactly what data it collects: whether it shares information with third parties, how long it keeps recordings, whether we can delete our history, and how deletion requests are handled.
Finally, it is worth considering whether the Is the software open source or proprietary?Being open source doesn't automatically make a tool secure, but it allows the community to audit the code, detect bugs, and verify that it does what it promises. Signal and Jitsi, for example, benefit from this transparency, while completely closed services require users to rely solely on the provider's word.
Free plans vs. business plans: impact on security
Once a solution has been chosen, another question arises: Is the free version sufficient, or is it worth investing in a business plan? From a security and privacy standpoint, in many cases the switch to the paid plan is more than justified.
Basic plans usually limit or even disable some advanced control and protection functionsFor example, they may not allow for managing policies at the organizational level, centrally logging access, or applying default security settings to all users. In a company, school, or institution, this can result in a chaotic mess of insecure settings spread across hundreds of accounts.
With a business license, on the other hand, it is more common to have corporate authentication options, recording control, strong encryption, and specialized technical supportIn addition, stricter contractual guarantees regarding data processing, regular audits, and service level agreements (SLAs) covering security incidents are usually included.
If the intended use is professional or involves sensitive topics, personal data, or confidential information (for example, meetings with clients, sessions with minors, health or strategic information), the general recommendation is clear: avoid relying on free accounts without support or guarantees, however tempting the savings may be.
Best practices before organizing a video call
Meeting security begins long before you press the "Join" button. It's advisable to adopt a series of preliminary measures to minimize the possibility of intrusions or leaks.
The first is Always download apps from official sources.The developer's website, Google Play, the App Store, or other reputable repositories. Avoid downloads from links received via email, messaging apps, or social media, as well as piracy sites or portals filled with suspicious installers and aggressive advertising.
Next, it is essential to maintain the videoconferencing software updated to the latest versionVulnerabilities that are discovered are patched; if these patches aren't applied, we leave the door open to attacks that are already publicly known. Ideally, you should enable automatic updates or, at least, receive alerts for new versions.
It is also advisable to create a robust account for video call serviceUse a long, unique password that combines uppercase letters, lowercase letters, numbers, and symbols. Never reuse passwords from other services, and enabling two-step verification is highly recommended if available. A password manager helps maintain this level of security without driving yourself crazy trying to remember impossible passwords.
Finally, before the first meeting, it's worth calmly reviewing the Initial platform privacy and security settingsMany important options are disabled by default or hidden among dozens of settings. Taking half an hour to properly configure everything will save you a lot of trouble later on.
Configure meeting access: ID, links, and passwords
One of the most delicate points is how access to the room is granted. A poorly managed link or a code recycled too many times can open the door to unwanted guests. The idea is that Only those who have actually been invited should enter..
The first measure is Protect the meeting with a strong passwordAlthough many tools already do this automatically, it's worth checking and, if necessary, customizing the password to ensure it's not trivial. Never leave meetings open without a password, especially if the link could end up being published or forwarded outside the intended group.
It is also recommended Use unique access codes, PINs, or links for each meetingInstead of always reusing the same personal room or the same identifier. The more you use the same ID, the more likely it is that it will circulate via email, screenshots, or social media, and end up in the hands of unauthorized people.
In particularly sensitive meetings, one can go a step further and Combine one-time passwords with additional authenticationso that simply having the link isn't enough. This prevents someone from joining simply by testing URLs or stealing an invitation.
Finally, it is essential to be careful with where and how do we share the call for applicationsIdeally, invitations should be sent directly from the platform to specific individuals, avoiding mass mailing lists, general groups, or open social media posts. If possible, email alerts should also be set up to detect any suspicious invitation forwarding.
Participant control: waiting rooms, blocking, and roles
Once the meeting is created, there are several functions designed to verify who enters, who stays, and what each person can do inside the roomUsing them properly makes the difference between a peaceful video call and a chaotic mess full of intruders.
The most useful one is the waiting roomWhen enabled, invited guests don't enter the video call directly, but instead remain in a virtual "waiting room." The host (or a designated co-host) can view the list, check names, and manually admit only those who are appropriate. If someone appears using a generic or suspicious identifier, access can be denied.
It is very practical in meetings with many people or from several organizations. designate one or more people in charge of managementThey admit attendees from the waiting room, mute microphones if necessary, remove those who interrupt, control who shares their screen, etc. This moderation role lightens the speaker's load and maintains order.
Another interesting feature is the option to lock the meeting once all authorized people have enteredFrom that point on, even if someone has the link and password, they won't be able to join. If someone's connection drops, you can always temporarily unblock them to let them in and then block them again later.
Finally, it is worth reviewing the participant panel and entry and exit notificationsIf the tool allows it, it's a good idea to activate sounds or notifications when someone joins, and ask new people to identify themselves at the beginning. This helps detect "ghost" attendees with generic or unusual names in time.
Audio, video, and image background management
Beyond who enters, we also need to take care What can be seen and heard during the meetingAudio and video can leak personal or corporate information without us realizing it.
One basic measure is that, by default, the attendees Enter with your microphone and camera turned off.This prevents background conversations from being overheard or unwanted views being displayed as soon as someone connects. The host can allow them to be activated when needed, or request that they only be used while speaking.
It's also important to be selective with the camera useIf it's not essential, participating with audio only is perfectly fine; besides reducing the exposure of your surroundings, it saves bandwidth. When using video, it's a good idea to check what appears in the background: photos of family members, visible documents, screens with sensitive information, identifiable locations, etc. Many applications allow you to blur the background or use virtual backgrounds precisely to avoid these kinds of leaks.
Regarding audio, it's always preferable when you're not speaking. Keep the microphone muted.This prevents accidental recordings of private conversations and improves the overall quality of the meeting. Special attention should be paid to wireless microphones, as they can continue to pick up sound even if the person moves away from the camera.
Outside of meetings, it is highly recommended Completely close the video calling application and physically block the camera Cover it with a tab or adhesive strip when not in use. This reduces the impact if a vulnerability or malware attempts to secretly activate the webcam or microphone.
Screen sharing, file sharing, and chat: how to prevent information leaks
One of the most delicate aspects of any video call is the screen sharing and file sharingThese are very useful functions, but if poorly managed they can become a constant source of leaks.
As a general rule, it shouldn't be The screen sharing option is enabled by default for everyone.Ideally, only the host, and perhaps specific individuals if necessary, should be able to share their desktop. This prevents intruders or anyone who mistakenly shares inappropriate or confidential content with the entire group.
Before sharing, it's key prepare the screen that will be displayedThis means closing sensitive documents, private chats, emails with personal data, or browser tabs containing financial information, credentials, corporate intranet access, etc. Whenever possible, it's best to share only a specific window or application rather than the entire desktop.
Something similar happens with files: exchanging documents within the tool may seem convenient, but you have to Limit it to the essentials and deactivate it if it is not neededIn meetings with people outside the organization, it is preferable to use controlled channels (secure platforms, encrypted corporate email, official repositories) instead of sending files through the meeting's own chat.
It should also be considered that, in some services, the Chat history is downloaded along with the meeting minutes or recordsand can even include private conversations between participants. That's why it's important to understand how each platform works and avoid assuming that direct messages are always isolated.
Recording, storage and processing of data
Recording a session can be very practical for taking notes later, sharing it with those who couldn't attend, or justifying attendance. However, it also implies a processing of sensitive personal data that must be handled with care.
The first step is to decide if recording is really necessary. The golden rule is clear: If it's not necessary, it's best not to record.Every minute of stored video is an additional responsibility, especially if it involves personal data, health information, sensitive work-related issues, or any confidential matter.
If it's going to be recorded, it's mandatory. clearly inform all attendees Explain the purpose of the recording, who will have access to it, and how long it will be kept. Many platforms display an automatic notification when recording begins, but it's always a good idea to reiterate this verbally at the start of the meeting.
From a technical point of view, the recordings must Store them in secure locations and, if possible, encrypt them with robust algorithms and strong passwords.It's advisable to avoid leaving unprotected copies in the provider's cloud if you're not familiar with their access and deletion policies. If recordings are stored on external servers, you must verify that the service complies with applicable data protection regulations.
Furthermore, it is good practice Delete recordings as soon as they are no longer neededKeeping files indefinitely only increases the risk of them being compromised in a security breach. In organizations, the ideal is to define and document a clear policy for secure retention and deletion.
Privacy, app permissions, and device management
Beyond the meeting itself, the video call application can access a lot of information if we don't carefully monitor permissions and privacy settings. It's worth reviewing them closely. what data are we giving away and with what justification?.
On mobile phones and tablets, apps usually request access to the camera and microphone, which makes sense for them to function. But they often also try to accessing contacts, files, location, or other data that is not essentialIt's recommended to go into the system settings (Android, iOS, etc.) and restrict permissions to the minimum necessary for each application. For more information on how to protect data in Windows environments and apps, see our guide on privacy in messaging and data.
In some services, you can choose whether other people can Find us using your phone number or email addressDisabling this option helps prevent former contacts, strangers, or even potential stalkers from easily locating you on platforms like Skype, FaceTime, or Google Duo.
There are also "convenience" features that, upon closer inspection, can be intrusive. For example, Google Duo has the Knock Knock option, which Show the other person our live video feed before they answer the callIf this idea makes you uncomfortable, you can disable it in the app settings to avoid surprises.
On computers, a quick look at the operating system's privacy settings allows control which applications have access to the camera, microphone, and screenIf any suspicious or unused tool is detected, it is best to revoke its permissions or uninstall it completely.
Special recommendations for businesses, educational institutions, and sensitive meetings
When video calls are used in professional, educational, or administrative settings, the bar for security and privacy must be raised considerably. Here, we're no longer just talking about inconvenience, but about... real risks of security breaches, loss of trade secrets, or exposure of personal data of many people.
In organizations, the first thing is to have clear and known policies on which tools are authorized and how they should be configured. It's not a good idea to allow each employee or teacher to use whichever platform they want without coordination: this increases the attack surface and makes regulatory compliance more difficult.
For meetings with very sensitive topics (for example, health data, financial information, disciplinary proceedings, or matters of high political sensitivity), the most prudent thing to do is to use only videoconferencing services approved by the IT and security area, with end-to-end encryption, unique passwords for each attendee and strict access controls.
In these cases, it is also advisable limit functionalities to the bare minimum: disable chat if not needed, prohibit file sharing through the platform itself, allow screen sharing only to the host, lock the meeting after identifying everyone, and actively monitor the attendees panel to detect generic or strange names.
If recordings are made, they should always be encrypted, protected with strong passwords, and stored on controlled corporate systemsnot in the provider's public cloud without oversight. Furthermore, it is essential to define who can access these recordings, for how long, and for what purposes, deleting them when they are no longer needed.
Additional tips for individual users
Although many of the above recommendations also apply on a personal level, there are a few Specific tips for those who use video calls in their daily liveswhether it's to talk to friends, family, or participate in online activities.
First of all, you have to Be wary of calls and contact requests from people you don't know.Some criminals use social engineering techniques to gain trust, obtain personal data, or get compromising screenshots that they then use for extortion. For those who need additional guidance on how to protect vulnerable groups, see resources for prevent online risks and scams.
It's also key to be prudent with What is said and shown during an informal video callEven if it seems like a friendly conversation, it's possible that it's being recorded without your knowledge or that someone is taking screenshots without your understanding. It's best to avoid giving out information such as full addresses, ID numbers, bank details, or information about minors.
Regarding the connection, it is recommended Avoid, as far as possible, the use of public Wi-Fi networks for important meetingsThese open access points often lack protection, making it easy for an attacker on the same network to intercept communications, steal credentials, or inject malware. If you need to check who is on your network, Discover how many devices are on your Wi-Fi network.
Finally, it is advisable not to lend your phone or computer to people you do not fully trust. With physical access to the device, it is relatively easy to install spyware or configure remote control tools. that then allow them to monitor our calls without us noticing.
Adopting all these privacy and security settings may seem daunting at first, but it really just comes down to integrating some basic habits: choosing the right platform, keeping it updated, protecting access with strong passwords and additional authentication, controlling who enters each meeting, limiting what is shared (screen, files, background, personal data), monitoring recordings, and reviewing app permissions. With these precautions, video calls become a much more reliable space for working, studying, or simply talking with loved ones, minimizing the chances of a third party turning a simple online meeting into a serious security or privacy issue.
