The security page for your IT person

• No calendar integration. No OAuth, no scopes, no access to any company's Microsoft or Google tenant — the product is built so this is impossible, not merely disabled. Calendar events flow one way, outward: an emailed invitation file and a personal read-only feed each member can subscribe to.
• No meeting subjects. The database has no column for what a meeting is about. Every booking is stored and shown as "Name's meeting". There is no confidential meeting data in the system because there is nowhere to put it.
• No passwords. Sign-in is by single-use email link (15-minute expiry). There is no password database to breach.
• No tracking cookies. One essential session cookie (HttpOnly, Secure, SameSite=Lax). No advertising, no fingerprinting, no consent banner needed. Product analytics are anonymous named events (counts of actions), never page-level tracking.
• No public signup. Members are added by your site's reception. Nobody can join by finding a URL. Visitors can be given a guest pass with an end date — it stops working on that day by itself, their sessions end and their future bookings are released.
• No domain lock, and no domain trust. Any email address can be invited, because access comes from being on your member list — never from what the address ends in. Being on one building's list grants nothing anywhere else.

Per member	Name, email address, role (member or admin), and — for a guest pass — the date it ends. That is the complete list of personal data.
Per room	Name, seat count, and an optional free-text list of what's in it (a TV size, a conference speaker). Set by your admin; no device is ever connected to.
Per booking	Room, start, end, who booked it, check-in time, and — if reception cancels a booking — an optional one-line note from reception explaining why. No subject, no attendees, no description.
Waiting list	If someone asks to be contacted about Colega, we keep the name, email, building name, room count, location and any note they wrote — until they ask us to delete it. Separate from member data; it grants access to nothing.
Never	Meeting subjects or content, calendar contents, passwords, payment card data (billing is invoiced), phone numbers, IP-based location profiles.

• Hosting: Cloudflare Workers and Cloudflare D1. The database is pinned to the EU — created with a jurisdiction constraint on where it may run and store data, which can only be set at creation and so can't be quietly changed later. Read replication is switched off, so there are no copies of it in other regions. Served over TLS, HSTS enforced.
• Sub-processors: Cloudflare (hosting & database), Resend (transactional email), PostHog EU (anonymous product analytics, EU region).
• Access: per-site data isolation — every record is scoped to your site; sessions are revoked instantly when reception deactivates a member or a guest pass reaches its end date.
• Sign-in: a single-use link, valid 15 minutes. If one address belongs to more than one building, the email offers a separate link per building — Colega never guesses which one you meant, and the sign-in form is never told where you're a member.

Ask and you receive: a full export of your site's members, rooms and bookings (CSV), or complete deletion of the site and every record in it, within 30 days of the request — normally same-week. No lock-in, no retention games. Email privacy at meetcolega dot com.