Least privilege
ReadStamp is an admin-managed Zoom app. It never reads channel messages. The only text it sees is what people type into its own form and buttons. It requests the smallest set of scopes that make announcements, audiences and acknowledgments work:
- Team Chat bot (
imchat:bot): post cards to users and to channels the bot was added to, edit its own cards (the live counter), and receive slash commands and button clicks. - Users, read-only: names, email addresses and time zones of the people in your account, so audiences can be resolved, reminders arrive at a sensible local hour, and new hires receive open policies.
- Channel members, read-only: used only when an announcement is addressed to a channel, and to list the channels you can pick from.
What we store
- Your Zoom account id and the admin's OAuth tokens, encrypted at rest.
- Member names, emails, Zoom ids and time zones.
- Announcement titles and message text, every version with its SHA-256 content hash, and the document URL you linked. We do not store the documents themselves.
- Acknowledgments: who, when (UTC), the confirmation wording, the version hash. Document opens (time, IP, browser) when the open-before-acknowledge option is on. Reminders sent.
- A log of messages the bot sent, for troubleshooting.
Audit integrity
- Acknowledgment rows are append-only. Nothing in the product deletes them. An admin void sets a voided-at timestamp, records who and why, and is written to the announcement timeline.
- Each acknowledgment stores the hash of the exact content version confirmed, so a later edit can never be mistaken for what was agreed to.
- The PDF report carries its own SHA-256 report hash over the structured data, so two exports of unchanged data match and a tampered copy does not.
How it is protected
- Every request from Zoom is verified with an HMAC signature before it is processed.
- Tokens are encrypted with the application key; the chatbot token is refreshed hourly and never stored on disk.
- Traffic is TLS only, behind Cloudflare. Databases and queues are not reachable from the internet.
- Only dashboard users who signed in with your Zoom account can see your account's data. Per-recipient document links are random 40-character tokens that only redirect; they expose nothing.
Uninstall and deletion
When an admin uninstalls ReadStamp, Zoom sends a deauthorization event. We immediately revoke and delete the account's tokens and close open announcements. Acknowledgment records are kept so you can still export them for an audit. Email hi@staticmaker.com to have all remaining data deleted.
Reporting a vulnerability
Email hi@staticmaker.com. We acknowledge reports within one business day.