Fathom Security Basics

---
name: fathom-security-basics
description: 'Secure Fathom API keys and handle meeting data privacy.

  Trigger with phrases like "fathom security", "fathom api key safety", "fathom privacy".

  '
allowed-tools: Read, Write, Edit, Grep
version: 1.6.0
license: MIT
author: Jeremy Longshore <jeremy@intentsolutions.io>
tags:
- saas
- meeting-intelligence
- ai-notes
- fathom
compatibility: Designed for Claude Code
---
# Fathom Security Basics

## Prerequisites

- A current recording/data classification, consent policy, scoped identity/secrets, and incident owner.

## Instructions

1. Apply least-privilege roles and approved recording/transcript access settings.
2. Keep credentials in the secret manager and meeting content out of logs and test fixtures.
3. Validate integrations and sharing controls with synthetic records before broad rollout.
4. Revoke access and follow the incident process on suspected exposure.

## Output

- A controlled Fathom deployment with data/consent safeguards, scoped credentials, access review, and incident path.

## Examples

Verify a development role can access only its synthetic meeting record and cannot retrieve production content, then record the redacted result and review date. If a token, recording, transcript, or participant data is exposed, contain/revoke first and follow the data incident process.

## Overview

Fathom records and transcribes meetings, producing transcripts and action items that contain participant PII (names, emails, spoken content), confidential business decisions, and potentially sensitive negotiations. API keys are per-user and grant access to all meetings the user recorded or that were shared to their team. Protect recording consent workflows, transcript storage, and any analytics pipeline touching meeting content.

## API Key Management

```typescript
function createFathomClient(): { apiKey: string; baseUrl: string } {
  const apiKey = process.env.FATHOM_API_KEY;
  if (!apiKey) {
    throw new Error("Missing FATHOM_API_KEY — store in secrets manager, never in code");
  }
  // Fathom keys are per-user — never share across team members
  console.log("Fathom client initialized (key hash:", apiKey.slice(-4), ")");
  return { apiKey, baseUrl: "https://api.fathom.video/v1" };
}
```

## Webhook Signature Verification

```typescript
import crypto from "crypto";
import { Request, Response, NextFunction } from "express";

function verifyFathomWebhook(req: Request, res: Response, next: NextFunction): void {
  const signature = req.headers["x-fathom-signature"] as string;
  const secret = process.env.FATHOM_WEBHOOK_SECRET!;
  const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex");
  if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    res.status(401).send("Invalid signature");
    return;
  }
  next();
}
```

## Input Validation

```typescript
import { z } from "zod";

const MeetingQuerySchema = z.object({
  meeting_id: z.string().uuid(),
  include_transcript: z.boolean().default(false),
  date_from: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
  date_to: z.string().regex(/^\d{4}-\d{2}-\d{2}$/).optional(),
  participant_email: z.string().email().optional(),
});

function validateMeetingQuery(data: unknown) {
  return MeetingQuerySchema.parse(data);
}
```

## Data Protection

```typescript
const FATHOM_PII_FIELDS = ["participant_email", "participant_name", "phone_number", "transcript_text"];

function redactFathomLog(record: Record<string, unknown>): Record<string, unknown> {
  const redacted = { ...record };
  for (const field of FATHOM_PII_FIELDS) {
    if (field in redacted) redacted[field] = "[REDACTED]";
  }
  // Also scrub emails from transcript snippets
  if (typeof redacted.summary === "string") {
    redacted.summary = (redacted.summary as string).replace(/[\w.+-]+@[\w-]+\.[\w.-]+/g, "[REDACTED_EMAIL]");
  }
  return redacted;
}
```

## Security Checklist

- [ ] API key stored in secrets manager, never in code
- [ ] Meeting recordings and transcripts encrypted at rest
- [ ] PII redacted in non-production environments
- [ ] Webhook endpoints use HTTPS with signature verification
- [ ] Access logs track per-user API key usage
- [ ] Recording consent verified before processing transcripts
- [ ] Transcript data retention policy enforced
- [ ] Action items containing confidential terms scrubbed before export

## Error Handling

| Vulnerability | Risk | Mitigation |
|---|---|---|
| Leaked API key | Access to all user meetings and transcripts | Secrets manager + key regeneration |
| Unredacted transcripts in logs | Participant PII exposure | Field-level redaction pipeline |
| Missing recording consent | Legal liability under two-party consent laws | Consent verification before processing |
| Unencrypted transcript storage | Bulk meeting data breach | Encryption at rest + access controls |
| Overly broad meeting sharing | Confidential content exposed to wrong teams | Per-meeting permission scoping |

## Resources

- [Fathom API Documentation](https://fathom.video)
- [OWASP API Security Top 10](https://owasp.org/www-project-api-security/)

## Next Steps

See `fathom-prod-checklist`.