BotBouncer

Who it's for

IT/security lead or founder at 20-500 person firms (law, healthcare-adjacent, agencies) whose staff meet externals daily on Zoom/Meet; today they cope with waiting rooms, asking hosts to eyeball the participant list, and Workspace OAuth-app inventories that don't say which granted apps are recording bots.

The problem

Legal: privileged client, M&A, or PHI conversations get recorded into vendors with their own breach record (tl;dv's 180k exposed meetings hit HN this week); discovering your side was silently recorded by a counterparty's bot is a compliance/malpractice event, and no log exists of which meetings were recorded by whom.

How to build it

Google Workspace + Zoom OAuth app; read-only calendar scan; dashboard of bot attendance; Slack/email real-time alerts; admin allowlist policy; auto-decline of invites from ~50 known bot sender domains with a templated 'please don't record' notice; exportable weekly audit log.

How it makes money

Orgs pay a flat $300-500/month for real-time detection, auto-decline policy, and the audit log as a compliance line item cheaper than one leaked privileged call; free options (host vigilance, native recording banners, OAuth-app lists) don't identify third-party bots in real time across platforms.

Why it doesn't exist yet

Incumbents skip it because Zoom, Google, and Teams each monetize their OWN notetaker and have no incentive to police rivals' bots, and maintaining a cross-vendor bot-signature database is pure grind. The indie gap: a vendor-neutral census across the mixed Zoom+Meet reality of SMBs, with the signature DB as the core asset — and the tl;dv exposure just created the budget scare to sell it.

First users

A free retro-audit tool ('which bots sat in your last 90 days of meetings?') posted to HN/LinkedIn; every security-minded founder who runs it screenshots a surprisingly large number and shares it; the first 10 paying teams are the ones who reply 'can it stop the next one?'

Build size

2 people x 8 weeks. In: Google Calendar + Zoom integrations, signature DB of top ~50 notetaker bots, retro scan, Slack/email alerts, auto-decline policy, audit log. Out: Teams support, in-meeting ejection, any transcription or content analysis.

Biggest risk

Zoom or Google ships a native 'third-party recording bot detected / auto-block' toggle in meeting security settings, collapsing the cross-platform wedge into a built-in feature.

Conditions for a hit (all 3 required)

• Read-only calendar connect produces a list of past meetings attended by known notetaker bots (>=40 vendor signatures) within 10 minutes, naming vendor and owning email per meeting.
• When a known notetaker bot is invited to or joins a meeting, the host or admin receives a Slack or email alert within 60 seconds identifying the vendor and the inviting account.
• Admin can enable auto-decline so invites from known bot sender domains are declined automatically with a templated notice, and every detection and decision appears in an exportable audit log.

How it's judged (in 6 months)

A tool matching at least 2 of the 3 features reaches Product Hunt daily top 5, or an open-source repo matching them passes 1,000 GitHub stars(judgment date 2027-02-11)

AI self-confidence 50/100 — self-reported likelihood of meeting the criterion, not a business success rate