Six months into his role at Meridian Group, Xavier Thompson had developed a personal policy around meeting invites.
He read them carefully.
This was not always the case. In a previous life — before the password incident, before the ransomware call, before he learned to treat every piece of technology at Meridian as a potential plot twist — Xavier had accepted calendar invitations with the casual confidence of a person who assumed someone else had handled the details.
He no longer assumed that.
Which is how, on a Tuesday morning in December, while reviewing the invite for Meridian’s quarterly board meeting, he noticed something that made him set his coffee down and read the invite a second time.
The video conferencing link at the bottom of the agenda was a Google Meet URL.
That was not, on its face, alarming. Except that Meridian didn’t use Google Meet. Hadn’t for years. And when Xavier traced the link back to its origin, he discovered it had been created in the spring of 2021 by a former executive who had left the company fourteen months ago — whose Google account was, apparently, still active enough to generate a meeting link that kept getting copy-pasted into board agendas like a technological ghost haunting the quarterly calendar.
He sent a message to the Xpert team before the meeting even started.
“We need to talk about our communication setup.”
The Stack, Such As It Was
What Xpert found when they mapped Meridian’s communication and collaboration environment was less a technology stack and more a technology archaeological dig — layers of tools, accounts, and platforms accumulated over years, each representing a decision made at a specific moment in time by a specific person who was solving a specific problem without any consideration for what was already in use.
The inventory, in its entirety, was uncomfortable reading:
Video conferencing: Three active Zoom accounts — one corporate, two personal accounts belonging to employees who had started using their own licenses when the corporate account ran out of capacity during the pandemic and nobody had upgraded it. One Microsoft Teams environment, partially deployed, used inconsistently. One Google Meet link from 2021, apparently immortal. One Webex account that a client had set up for a project two years ago and that somehow still appeared as an option in the conference room booking system.
Messaging and collaboration: Microsoft Teams for some departments. Slack workspaces for two others — one set up by the marketing team, one by engineering, neither connected to the corporate Microsoft environment. A WhatsApp group used by the sales leadership team for “quick updates” that had quietly become a primary channel for deal discussions, client strategy, and occasionally sensitive pricing conversations.
File sharing: The corporate SharePoint environment. Google Drive links shared by employees who preferred it. A Dropbox account that finance had been using for vendor document exchange since 2019. And a shared Box folder set up for a client project that had since become an informal archive for documents nobody wanted to deal with migrating.
Board communications: The 2021 Google Meet link. An email thread. A shared OneDrive folder that three of the six board members could access and three could not, for reasons nobody fully understood.
Xavier read the inventory summary and was quiet for a long moment.
“How,” he said finally, “does anything get done?”
The Xpert team, professional as always, resisted the obvious answer.
The Board Member’s Question
The quarterly board meeting proceeded, 2021 Google Meet link and all. Xavier had made a judgment call — flagging the issue to Xpert was sufficient for now, and interrupting a board meeting to explain that the video link was technically a zombie from a former employee’s account was a conversation he preferred to have after the fact.
The meeting went smoothly until the final agenda item, when Eleanor — a board member with a background in financial services and a reputation for asking the questions other people had been avoiding — raised her hand.
“I want to ask about our communication security,” she said. “Specifically around how we’re handling confidential board discussions from a platform governance standpoint.”
The room was quiet in the particular way rooms go quiet when someone has asked the exact question that nobody had prepared an answer for.
Eleanor’s concern was specific and legitimate. In her previous board experience, she had seen a company face regulatory scrutiny after sensitive board-level communications were discovered to have occurred over personal, unmanaged messaging platforms — platforms with no archiving, no access controls, no audit trail, and terms of service that technically gave the platform operator broad rights to the content exchanged on them.
She was asking, in the most professional possible way, whether Meridian was doing the same thing.
Xavier answered honestly: he was in the process of addressing it. He had a partner working on it. He would have a full report before the next board meeting.
Eleanor nodded. “I’d appreciate that.”
It was not a threat. It was a board member doing her job. But Xavier drove back to the office that afternoon with the distinct awareness that “we’re working on it” had a shelf life, and it was measured in weeks, not months.
Why a Patchwork Communication Stack Is a Security Problem
The tools themselves weren’t the issue. Zoom, Teams, Slack, Google Meet — these are all legitimate, widely used platforms. The problem was the absence of governance around them: who had accounts, what those accounts could access, how conversations were stored, and what rights the platforms had over the content exchanged on them.
Xpert walked Xavier through four specific risks embedded in Meridian’s current communication environment:
Unmanaged personal accounts. When employees use personal accounts on corporate communication platforms, IT has no visibility into those conversations, no ability to enforce data handling policies, and no access to the content if it becomes relevant to a legal matter or compliance audit. The employee owns the account. The company does not.
Platform data practices. Several of the consumer-grade tools in Meridian’s stack had terms of service that were, to put it diplomatically, broad in their approach to user data. The WhatsApp conversations happening among the sales leadership team — discussing client pricing, deal strategy, competitive positioning — were occurring on a platform not designed or contracted for enterprise data security.
No archiving or audit trail. For a company with contractual obligations to clients, potential regulatory exposure, and a board that was now actively asking compliance questions, the absence of a unified, searchable, auditable communication archive was a material risk. If something ever needed to be produced — in a legal proceeding, a regulatory inquiry, or a client dispute — a significant portion of Meridian’s business communication existed in personal accounts, consumer apps, and a WhatsApp group that nobody had ever thought to preserve.
The ghost account problem. The 2021 Google Meet link was a symptom of a broader issue: former employee accounts and licenses persisting in the environment with no lifecycle management. Not just meeting links — email aliases, shared drive access, messaging platform memberships. People left Meridian and their digital presence didn’t always leave with them.
How Xpert Fixed It
The solution Xpert implemented wasn’t about eliminating choice or forcing Meridian’s employees into a single tool they didn’t want to use. It was about establishing a governed, secure foundation and making sure everything operated within it.
A consolidated communication platform. Xpert worked with Meridian’s leadership to standardize on Microsoft Teams as the primary platform for all internal communication, video conferencing, and collaboration — leveraging licenses Meridian was already paying for but underutilizing. The existing Slack workspaces were migrated into Teams channels. The personal Zoom accounts were replaced with properly licensed corporate accounts under IT management.
Enterprise data policies. Within the managed Teams environment, Xpert configured retention policies, archiving, and compliance recording for designated channels — including board communications. Eleanor’s audit trail concern was addressed directly: board-level conversations now occurred in a governed, archived, producible environment.
Consumer platform policy. The WhatsApp sales leadership group was retired in favor of a Teams channel with equivalent functionality and appropriate governance. The policy — no business-critical conversations on personal, unmanaged consumer platforms — was documented, communicated, and built into the acceptable use guidelines Xpert had been developing across the organization.
Ghost account remediation. As part of the broader offboarding work Xpert was developing in parallel, all communication platform accounts associated with former employees were reviewed, archived where necessary, and deactivated. The 2021 Google Meet link was, at last, laid to rest.
Xavier personally removed it from the board meeting template.
It felt more satisfying than it probably should have.
The Report Eleanor Asked For
Four weeks after the board meeting, Xavier presented a one-page communication governance summary to the board. Consolidated platform. Managed accounts. Archived board communications. Consumer platform policy in place.
Eleanor reviewed it, asked two clarifying questions, and nodded.
“This is what it should look like,” she said. “Well done.”
For Xavier, the moment mattered less as a board approval and more as a marker of how far Meridian had come in six months. A company that had been running a technology archaeological dig as its communication infrastructure now had a clean, governed, auditable environment.
Nobody had noticed the transition. The tools worked. The meetings happened. The sales team adjusted to Teams faster than anyone had expected, which said something about how willing people are to adopt new tools when the old ones aren’t actually serving them well.
The only thing that didn’t survive the migration was the Google Meet link.
Nobody mourned it.
The Question Worth Sitting With
Communication platforms feel personal. People develop preferences, habits, workflows built around specific tools. Governance conversations can feel like corporate overreach — IT telling people how to do their jobs.
But communication is where business happens. It’s where strategy gets discussed, deals get negotiated, client relationships get managed, and sensitive decisions get made. The platforms those conversations happen on are not neutral infrastructure. They have data practices, access policies, and terms of service that matter.
Do you know where your most sensitive business conversations are happening right now — and who else might have access to them?
It’s worth finding out before a board member asks.
Coming up in the next installment of The Xavier Chronicles: Xavier reviews the monthly technology spend and finds a cloud infrastructure bill that has tripled in three months. Nobody can explain why. The answer, it turns out, is hiding across six departments and a surprising number of forgotten test environments.
Meridian Group is a fictional company. Fragmented communication infrastructure — personal accounts, unmanaged platforms, and ungoverned messaging tools — is one of the most common and least visible compliance risks facing growing businesses today. Xpert Technologies helps growing companies in Metro Detroit build communication environments that are secure, governed, and built for the way business actually works.
Not sure what’s running inside your communication stack? Maybe it’s time to chat with an Xpert.
#UnifiedCommunications #CyberSecurity #Compliance #MicrosoftTeams #ITGovernance #MetroDetroit #XpertTechnologies