IT department guide

Sending this to a security team that cannot reach roomsum.com? Download it as a PDF. The file is generated from this page at every release and names the live address.

RoomSum for IT departments

RoomSum is a browser-based service for live training sessions: questions and polls from participants' phones, answers from a moderation panel, action plans, and course evaluations. Staff use it in a web browser and from a PowerPoint add-in; participants use the browser on their phones and never install anything. This page has what a security or IT team needs to let it through: the hosts it talks to, how its email is sent and authenticated, what the sign-in buttons ask for, and where data lives. Questions go to info@roomsum.com.

The short version

Web (HTTPS on port 443, plus WebSocket connections)
  roomsum.com
  *.roomsum.com
    each organization has its own subdomain;
    api.roomsum.com is the data service

Email (all sent through Postmark from one address)
  From   "RoomSum (via 10/10ths Development)" <roomsum@1010development.com>
  DKIM   signed as 1010development.com
  Bounce pm-bounces.1010development.com, so SPF aligns with the From address
  DMARC  p=quarantine at _dmarc.1010development.com

Sign-in buttons (only if your people use them)
  login.microsoftonline.com
    Microsoft Entra application "RoomSum",
    client ID 28ae5b3b-e439-4924-bbf0-97b2112bb67e
  accounts.google.com
    Google app "RoomSum", verified

Help chat (optional; the "Ask us" / "Help" button)
  drivestate.ai

Checkpoint Live (only if your organization connects DriveState)
  drivestate.ai
    the round on participants' phones, which asks for the microphone;
    the Room View on the projector, framed in RoomSum's own pages

Web access

  • roomsum.com serves the public pages, sign-in, and the documentation. Each organization works at its own subdomain, for example acme.roomsum.com, which is why the wildcard matters.
  • Participants open roomsum.com followed by a six-character session code, typed or scanned from a QR code. They need nothing beyond a browser.
  • api.roomsum.com is the data service, hosted by Supabase. Browsers and the PowerPoint add-in call it directly over HTTPS and hold a WebSocket connection to it for live updates.
  • roomsum.com/downloads hosts the PowerPoint add-in installer for presenters and the starter kit, behind a RoomSum sign-in. Participants never download anything.
  • Billing takes admins who pay by card to Stripe at checkout.stripe.com and billing.stripe.com. No one else sees those.
  • Google Analytics runs on the public pages only. Blocking it changes nothing in the application.
  • drivestate.ai provides the Ask us button on the public pages and the Help button on the staff sign-in and facilitator pages: a small script, and the chat behind it, run by DriveState. What a person types into that chat is sent to DriveState and answered from RoomSum's own documentation. Blocking the host removes the button and changes nothing else.
  • drivestate.ai also runs Checkpoint Live, for organizations that connect their own DriveState account. A round opens on participants' phones at drivestate.ai and is a short spoken conversation, so the phone's browser asks for the microphone. The Room View a class sees for the debrief is a drivestate.ai page framed inside RoomSum's pages and PowerPoint slides. Blocking the host blocks those rounds; nothing else in RoomSum depends on it. No participant list or email address is involved: each round reaches the phones already in the session.

roomsum.com was registered in August 2026. A web filter that blocks newly registered or uncategorized domains may block it on that basis alone until its category catches up; an explicit allow entry for roomsum.com and its subdomains is the fix.

Email

Every message comes from one address, through Postmark: roomsum@1010development.com, shown as "RoomSum (via 10/10ths Development)". 10/10ths Development makes RoomSum, and its domain has sent mail since 2011. RoomSum mail moves to a roomsum.com address once that newer domain has a sending history of its own. Messages never go out under your organization's name; the message names your organization inside instead.

Sign-in codes come from the same address. That message contains a six-digit code and no links, and the code expires after an hour, so a message held in quarantine for a day is useless even when released. Allowing the sender is what helps.

Every message is DKIM-signed for 1010development.com. The bounce address is pm-bounces.1010development.com, which points to Postmark, so SPF is checked there and aligns with the From address. DMARC for 1010development.com is published at quarantine. Links in RoomSum mail point only to roomsum.com and its subdomains and are never rewritten through a tracking domain. The only attachment RoomSum ever sends is a CSV of evaluation results, to the organization's own staff, when they ask for it.

If your mail filter holds RoomSum mail, allowing roomsum@1010development.com as a sender resolves it for everyone at once. Allow roomsum.com as a web destination too (see above): every link in the message goes there.

Sign-in and identity

RoomSum has no passwords. Staff sign in with a one-time code sent by email, with their Microsoft or Google work account, or with a passkey they add afterwards, which uses the device's own unlock through WebAuthn on roomsum.com.

Microsoft. RoomSum is a multi-tenant Microsoft Entra application named RoomSum, application (client) ID 28ae5b3b-e439-4924-bbf0-97b2112bb67e, publisher domain roomsum.com. It requests only the sign-in permissions openid, email, and profile, and receives the person's name and email address, nothing else: no directory, mail, or file access. If your tenant requires administrator consent for third-party applications, an administrator can approve RoomSum for the whole organization once. Microsoft shows RoomSum as a verified publisher, the blue badge on the consent screen.

Google. RoomSum is a verified Google application requesting only openid, email, and profile.

Sign-in with either provider matches the person to the address their organization registered in RoomSum; it creates no new access on its own.

The PowerPoint add-in signs in either with an emailed code or through the person's own browser, because PowerPoint's embedded browser cannot use a passkey and Google does not allow sign-in inside embedded browsers. Sign in with your browser opens roomsum.com/link in the default browser. The person signs in there by any method above, checks that the code on the page matches the one on their slide, and confirms. The add-in then exchanges a secret that never left PowerPoint for its own session. Nothing from the browser's session is copied to PowerPoint, a request expires after ten minutes, and each one works once. Allow the default browser to open roomsum.com from PowerPoint.

Participants never sign in. Opening a session link gives the phone an anonymous identity for that session; no name or email is collected. A participant who fills in an action plan gives an email address, and a name if they choose, so RoomSum can send them their own plan; the plan's content is private to them. Staff never see the name, and see the address only if an email to it bounces, so an admin can correct it.

Data

  • Data is hosted in the United States: the database and authentication with Supabase on AWS in Ohio, hosting with Vercel, email with Postmark, payments with Stripe. AI providers (Google, Anthropic, Groq, OpenAI) process submission text to group questions and never train on it.
  • DriveState runs the help chat described above. Separately, an organization that connects its own DriveState account can have draft answers suggested to its moderators; that exchange runs between RoomSum's servers and DriveState, never from a browser, and only for organizations that switch it on.
  • For Checkpoint Live, RoomSum gives DriveState only an opaque token for each phone, made from a random key on the device and never from a name or email address; which session and class a round belongs to; and, when a round opens, the session's name and reference, so DriveState's report can say which run it was. The conversation itself runs between the phone and DriveState. RoomSum receives back only counts of who has finished, and, for each phone, whether it has a conversation left in the open round, which only that phone is shown and RoomSum does not keep.
  • Every organization's data is isolated by database-enforced row-level security. Traffic is TLS everywhere.
  • Email delivery records (address, outcome, reason, kind of message) are kept for 90 days, then deleted.
  • The privacy policy and terms of service are the governing documents. Data deletion requests go to info@roomsum.com.

The PowerPoint add-in

Presenters run RoomSum from inside PowerPoint on Windows or Mac, or in PowerPoint for the web. The add-in loads its pages from roomsum.com/ppt and talks to the data service like a browser does, so it needs the same web access as above and nothing more. On Windows and Mac it installs from roomsum.com/downloads. On the Mac the installer is a signed and notarized app for Intel and Apple Silicon: it fetches the current add-ins from roomsum.com, opens PowerPoint's add-in folder in Finder, and the presenter drags one tile into it. macOS 27 lets no installer or script write in PowerPoint's folder, only the person at the Mac in Finder, so it needs no administrator password, and to deploy to many Macs the clean route is Microsoft 365's admin center (Integrated apps), which installs nothing on the Mac. The add-ins are standard Office add-ins defined by manifest files under roomsum.com/ppt; an organization that deploys Office add-ins centrally can use those manifests. Central deployment also reaches PowerPoint for the web, where the RS add-ins run; the next paragraph says which add-ins and how. When someone on staff opens the add-in signed in, RoomSum records which PowerPoint they are running (the application, the platform, and the version number) and which version of the add-in it loaded. It is used to support them when they report a problem, it replaces the previous reading rather than accumulating, and nothing else about the machine is collected.

PowerPoint for the web. There are five add-ins: RS Start, RS Question and RS Extra (RoomSum), and DS Check and DS Room (DriveState). The three RS add-ins run in PowerPoint for the web, in a browser with Microsoft 365. DS Check and DS Room do not yet: on the web they show a notice that says so, and they run in PowerPoint on a Mac or a Windows PC. The installers do not reach the web. An add-in is installed there by central deployment, as above, or by a person with Microsoft's Upload My Add-in and the add-in's manifest file. The manifest files are at https://roomsum.com/ppt/manifest-start.xml for RS Start, https://roomsum.com/ppt/manifest-question.xml for RS Question and https://roomsum.com/ppt/manifest-extra.xml for RS Extra. RS Results, RS Action and RS Eval were retired on 8 October 2026 (RS Question and RS Extra replace them), and their manifests are no longer offered, so an organization that deployed them centrally removes those three and deploys RS Extra in their place; re-running the Windows installer removes them, while on a Mac their manifest files (roomsum-manifest.xml, roomsum-manifest-action.xml, roomsum-manifest-eval.xml) stay in PowerPoint's wef folder until deleted, because the Mac installer can only add files. After any change to the deck in the web editor, PowerPoint for the web can move a slide show ahead on its own when it starts. Presenters are told to start the slideshow from the last slide and press Esc after their last edit, then present.