No one in the middle sees unencrypted video. Two-party is fully end-to-end encrypted. We avoid overusing that overloaded phrase for multiparty and we're working on defenses against active (zoom bomb) attacks, that do not require a login. So any face scanner on a multiparty call would have to be someone the host invited who is doing face scanning at their endpoint where the cryptographic session terminates and video gets decrypted.
I didn’t describe the active threat correctly — not zoom bombing (auth system saves day), MitM from us or 8x8. We are closing off this attack surface in a followup release.
Apple whiffed it with NeuralHash, didn't they? Hard problem.
We don't host content. For Brave Search, we have been using a neat trick: not serving pages that Google doesn't index (we can cheaply test in our service with no privacy loss), but as we scale up, we are looking at top vendors who can help filter.
