PM from MS here. Authentication and authorization is managed by a cloud service but your code is not persisted in the cloud. The service optimizes for the most high perf connection possible via an encrypted channel with the cloud being one option. We intend to allow customers to lock down their invite links as well as they so choose.