Security & trust
A virtual office holds conversations, recordings, attendance records and organisational structure. That is a serious amount of trust, so this page describes what we actually do — including where we are not finished yet.
Encryption everywhere
TLS 1.3 for all application and API traffic, encrypted transport for every voice and video stream, and AES-256 encryption at rest for databases, object storage and backups.
Tenant isolation
Every workspace is logically isolated. Authorisation is enforced at the data layer on each request, so a query can only ever reach the workspace the caller belongs to.
Identity and access
OAuth and OIDC single sign-on, enterprise identity provider support, session revocation on deprovisioning, and role-based access control across every office, room and report.
Auditability
Every administrative action writes an immutable audit entry — who did what, to which resource, from where and when — retained for the period your tier and policy define.
What that means in operation
Security is mostly unglamorous discipline applied consistently. This is the list.
Platform
- Infrastructure runs in hardened, containerised environments with no direct production shell access by default
- Secrets held in a managed secrets service, never in source control or client applications
- Automated dependency and container image scanning on every build
- Infrastructure changes go through peer-reviewed, version-controlled pipelines
- Encrypted, regularly restored backups with defined recovery point and recovery time objectives
Application
- Authorisation checks enforced server-side on every request, never in the client
- Media tokens are short-lived, room-scoped and issued only after authorisation
- Rate limiting and abuse protection on authentication and API endpoints
- Input validation and output encoding across API and realtime surfaces
- Content security headers and strict transport security on all web responses
People and process
- Least-privilege access to production, reviewed on a recurring basis
- Mandatory multi-factor authentication for all staff systems
- Background checks and confidentiality obligations for personnel with data access
- Security training at onboarding and annually thereafter
- Documented incident response plan with defined severity levels and notification timelines
Customer controls
- Configurable retention windows per data type, including messages, recordings and transcripts
- Workspace-wide ability to disable meeting recording entirely
- Per-zone privacy settings and locked rooms with hard audio boundaries
- One-action deprovisioning that revokes floor access, sessions and integration tokens
- Self-service export of workspace data at any time
The most important security control is the data we chose not to collect
Every record that exists is a record that can leak, be subpoenaed, or be misused by a future manager with different values. The shortest path to protecting employees is not collecting the data in the first place.
- No keystroke logging
- No screenshot or webcam capture
- No application or website usage tracking
- No individual productivity scores or rankings
- No recording without an explicit host action and a visible indicator
- No customer content used for model training
- No sale of personal data, ever
The full detail is in the privacy policy.
Where we stand, stated plainly
Security pages have a habit of implying certifications that are still aspirational. Here is the honest status of each.
- In placeGDPR-aligned data handlingData processing agreement available, sub-processor list published on request, data subject request workflow operating.
- EnterpriseRegional data residencyWorkspace data stored and processed within a specified region for Enterprise customers.
- RecurringIndependent penetration testingThird-party testing conducted on a recurring schedule, with summary reports available under NDA.
- In progressSOC 2 Type IIControls implemented and the observation window under way. Not yet certified — we will publish the report when it is issued.
- PlannedISO/IEC 27001Targeted after SOC 2. Not yet started, and we would rather say so than imply otherwise.
Found something? Tell us and we will act on it
We welcome reports from security researchers and will not pursue legal action against good-faith research conducted under this policy.
How to report
- 1Email us with steps to reproduce, the impact you believe it has, and any proof-of-concept material.
- 2We acknowledge within two business days and give you a severity assessment and a target timeline.
- 3Test only against your own workspace. Do not access other customers' data, degrade the service or run automated scans against production.
- 4Give us reasonable time to remediate before public disclosure. We will credit you when the fix ships, if you would like us to.