Security

Your conversations stay yours.

A virtual office is where your team talks candidly. We designed it so the most sensitive part, your voice and video, never passes through our servers to be stored.

Encrypted calls

Voice, video and screen sharing use WebRTC, which encrypts every stream. They travel directly between the people in a conversation whenever the network allows.

No recording on our side

We never record calls. If you record a meeting, the file is saved on your own computer and never uploaded.

Chat that does not linger

Nearby and room chat are never stored. Direct messages and the office-wide chat are kept for 24 hours so they reach people, then deleted.

Secure sign-in

People sign in with Google or an email and password, handled by a dedicated sign-in provider. We never see or store their passwords.

Invite-only offices

Only email addresses an admin has invited can enter. Removing someone signs them out of the office immediately.

Separated companies

Each company's office, members and settings are stored separately. Nothing is shared between customers.

What we store

  • Your office layout: floors, furniture, rooms and their settings.
  • Your members: name, email address and role for each person invited.
  • Guest links: who created them and when they were used. The link itself is stored only as a one-way hash, so a copy of our data could not be used to get in.
  • Room PINs: stored only as salted scrypt hashes, never in readable form. Wrong guesses are rate-limited.
  • Direct messages: for 24 hours, then deleted.
  • Billing: handled by Lemon Squeezy, our merchant of record. We never see or store card numbers.

What we do not store

  • Audio, video or shared screens from your calls
  • Nearby and room chat
  • Recordings
  • A history of where people walked or who they spoke to

Access and permissions

Every office has an owner, who is always an admin. Admins invite and remove people, run the office builder, and manage the plan and billing. Members work in the office and can lock the room they are in. Guests, via one-time links, can walk around and talk, and nothing more.

Infrastructure

All traffic to the service uses HTTPS. Payments are handled by Lemon Squeezy, as merchant of record. Office data is backed up off-site every day.

Questions or a security report?

We are happy to answer security questionnaires and take reports of possible vulnerabilities seriously. Get in touch.