Skip to content
Security & permissions

One permission model, four tools, no leaks between them.

One permission model governs all four tools: chat, tasks, calendar and huddles. Grant a capability at workspace, group or single-channel level, layer per-member exceptions on top, and the board and calendar obey it automatically.

Chat
view · send · reply
Tasks
create · manage
Calendar
create · edit
Meetings
start · join
one model, four toolsworkspace → group → channel
Capability × scope

Pick a role. See exactly what it can do.

Roles are a starting point, not a cage — every cell below can be overridden for one person, in one channel.

capabilityworkspacegroupchannel
See channel & historyallowedallowedallowed
Send messagesallowedallowedallowed
Reply in threadsallowedallowedallowed
Create tasksallowedallowedallowed
Manage tasks & boardsby grantby grantallowed
Create & edit eventsby grantallowedallowed
Start huddlesallowedallowedallowed
Moderate & delete messagesdeniedby grantby grant
See members & activityallowedallowedallowed

A typical internal role: full participation, no moderation. Any single cell can be raised or lowered per member, per channel.

Platform hardening

The unglamorous parts, done properly.

Hardened auth

HttpOnly cookies, token rotation, safe OAuth linking, email or Google sign-in.

Content-inspected uploads

Magic-byte MIME verification and per-file size limits on every shared file.

Scoped private channels

Private channels use the same capability model as everything else — no parallel code path to get wrong.

Notification discipline

Direct interactions always notify; muted channels stay muted. No content in push payloads you have not consented to.

Ephemeral by design

Live call reactions are never stored, and huddle media is not recorded unless you ask us to build that for your instance.

Data portability

Export workspace content on the subscription; on a dedicated instance the data is already yours, in your storage.
Where your data lives

Shared cloud, private cloud, or entirely inside your network.

Most teams are fine on our multi-tenant cloud. Organisations that are not can have a single-tenant instance — managed by us in a region you pick, or deployed on your own servers where nothing transits our systems at all.

questioncloudmanagedon-prem
Data isolated from other customerslogicalyesyes
You choose the regionnoyesyours
Data never leaves your networknonoyes
We patch and monitoryesyesyou
Your SSO providersoonon requeston request
Security FAQ

What reviewers ask us first.

Need a questionnaire filled in, a DPA, or a penetration-test summary? Ask and we'll send what we have.

Contact security →

Authentication uses HttpOnly cookies with token rotation, so tokens are not readable by page scripts and a stolen token has a short useful life. OAuth linking is validated to prevent account-takeover through a second provider.

Bring the security review. We'll bring the documents.

Security docs go out before any sales call — and if the answer is "it has to run on our servers", that's a product we sell.