Loading digital workplace…
A virtual office holds conversations, recordings, attendance records and organisational structure. That is a serious amount of trust, so this page describes what we actually do — including where we are not finished yet.
TLS 1.3 for all application and API traffic, encrypted transport for every voice and video stream, and AES-256 encryption at rest for databases, object storage and backups.
Every workspace is logically isolated. Authorisation is enforced at the data layer on each request, so a query can only ever reach the workspace the caller belongs to.
OAuth and OIDC single sign-on, enterprise identity provider support, session revocation on deprovisioning, and role-based access control across every office, room and report.
Every administrative action writes an immutable audit entry — who did what, to which resource, from where and when — retained for the period your tier and policy define.
Security is mostly unglamorous discipline applied consistently. This is the list.
Every record that exists is a record that can leak, be subpoenaed, or be misused by a future manager with different values. The shortest path to protecting employees is not collecting the data in the first place.
The full detail is in the privacy policy.
Security pages have a habit of implying certifications that are still aspirational. Here is the honest status of each.
| Status | Commitment | What it means today |
|---|---|---|
| Status In place | CommitmentGDPR-aligned data handling | What it means todayData processing agreement available, sub-processor list published on request, data subject request workflow operating. |
| Status Enterprise | CommitmentRegional data residency | What it means todayWorkspace data stored and processed within a specified region for Enterprise customers. |
| Status Recurring | CommitmentIndependent penetration testing | What it means todayThird-party testing conducted on a recurring schedule, with summary reports available under NDA. |
| Status In progress | CommitmentSOC 2 Type II | What it means todayControls implemented and the observation window under way. Not yet certified — we will publish the report when it is issued. |
| Status Planned | CommitmentISO/IEC 27001 | What it means todayTargeted after SOC 2. Not yet started, and we would rather say so than imply otherwise. |
We welcome reports from security researchers and want the process to be easy, quick and safe for you.
Encryption, staff access, disclosure, incident response and hosting — answered without the marketing gloss.
Talk to the team that builds the office, or ask it from inside a live 3D walkthrough.
Access to customer content is restricted, requires a specific justified reason such as a support request you raised, is time-limited, and is logged. It is never used for analytics, product development or model training.
We operate a coordinated disclosure process today and reward significant findings case by case. A formal bounty programme is planned alongside SOC 2 completion.
Our incident response plan defines severity levels, an on-call escalation path and notification timelines. Affected customers are notified without undue delay, and within the timeframe applicable law requires, with the facts we have confirmed rather than a holding statement.
Self-hosting is not offered today. Enterprise customers with strict requirements typically use regional data residency, custom retention policies and a dedicated environment instead. Talk to us about what your review actually requires.
We will complete it and return our architecture overview, data handling documentation and current test summaries under NDA.