Spaces, threads, mentions and attachments — encrypted on the device, relayed by a server that cannot open them.
“Your conversations stop being someone else's readable data.”
For teams inside google workspace who need a confidential channel for client work, deals, personal data, incidents and anything under nda.
Threads, mentions, reactions and tasks, with each message sealed under a room key wrapped per member.
Files land in an encrypted drive with client-side previews and encrypted ZIP downloads, not in provider-readable storage.
Search tags are computed with HMAC on your device, so finding a message never requires a server-side plaintext index.
Passphrase-gated links carrying key material in the URL fragment, expiring within 24 hours at most, revocable at any time.
Peer-to-peer audio, video and screen sharing, so the confidential conversation does not move to a second product.
Departures are cryptographic events, not database flags.
Google Chat encrypts data in transit and at rest with provider-managed keys, and Workspace administration provides retention, investigation and export tooling. Those capabilities require content to be readable server-side, which is the definitional opposite of end-to-end encryption. It is a reasonable design for governed enterprise coordination, and the wrong design for conversations that must stay unreadable.
Conversations produce files. Encrypting the sentences while attachments land in a provider-readable drive protects very little. DRIVUNO keeps messages, attachments, drive, photos and mail under one key model derived on your device, so the confidential material never separates from its protection.
Create one channel per confidential workstream, bring across the history you actually need through the universal importer, and keep general coordination in Chat. Teams follow a boundary rule they can state in a sentence: if disclosure would harm a client, a case or a person, it lives in the encrypted workspace.
No. Content is encrypted on your device before upload. Account keys are derived locally with Argon2id, room and folder keys are wrapped per member with X25519, and payloads are sealed with XChaCha20-Poly1305. Our servers store ciphertext and wrapped keys.
Transit and at-rest encryption use keys held by the provider, which is why server-side search, previews, scanning and administrative export are possible. Client-side encryption removes the provider from the set of parties able to read content.
Provider-side full-text search over document contents, universal server-generated previews, content AI on your data, administrative content export, and password resets that recover data. Search runs on device-side blind indexes and recovery relies on a recovery kit you keep offline.
Removal revokes their sealed copy of the room or folder key and triggers rotation, so future content is sealed under a key they never held.
Public links carry key material in the URL fragment, which browsers never transmit to a server, are gated by a passphrase and expire within 24 hours at most. Links can be revoked earlier and view counts capped.
No, and most teams should not. Move the confidential surface first — client work, matters, deals, personal data, unreleased product — and keep general coordination where it is until the pilot proves out.
Start free with 1 GB. Zero-knowledge encryption from the first upload — no admin override, no AI scanning, no plaintext on the server.
