Every message, attachment and reaction is sealed on the sender's device for the exact set of recipients. What our servers store is opaque, and stays opaque during a breach, an audit or a legal request.
“The conversation belongs to the people in it.”
For teams discussing unreleased products, client work under nda, investigations, deals or anything that would be damaging if a transcript leaked.
A message key is generated locally and sealed to each participant's public key with X25519 — the server routes envelopes it cannot open.
Your device computes blind-index tags; the server matches opaque tags and your browser decrypts the matching messages.
Removing a member rotates keys for what comes next and records the change in an append-only audit log.
Files dropped into a channel are encrypted like everything else and land in the linked drive folder, not in a separate readable bucket.
Encrypted voice, video and screen sharing with join alerts, detached windows and true fullscreen.
There is no readable corpus to train on. The absence is architectural rather than a policy sentence we could quietly change.
Slack, Teams and most business messengers hold the keys to your workspace so they can index, preview, moderate and export it. That is also what makes workspace-wide discovery, third-party app access and compelled disclosure possible. The risk is not malice; it is capability.
Several products advertise end-to-end encryption for meetings while message history stays readable server-side. Transcripts are usually the most damaging artefact in a leak — they contain dates, names, decisions and links. Encrypting the history is the part that matters.
Append-only audit trails, membership history, retention and legal-hold style workflows operate on metadata your organisation controls, not on plaintext held by a vendor. You can prove who had access and when, without anyone having to read what was said.
No. Administration covers membership, billing and policy. Access to content requires a key envelope sealed to that person's device, which an admin role does not grant.
Yes, including across mail and files. Index terms are turned into blind indexes on your device, so the server matches opaque values without learning the words.
No. Everything is encrypted on the device before it leaves it, with XChaCha20-Poly1305, using keys derived locally with Argon2id and wrapped per member with X25519. Our servers hold ciphertext and sealed key envelopes, so there is no admin view, no support tool and no classifier that can reach your content.
No. There is nothing to self-host and nothing to configure: you create an account, invite people by email, and encryption happens transparently in the browser and apps. Zero-knowledge here is the default, not an expert mode.
Yes. The free plan includes 1 GB with exactly the same zero-knowledge architecture as paid plans, so you can validate the workflow before moving a studio onto it.
Removing a member revokes their access and rotates the remaining key envelopes, so their old copy of the key stops opening anything new. Every membership change is written to an append-only audit trail.
Because we cannot read your data, we cannot reset it for you. Each account creates a Recovery Kit — a printable PDF with a QR code — to keep offline. That is the same property that stops anyone else, including us, from reading your workspace.
Start free with 1 GB. Zero-knowledge encryption from the first upload — no admin override, no AI scanning, no plaintext on the server.
