This page lists what the product does, not what we intend to do. Every item maps to a mechanism already in the code, and none of them depends on someone remembering to apply it.
Each organization is isolated by Row Level Security inside PostgreSQL itself, not by a filter in application code, so a forgotten `WHERE` leaks nothing. The app connects as a database user that cannot bypass the policy and does not own the tables. On startup, the service TRIES to read another organization’s data: if it succeeds, it refuses to start.
Meetings run on a media engine Quathos wrote, on our own machine, talking straight to your browser. There is no Zoom, Twilio or SFU vendor in the path, and our own API never sees an audio or video packet.
Meeting codes and invitation reply links exist in the database only as hashes, so a database leak hands access to no one. Every link expires, and the host can rotate it at any time: the old address stops working immediately.
Sign-in goes through Quathos Account, with OIDC and PKCE. There is no Room password to leak: local registration answers 403. When a session ends at the hub, it ends here too, without waiting for a token to expire.
The lobby is on by default. Without admission there is no media negotiation: a leaked link stops at the door, the host decides who comes through and can remove anyone at any time.
Who joined, who admitted, who was removed, who invited: it all goes to a hash-chained trail the database refuses to alter or delete, not by convention but by trigger and privilege. A tampered record breaks the chain and shows.
Invitations, reminders and confirmations go out with open and click tracking OFF, always and explicitly. The links we send are credentials; routing them through a metrics redirector would hand them to a middleman to count clicks we do not care about.
Messages, files and meetings export as a ZIP with a hash manifest, on any plan, including the free one. Closing the organization really deletes everything, and the export window is in the contract, not in our goodwill.
We do not have SOC 2, ISO 27001 or an external audit, and claiming otherwise on a security page would be the first reason not to trust the rest of it. End-to-end encryption is planned and not shipped. If your vendor review requires any of these, talk to us before you start.