Security
This page is written in plain language. It is a draft that is being reviewed by a lawyer, and we will update it if anything changes as a result.
Encryption
All traffic uses HTTPS. Stored files are kept in encrypted cloud storage.
Account protection
Sign in happens on OfficeBats, with optional two factor authentication. Sessions end when you sign out everywhere or change your password.
Documents and sharing
- Every document request checks your role: owner, editor, commenter or viewer.
- Share links are long random tokens and can be turned off at any time.
- Comment and edit links require sign in.
Content safety
Slide and memo content, including AI output, is sanitized on the server and in the browser: no scripts, no event handlers, no external requests except our own media. Video embeds are limited to known providers and run in sandboxed frames.
Application security
Rate limits, cross site request checks, strict content security policy and security headers protect every page.
Report a vulnerability
Email [email protected]. We appreciate responsible disclosure and will respond quickly.