Private messages stay private
Direct messages and private groups are visible only to their members. Company admins can't read them.
Security and privacy
Your office,
Your office,
your conversations.
How Collabiro protects your account, your team's data and your private conversations.
Principles
Private by default
Encrypted in transit
The app, API and live updates use HTTPS and secure WebSockets. Audio and video use WebRTC, which encrypts media in transit.
Separate companies
Each company's people, rooms, messages and files are kept apart from every other company.
Controls
What you and your admins control
| Area | How it works |
|---|---|
| Roles | Owners, admins and members. Admins manage people, rooms, floors and settings, not private conversations. |
| Joining | Invite links, or automatic joining for people with your company's email domain. Public sign-up can stay off. |
| Guests | Guest links open a single room. Guests have a visible Guest badge, and admins can turn guest links off for the whole company. |
| Passwords | At least 8 characters with upper case, lower case and a number. Change your password from your account page. |
| Sessions | Stay signed in with refresh tokens that rotate on every use. Sign out of every device at once from your account page. |
| Do not disturb | Knocks are turned away while you're in Do not disturb, and you choose which notifications you get. |
| API and MCP access | Tokens and API keys are scoped to a company, can be limited to specific tools, and can be revoked at any time. |
Your account
You're in charge of your sign-ins
Your account page shows your profile and security settings in one place.
- Change your password
- Sign out of all devices if a laptop goes missing
- Create and revoke personal MCP tokens
- Control your notifications
Questions about security?
Create an office to see the controls for yourself, or ask your Collabiro admin.