Security

Encryption

• TLS 1.2 or better for everything in transit.
• Encryption at rest across our database, object storage and backups.
• End-to-end encryption for direct messages and encrypted channels, with keys held only on devices you have approved. We hold ciphertext and no key material.

Access control

• Role-based access control with per-workspace overrides and per-user exceptions, evaluated server-side on every request — the interface never decides what you may do.
• Workspace isolation on every query: a request carries the workspace it is scoped to, and data from another workspace is unreachable regardless of the URL.
• Session control — an administrator can end any session, and a password change or an account lock revokes every live session immediately.

Device trust

• A new device registers a keypair and must be approved by a device you already trust before it can read encrypted conversations.
• Linking a device by QR code compares a key fingerprint out of band, so a substituted key fails the check rather than silently succeeding.
• Biometric App Lock on iOS and Android, with the app switcher preview hidden while locked.

Monitoring and records

• Sign-in history including failed attempts, with IP and user agent, visible to workspace administrators.
• An administrative audit log of privileged actions, retained separately from application data.
• Configurable IP allowlisting and password policy per workspace.

Reporting a vulnerability

Send findings to privacy@projectri.com. We will acknowledge within two business days. Please give us a reasonable window to fix an issue before disclosing it, and do not access data that is not yours while testing.