Security built in, not bolted on.

Your data is encrypted in transit and at rest

Messages, files and personal details are encrypted when they travel to and from CM Chat and while they are stored. Every workspace is kept separate, and every request is checked against the workspace it belongs to.

CM Chat is not end-to-end encrypted today: our servers process message content so that delivery, search and administration work.

Invite-only workspaces, passkeys and optional second steps

Nobody can create an account without an invitation. You sign in with a one-time code sent to your email, or with a passkey that uses your fingerprint, face or PIN. Workspace owners can require a second step for everyone. Sensitive administrator actions ask you to confirm it is you, and sessions can be reviewed and ended remotely.

Each workspace on its own address

Each workspace lives on its own web address, such as yourteam.cmchat.app, and nothing is shared between workspaces. The apps use no third-party scripts and no trackers.

A detailed log of admin activity

Sign-ins, invitations, role changes, settings changes, admin actions and file downloads are recorded. Workspace admins can review their log at any time.

Access from the countries you choose

Workspace owners decide which countries can reach their workspace, and connections from anywhere else are refused.

Deleting a channel or workspace

When you permanently delete a channel or a workspace, its data is made unreadable and then removed. Backups expire on a short schedule.

Protection around the edges

CM Chat is monitored, and automated protections filter abusive and unwanted traffic.

Detailed security documentation is available on request: security@cmchat.app. You can also read how we handle access, data and vulnerability reports in the Trust Center.