Trust Center · Access
Only the right people. On the right devices.
How people get into a workspace, how guests are limited, and how important actions are recorded.
Last reviewed October 2026
Signing in
Your workspace, your rules.
A workspace owner chooses how much checking applies to everyone.
- 1
Invitation
Nobody can create an account without an invitation. Invitation links are single-use and expire.
- 2
Email code or passkey
Sign in with a one-time code sent to your email, or with a passkey. Codes expire quickly.
- 3
Second step (optional)
Owners can require a second step for everyone: a passkey, an authenticator app or a recovery code.
- 4
Confirm for admin work
Sensitive administrator actions ask you to confirm it is you.
- Passkeys
- A passkey works only on your real workspace address, so a look-alike website cannot use it. Owners can require passkeys for administrators.
- Recovery
- Recovery codes are available as a way back in if a device is lost.
- No account guessing
- The sign-in page never reveals whether an email address has an account.
- Default
- The second step is off by default, so the emailed code alone signs a person in. Owners who want more turn the second step on.
Sessions and devices
Limited, listed and revocable.
- Time limits
- Sessions end after a period of inactivity and after a maximum time. Owners set both, and guests get shorter limits by default.
- One workspace per session
- A session works only on the workspace it was created for.
- Review and sign out
- People can see their own signed-in devices and end any of them. Admins can see every session in the workspace and sign a device or a person out everywhere.
Who is in the workspace
Roles, invitations and guests.
Invite-only
Owners and admins invite people by email. Roles are owner, admin, member and guest, and they are enforced on every request.
Guests see little
A guest can reach only the channels they were added to, and sees only the people who share a channel with them.
Access that ends
A guest invitation carries an end date. After it, the account stops working. An admin can change the date.
Where people connect from
Countries you choose.
- Default
- New workspaces accept connections from the United States only.
- Change it
- Owners choose the allowed countries.
- What it is
- A control on who can connect. It is not a promise about where data is stored (see Data).
Protection
Guessing and abuse are slowed down.
- Sign-in protection
- Repeated failed attempts are limited and temporarily locked.
- Unusual traffic
- Known attack patterns and scanner traffic are filtered, and sign-in and contact forms use a bot check.
Admin activity log
A record of who did what.
What is recorded
- Sign-ins and failed sign-ins
- Invitations and role changes
- Channel creation, changes and deletion
- Messages deleted by an admin, and file downloads and removals
- Settings changes, and platform actions that touch your workspace
How it is handled
- Workspace admins can read the log, filter it and check it.
- Message text is never written to the log.
- Entries are kept for the life of the workspace.
NextData →
Questions from your security team?
Write to hello@cmchat.app and a person will reply. To report a vulnerability, write to security@cmchat.app (see how to report, and security.txt).
Detailed security documentation is available on request: security@cmchat.app.
Schools and districts: talk to us about your district's requirements. We would rather answer a specific question than hand you a badge.