Security

Your company's data stays your company's

Every company's records sit in one database, and the database itself keeps them apart. Each table that holds a company's data names the company each row belongs to, and row-level security lets a request reach only its own company's rows. The server connects as a role that cannot switch that off, and in production it refuses to start if it could.

The Commons, the one shared place where companies meet, keeps its own records apart from every company's. People appear there only if they choose to, under the name or alias they pick, and a company is named only when one of its admins lists it. Direct messages never cross from one company to another.

Signing in

Passwords are stored only as scrypt hashes, never as the password itself. A new password needs at least 10 characters, and cannot be one of the 19,096 most common passwords.

After five failed sign-ins in a row, each further try has to wait longer: a minute, then two, then four, up to an hour.

You stay signed in through one cookie that the page's scripts cannot read and no other site can set. A session lasts 30 days at most and ends after 14 days unused, and resetting your password signs you out everywhere.

Rooms, calls and screens

The server decides who is in which room. A locked room admits only the people who were inside when it was locked and the people someone inside lets in, and nobody's position inside a locked room is passed to anyone the lock keeps out.

We carry voice, video and screens through LiveKit Cloud. Our server hands out a room's key only after its own check, and each speaker's browser tells LiveKit exactly who may receive each of their streams, so LiveKit refuses everyone else.

Alsa World doesn't record calls. A meeting's Record button saves what the person recording sees, with their own microphone, to a file on their own computer. Everyone in the room is told, the door says so, and the start and the stop are noted in your company's audit log.

Camera backgrounds are made in your browser before your picture is sent. The model that finds you in the picture is served from our own site, and a background picture of your own stays on your device.

In your browser

The site is served over HTTPS, with a strict content security policy: no scripts from anywhere else, no inline scripts, no eval. Fonts, pictures and code all come from our own server.

No ads, no trackers and no analytics. The only cookies are the ones that keep you signed in.

Other sites cannot frame our pages or read our files, and the camera, the microphone and screen sharing can be asked for by this site alone.

Limits and records

Signing in, signing up, password resets, invitations and this site's contact form all have rate limits, which slow password guessing to a crawl and cap how much e-mail any one address can make us send.

Sign-ins, sign-outs and every change to a company, its members, its invitations and its domains are written to an audit log that the app can add to but never change.

The server's logs never hold passwords, cookies or the one-time links sent by e-mail.

The server

Alsa World runs in one locked-down container on our server. The database and the cache can't be reached from the internet, each part runs as its own user with only the rights it needs, and nothing can change the container's files while it runs.

The database is backed up every night.

Still to come

Two-step sign-in, single sign-on through SAML and an export of your company's data are planned, not built. Alsa World hasn't had an outside security audit or a certification yet.

If you think you have found a security problem, please tell us through the contact form before you tell anyone else, so we can fix it first.