// security

off until you say so. on your server if you want.

teamhud sits on your desktop and in your calls, so it starts locked down. Here's what we enforce today, what we don't do yet, and how to run the whole thing yourself.

// privacy by default

nothing captured you didn't turn on.

Anything that captures people's audio, video, screens or messages ships off. An admin allows it, a person starts it, and everyone it touches can see it.

off by default. visible when on.

A new org can't record, transcribe or run AI meeting suggestions until an admin allows it. Then someone still has to press start.

While it runs, everyone in the call sees REC or CC. Guests consent first; members are told. Meeting audio is deleted no later than 30 days after recording stops.

// contained code

build anything. it still stays in its box.

The platform lets anyone write widgets. Custom widgets are treated as untrusted code from the first line.

widget ui
its own origin, no preload, talks to teamhud by message only
backend
its own process, locked to its own folder, allowlisted modules, no native add-ons
network
granted per host and method; an empty list means no network
permissions
granted explicitly, audited, revocable in Privacy & Security

// the honest part Our own built-in widgets and plugins are trusted first-party code and aren't sandboxed the same way. Third-party plugins can't be installed in release builds yet; when they can, they'll be signature-checked first.

How we contain untrusted code (PDF)

// the app and your data

locked down where it counts.

The short version, for people who skip to the spec sheet.

  • apprenderercontext isolation and sandbox forced on, Node off; CI blocks a regression
  • appnavigationnavigation, webviews and new windows guarded
  • datadatabaserow-level security on every table; production won't boot with a gap
  • datatenancyorgs and teams kept apart in the application layer too
  • datasecretsAES-256-GCM on the server, OS keychain on your machine; server keys stay server-side
  • callsmediaDTLS-SRTP on every hop; decrypted at the media server
  • callstokenseach call token works for one room
  • aidefaultoff; your own key or a local CLI; no model of ours
  • aivoicecommands recognized on your device by default
  • opslogsquery strings, and the tokens in them, stripped
  • opsdependenciesCI fails on a new security advisory
  • opsthis sitestrict CSP, no inline script, HSTS preload, no referrer

// known issues

what we don't do. yet.

You'd find these anyway. Better you hear them from us.

  • parkedend-to-end encrypted callsMedia is decrypted at the media server. Run your own server to keep it on your network.
  • plannedMFA, SAML and generic OIDCEmail and password, Slack and Microsoft sign-in today. More SSO is on the enterprise track.
  • not yetcertificationsNo SOC 2, ISO 27001 or third-party audit yet.
  • in progresssigned auto-updatesRelease signing is being set up.
  • plannedself-service export and deletionAsk us and we'll do it by hand until it's in the product.

seen enough to try it?

// get started

// found something? Email support@teamhud.app with "security" in the subject. A person will answer. For everything else, find us on Discord.

// early access

kick the tires.

Try it in early access, poke at it, and tell us what you find. Pro is free during early access, while slots last.

Mac (Apple Silicon), Windows and Linux. Mobile is coming.

// early access

Every feature, free to use during early access while slots last. No card. It's early, so expect things to change.

// create your account // how getting started works

Already in? Sign in.