Security and data protection

Calls are established over WebRTC. WebRTC does not make encryption optional: media travels as SRTP with keys derived from a DTLS handshake. An unencrypted WebRTC media stream cannot be established by the browser in the first place.

• Keys are generated between the two browsers. The signalling server never sees key material.
• When a direct (P2P) connection can be established, media never touches our servers.
• There is no server-side media mixer (SFU/MCU); the stream is not decrypted and re-encrypted.
• There is NO call recording feature: neither browser-side nor server-side recording exists in the application, and no storage is defined for media.
• Live connection statistics in the agent panel are read from the browser’s own report (RTCStatsReport) and the encryption in use is visible on screen throughout the call — that is the browser’s measurement, not our claim.

Behind symmetric NAT or a corporate firewall a direct connection is not always possible. In that case media is relayed through a TURN server.

• The relay CANNOT open the content: because the DTLS keys stay at the endpoints, TURN only forwards encrypted packets.
• The TURN server (coturn) runs on our own infrastructure; media is not handed to a third-party relay service.
• TURN credentials are not static: they are generated per request with an HMAC and expire after roughly 6 hours. The shared secret stays on the server and is never sent to the client.
• Relaying to private network ranges (10/8, 172.16/12, 192.168/16, 169.254/16, 127/8) is denied — TURN cannot be turned into an internal network proxy.
• Per-user and total session quotas, a bandwidth ceiling and nonce rotation are enabled; the management interface (CLI) is disabled.

The browser needs STUN to learn its own public IP and port. That query goes to our own server; no request to a third-party server is made while the call is set up.

STUN only performs address discovery: it carries no media, chat or personal data. Public third-party servers used to be used here; they were removed because they could be.

• All signalling traffic goes over TLS (HTTPS and WSS); the WebSocket server (Laravel Reverb) is not exposed directly to the internet but sits behind a TLS-terminating reverse proxy.
• Connection descriptions (SDP) are stored with the session record so the mobile app can recover a dropped call. SDP carries the parties’ local and public IP addresses in the ICE candidate list; it is therefore subject to the IP retention period and is cleaned up automatically together with the IP.
• Visitor sessions are authenticated with an unguessable token; signalling channels are session-specific.

The phrase “end-to-end encrypted” on the site refers to audio and video. The following pass through the server, are stored there and are readable by us — we are obliged to state this plainly:

• Chat messages are kept as plain text in the database (they are not additionally encrypted at the application level).
• Shared files are written to a private disk outside the web root; downloads work only through a signed link valid for 30 minutes and stop working once it expires.
• Survey answers, the visitor’s name/email/phone and the call duration are recorded; the customer company sees the data of its own rooms in its panel.

The periods are read from the same source as the ones declared in the legal texts; they are not typed into this page. The “How” column is the name of the scheduled job that actually performs the deletion.

• Passwords are hashed with bcrypt; no plain-text password is stored anywhere and nobody, including support, can read one.
• Two-factor authentication (TOTP + recovery codes) can be enabled on every account; enabling it requires password confirmation.
• Login attempts are limited to five requests per minute per email and IP.
• Permissions are role-based (super admin / admin / agent / staff); customer company data is separated by organisation identifier and authorisation is checked on every request.
• The session cookie is HttpOnly and SameSite-restricted and is sent only over HTTPS in production; an idle session expires after 120 minutes.
• Administrative actions (who, what, when, severity) are written to the system history.

• All traffic runs over TLS; HSTS is enabled for one year and covers subdomains.
• Response headers: content-type sniffing disabled (nosniff), referrer restricted (strict-origin-when-cross-origin), camera/microphone/screen-sharing permissions explicitly declared.
• Panel pages can only be framed on their own origin. The support call widget, on the other hand, is DELIBERATELY framable on any site — embedding it in the customer’s site requires that; this is why the widget is separate and narrow in scope.
• CSRF protection is applied to form operations and rate limiting to public endpoints.

The current list of sub-processors, their purposes and locations is set out as a table in the Data Processing Agreement; the customer company is notified 30 days before a new sub-processor is added. Part of our server infrastructure is located in the European Union; processing in that scope is subject to the cross-border transfer provisions of the KVKK.

See the sub-processor table

This is the most useful part of a security page. We do not claim the following:

• No ISO 27001 or SOC 2 certification.
• No independent third-party penetration test report.
• No published uptime commitment or standard SLA; it is negotiated separately in an enterprise agreement.
• No paid vulnerability disclosure (bug bounty) programme.
• No end-to-end encryption for chat and files (detailed above).

If you have found a vulnerability, please write to us before disclosing it publicly. Selecting the “Vulnerability report” topic on the contact form is enough; we give a first response within five business days at the latest.

Machine-readable contact information is published at /.well-known/security.txt.

• Veri İşleme Sözleşmesi
• Aydınlatma Metni (KVKK)
• Gizlilik Politikası

If your security team has a question list we answer it directly; we provide written answers on architecture, data flow and authorisation. Start an enterprise conversation