Security overview

Bearicorn encrypts supported chat and task content on your device before sending it to the hub. This limits what someone with access to the server or a database backup can read.

Encryption is one part of security. Your devices, recovery phrase, server, backups, and the information needed to operate the service still need protection.

Content protection

Bearicorn protects supported content including:

• chat messages and attachments;
• task comments;
• task titles and descriptions; and
• task attachments.

Authorized devices decrypt this content for the user. The hub stores and delivers it without needing the readable content.

Information the hub still handles

The hub processes information needed to run the service, including accounts, team and room membership, permissions, timestamps, delivery activity, and attachment information such as type and size. Some task workflow information is also visible to the hub.

Read What the server can access for a practical summary.

What encryption does not prevent

End-to-end encryption does not protect against every risk:

• A compromised or unlocked device can expose content available to that user.
• A compromised server can interrupt the service or deliver a modified web client.
• An operator or attacker can delete data, block access, or retain backups.
• Losing the recovery phrase can permanently remove a user's ability to sign in.

Protect the whole deployment

Use HTTPS, keep the host and clients updated, restrict administrative access, protect every user device, and maintain tested backups. Treat service information and logs as sensitive even when message content is encrypted.

Recovery

Bearicorn cannot reconstruct a lost recovery phrase. Read Recovery phrase before creating or inviting accounts.